[Snort-devel] Re: Snort 2.3RC2 crashes on OpenBSD 3.5/i386

Befour07 befour07 at ...224...
Sat Dec 25 17:18:04 EST 2004


Hi

we finally managed to get a coredump (after some ulimit tweaking); the
backtrace is:

==============================================================================
~/snort-2.3.0RC2 # sudo gdb /usr/local/bin/snort snort.core
Password:
GNU gdb 4.16.1
Copyright 1996 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd3.5"...
Core was generated by `snort'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/local/lib/libpcre.so.0.1...done.
Reading symbols from /usr/lib/libpcap.so.2.1...done.
Reading symbols from /usr/lib/libm.so.1.0...done.
Reading symbols from /usr/lib/libc.so.30.3...done.
Reading symbols from /usr/libexec/ld.so...done.
#0  0x4af3957 in pcap_read ()
(gdb) bt
#0  0x4af3957 in pcap_read ()
#1  0x4af3f1f in pcap_loop ()
#2  0x1c00f3b8 in InterfaceThread (arg=0x0) at snort.c:1746
#3  0x1c00e0a3 in SnortMain (argc=5, argv=0xcfbf2ec8) at snort.c:635
#4  0x1c00dab4 in main (argc=5, argv=0xcfbf2ec8) at snort.c:179
#5  0x1c002121 in ___start ()
#6  0x1c002097 in _start ()
#7  0xcfbf3054 in ?? ()
#8  0xe03c140c in ?? ()
Cannot access memory at address 0xa83d04b0.
==============================================================================

The crash occured at 21:28:24, so I attached a tcpdump pcap (with
obfuscated addresses, per company policy...) from 21:27:45 to 21:28:35.
I still have the original (recorded during the whole snort run), in
case I trimmed it down too much.

Thanks,

SL

On Tue, Dec 21, 2004 at 02:40:26PM -0500, Martin Roesch wrote:
> It's probably something to do with the tun0 interface that you're 
> sniffing on.  Can you make a  pcap of the traffic it's seeing and send 
> it in?  Do you have a backtrace of the core file?
> 
>      -Marty
> 
> On Dec 21, 2004, at 2:23 PM, Befour07 wrote:
> 
> >Hi,
> >
> >I'm on OpenBSD 3.5 on i386 (where I used to run the packaged Snort 2.0
> >without any problems).
> >
> >Yesterday I decided I would give 2.3rc2 a spin. I installed it and
> >tweaked the configuration a bit:
> >
> >  - disabled all the portscan preprocessors to minimize memory usage
> >  - used "config detection: search-method lowmem"
> >  - set my HOME_NET variable
> >
> >and ran it using:
> >
> >sudo /usr/local/bin/snort -c /etc/snort/snort.conf -A full -b -d -i
> >tun0 -o -u snortman -k none -v
> >
> >Problem is, it dies after a few minutes of operation, without any
> >"proper" error message: the only thing is, the last message it gives
> >is always about something not being an IPv4 datagram; during the last
> >crash, I got two of them at the end of snort's run:
> >
> >  Not IPv4 datagram! ([ver: 0x2][len: 0x0])
> >  Not IPv4 datagram! ([ver: 0x0][len: 0x1ba2])
> >
> >The crash before that, I got only one:
> >
> >  Not IPv4 datagram! ([ver: 0xf][len: 0xf457])
> >
> >Any ideas on what might be wrong ? I attached my snort.conf file to
> >this report...
> >
> >Thanks a lot for your time,
> >
> >SL
> ><snort.conf>
> -- 
> Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
> Sourcefire - Discover.  Determine.  Defend.
> roesch at ...402... - http://www.sourcefire.com
> Snort: Open Source Network IDS - http://www.snort.org
> 
> 
-------------- next part --------------
21:27:47.826164 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 149639:149772(133) ack 2297 win 57600 <nop,nop,timestamp 576370440 144797043> (DF) (ttl 44, id 38863)
21:27:47.826548 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 149772 win 34560 <nop,nop,timestamp 144797360 576370440> (DF) (ttl 63, id 42555)
21:27:50.527613 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 149772:149874(102) ack 2297 win 57600 <nop,nop,timestamp 576370710 144797360> (DF) (ttl 44, id 39775)
21:27:50.528069 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 149874 win 34560 <nop,nop,timestamp 144797630 576370710> (DF) (ttl 63, id 42556)
21:27:52.756156 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 149874:149970(96) ack 2297 win 57600 <nop,nop,timestamp 576370933 144797630> (DF) (ttl 44, id 40327)
21:27:52.756486 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 149970 win 34560 <nop,nop,timestamp 144797853 576370933> (DF) (ttl 63, id 42557)
21:27:57.910416 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: S [tcp sum ok] 3175034984:3175034984(0) win 16384 <mss 1452,nop,nop,sackOK> (DF) (ttl 108, id 13392)
21:27:57.911114 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: S [tcp sum ok] 4042615666:4042615666(0) ack 3175034985 win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 127, id 48549)
21:27:59.484678 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: . [tcp sum ok] ack 1 win 17424 (DF) (ttl 108, id 13438)
21:27:59.514680 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: P 1:72(71) ack 1 win 17424 (DF) (ttl 108, id 13440)
21:27:59.516819 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: P 1:101(100) ack 72 win 65464 (DF) (ttl 127, id 48550)
21:28:00.258762 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 149970:150059(89) ack 2297 win 57600 <nop,nop,timestamp 576371683 144797853> (DF) (ttl 44, id 42969)
21:28:00.259121 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150059 win 34560 <nop,nop,timestamp 144798603 576371683> (DF) (ttl 63, id 42558)
21:28:00.854914 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: P [tcp sum ok] 72:94(22) ack 101 win 17324 (DF) (ttl 108, id 13478)
21:28:01.033550 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: . [tcp sum ok] ack 94 win 65442 (DF) (ttl 127, id 48551)
21:28:02.017110 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: P [tcp sum ok] 94:116(22) ack 101 win 17324 (DF) (ttl 108, id 13507)
21:28:02.019742 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: P [tcp sum ok] 101:123(22) ack 116 win 65420 (DF) (ttl 127, id 48552)
21:28:02.440160 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150059:150142(83) ack 2297 win 57600 <nop,nop,timestamp 576371901 144798603> (DF) (ttl 44, id 43635)
21:28:02.440894 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150142 win 34560 <nop,nop,timestamp 144798821 576371901> (DF) (ttl 63, id 42559)
21:28:03.415079 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: F [tcp sum ok] 116:116(0) ack 123 win 17302 (DF) (ttl 108, id 13541)
21:28:03.415489 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: . [tcp sum ok] ack 117 win 65420 (DF) (ttl 127, id 48555)
21:28:03.415837 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.3457: F [tcp sum ok] 123:123(0) ack 117 win 65420 (DF) (ttl 127, id 48556)
21:28:04.146120 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 59352+% [1au] A? www.google.akadns.net. (50) (ttl 64, id 56896)
21:28:04.160416 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  59352 3/10/11 www.google.akadns.net. A 66.102.7.147, www.google.akadns.net.[|domain] (ttl 250, id 57564)
21:28:04.164515 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2501070536:2501070536(0) win 5840 <mss 1460,sackOK,timestamp 144798994 0,nop,wscale 0> (DF) (ttl 63, id 15322)
21:28:04.176006 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: S [tcp sum ok] 2300666608:2300666608(0) ack 2501070537 win 8190 <mss 1452> (ttl 244, id 64111)
21:28:04.176499 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 15323)
21:28:04.176929 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: P 1:495(494) ack 1 win 5840 (DF) (ttl 63, id 15324)
21:28:04.213708 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: . 1:1431(1430) ack 495 win 17204 [tos 0x10] (ttl 53, id 55895)
21:28:04.214388 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1431 win 8580 (DF) (ttl 63, id 15325)
21:28:04.222887 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: P 1431:1845(414) ack 495 win 17204 [tos 0x10] (ttl 53, id 55896)
21:28:04.223366 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1845 win 8580 (DF) (ttl 63, id 15326)
21:28:04.347464 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2488909850:2488909850(0) win 5840 <mss 1460,sackOK,timestamp 144799012 0,nop,wscale 0> (DF) (ttl 63, id 46398)
21:28:04.363497 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: S [tcp sum ok] 2263402446:2263402446(0) ack 2488909851 win 8190 <mss 1452> (ttl 244, id 26226)
21:28:04.363978 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 46399)
21:28:04.370318 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: P 1:468(467) ack 1 win 5840 (DF) (ttl 63, id 46400)
21:28:04.393777 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: . [tcp sum ok] ack 468 win 15929 [tos 0x10] (ttl 53, id 63731)
21:28:04.404136 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: . 1:1431(1430) ack 468 win 15929 [tos 0x10] (ttl 53, id 63732)
21:28:04.404770 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1431 win 8580 (DF) (ttl 63, id 46401)
21:28:04.414835 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: P 1431:2837(1406) ack 468 win 15929 [tos 0x10] (ttl 53, id 63733)
21:28:04.415523 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2837 win 11440 (DF) (ttl 63, id 46402)
21:28:04.427280 xxx.xxx.xxx.xxx.3457 > hhh.hhh.hhh.hhh.44662: . [tcp sum ok] ack 124 win 17302 (DF) (ttl 108, id 13571)
21:28:04.433850 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: . 2837:4267(1430) ack 468 win 15929 [tos 0x10] (ttl 53, id 63734)
21:28:04.434567 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4267 win 14300 (DF) (ttl 63, id 46403)
21:28:04.441661 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: . 4267:5697(1430) ack 468 win 15929 [tos 0x10] (ttl 53, id 63735)
21:28:04.442235 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5697 win 17160 (DF) (ttl 63, id 46404)
21:28:04.444381 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: P 5697:6660(963) ack 468 win 15929 [tos 0x10] (ttl 53, id 63736)
21:28:04.444994 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6660 win 20020 (DF) (ttl 63, id 46405)
21:28:04.509852 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: . 1845:3275(1430) ack 495 win 17204 [tos 0x10] (ttl 53, id 55897)
21:28:04.510444 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3275 win 11440 (DF) (ttl 63, id 15327)
21:28:04.515656 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: P 3275:4156(881) ack 495 win 17204 [tos 0x10] (ttl 53, id 55898)
21:28:04.516190 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4156 win 14300 (DF) (ttl 63, id 15328)
21:28:04.553495 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: P 468:928(460) ack 6660 win 20020 (DF) (ttl 63, id 46406)
21:28:04.555507 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: P 495:957(462) ack 4156 win 14300 (DF) (ttl 63, id 15329)
21:28:04.594819 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: P 4156:4737(581) ack 957 win 17158 [tos 0x10] (ttl 53, id 40050)
21:28:04.595281 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4737 win 17160 (DF) (ttl 63, id 15330)
21:28:04.595571 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: P 957:1416(459) ack 4737 win 17160 (DF) (ttl 63, id 15331)
21:28:04.608586 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: P 6660:7899(1239) ack 928 win 16688 [tos 0x10] (ttl 53, id 34950)
21:28:04.609154 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7899 win 22880 (DF) (ttl 63, id 46407)
21:28:04.609620 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: P 928:1387(459) ack 7899 win 22880 (DF) (ttl 63, id 46408)
21:28:04.624017 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: P 4737:5315(578) ack 1416 win 16065 [tos 0x10] (ttl 53, id 34034)
21:28:04.647395 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: . 7899:9329(1430) ack 1387 win 17808 [tos 0x10] (ttl 53, id 63636)
21:28:04.647745 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.64924: P 9329:9619(290) ack 1387 win 17808 [tos 0x10] (ttl 53, id 63637)
21:28:04.648111 hhh.hhh.hhh.hhh.64924 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 9619 win 25740 (DF) (ttl 63, id 46409)
21:28:04.663701 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5315 win 17160 (DF) (ttl 63, id 15332)
21:28:04.757356 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: P 1416:1769(353) ack 5315 win 17160 (DF) (ttl 63, id 15333)
21:28:04.793132 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: . 5315:6745(1430) ack 1769 win 16896 [tos 0x10] (ttl 53, id 1902)
21:28:04.793518 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58052: P 6745:6930(185) ack 1769 win 16896 [tos 0x10] (ttl 53, id 1903)
21:28:04.793777 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6745 win 20020 (DF) (ttl 63, id 15334)
21:28:04.793929 hhh.hhh.hhh.hhh.58052 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6930 win 20020 (DF) (ttl 63, id 15335)
21:28:06.992249 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150142:150237(95) ack 2297 win 57600 <nop,nop,timestamp 576372357 144798821> (DF) (ttl 44, id 45281)
21:28:06.992670 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150237 win 34560 <nop,nop,timestamp 144799276 576372357> (DF) (ttl 63, id 42560)
21:28:09.442224 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 930438515:930438515(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193475 0> (DF) (ttl 64, id 45800)
21:28:09.602566 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: S [tcp sum ok] 2675058611:2675058611(0) ack 930438516 win 31944 <mss 1452,sackOK,timestamp 982966571 2115193475,nop,wscale 0> (DF) (ttl 48, id 3214)
21:28:09.602726 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193475 982966571> (DF) (ttl 64, id 46766)
21:28:10.348145 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: P [tcp sum ok] 1:24(23) ack 1 win 31944 <nop,nop,timestamp 982966646 2115193475> (DF) (ttl 48, id 3468)
21:28:10.348400 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:17(16) ack 24 win 16384 <nop,nop,timestamp 2115193477 982966646> (DF) (ttl 64, id 41017)
21:28:10.508747 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: . [tcp sum ok] ack 17 win 31944 <nop,nop,timestamp 982966662 2115193477> (DF) (ttl 48, id 3529)
21:28:10.511933 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: P [tcp sum ok] 24:61(37) ack 17 win 31944 <nop,nop,timestamp 982966662 2115193477> (DF) (ttl 48, id 3530)
21:28:10.512159 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 17:30(13) ack 61 win 16384 <nop,nop,timestamp 2115193477 982966662> (DF) (ttl 64, id 33590)
21:28:10.677987 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: P 61:102(41) ack 30 win 31944 <nop,nop,timestamp 982966679 2115193477> (DF) (ttl 48, id 3615)
21:28:10.875004 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 102 win 16384 <nop,nop,timestamp 2115193478 982966679> (DF) (ttl 64, id 35798)
21:28:13.055232 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150237:150321(84) ack 2297 win 57600 <nop,nop,timestamp 576372963 144799276> (DF) (ttl 44, id 46859)
21:28:13.055652 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150321 win 34560 <nop,nop,timestamp 144799883 576372963> (DF) (ttl 63, id 42561)
21:28:13.604439 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: P [tcp sum ok] 2297:2325(28) ack 150321 win 34560 <nop,nop,timestamp 144799938 576372963> (DF) (ttl 63, id 42562)
21:28:13.685172 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 30:36(6) ack 102 win 16384 <nop,nop,timestamp 2115193484 982966679> (DF) (ttl 64, id 57897)
21:28:13.824536 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150321:150377(56) ack 2325 win 57600 <nop,nop,timestamp 576373040 144799938> (DF) (ttl 44, id 47165)
21:28:13.824965 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150377 win 34560 <nop,nop,timestamp 144799960 576373040> (DF) (ttl 63, id 42563)
21:28:13.847906 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: P [tcp sum ok] 102:111(9) ack 36 win 31944 <nop,nop,timestamp 982966996 2115193484> (DF) (ttl 48, id 4461)
21:28:13.848204 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 36:42(6) ack 111 win 16384 <nop,nop,timestamp 2115193484 982966996> (DF) (ttl 64, id 44358)
21:28:14.011379 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: P [tcp sum ok] 111:135(24) ack 42 win 31944 <nop,nop,timestamp 982967012 2115193484> (DF) (ttl 48, id 4494)
21:28:14.011798 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 42:42(0) ack 135 win 16384 <nop,nop,timestamp 2115193484 982967012> (DF) (ttl 64, id 61372)
21:28:14.017234 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: F [tcp sum ok] 135:135(0) ack 42 win 31944 <nop,nop,timestamp 982967012 2115193484> (DF) (ttl 48, id 4495)
21:28:14.017412 hhh.hhh.hhh.hhh.2408 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 136 win 16384 <nop,nop,timestamp 2115193484 982967012> (DF) (ttl 64, id 33703)
21:28:14.020479 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 679303193:679303193(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193484 0> (DF) (ttl 64, id 41968)
21:28:14.035196 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: S [tcp sum ok] 1807155742:1807155742(0) ack 679303194 win 65535 <mss 1452,nop,wscale 0,nop,nop,timestamp 372499603 2115193484> (ttl 52, id 36156)
21:28:14.035376 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193484 372499603> (DF) (ttl 64, id 63445)
21:28:14.051022 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: P 1:58(57) ack 1 win 65535 <nop,nop,timestamp 372499604 2115193484> (DF) (ttl 52, id 36159)
21:28:14.051264 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:28(27) ack 58 win 16384 <nop,nop,timestamp 2115193484 372499604> (DF) (ttl 64, id 37903)
21:28:14.062954 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: . [tcp sum ok] ack 28 win 65535 <nop,nop,timestamp 372499606 2115193484> (DF) (ttl 52, id 36160)
21:28:14.063223 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: P [tcp sum ok] 58:86(28) ack 28 win 65535 <nop,nop,timestamp 372499606 2115193484> (DF) (ttl 52, id 36161)
21:28:14.063425 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 28:44(16) ack 86 win 16384 <nop,nop,timestamp 2115193484 372499606> (DF) (ttl 64, id 58647)
21:28:14.074456 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: . [tcp sum ok] ack 44 win 65535 <nop,nop,timestamp 372499607 2115193484> (DF) (ttl 52, id 36162)
21:28:14.078257 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: P 86:136(50) ack 44 win 65535 <nop,nop,timestamp 372499607 2115193484> (DF) (ttl 52, id 36168)
21:28:14.183853 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.2408: . [tcp sum ok] ack 43 win 31944 <nop,nop,timestamp 982967029 2115193484> (DF) (ttl 48, id 4531)
21:28:14.275113 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 136 win 16384 <nop,nop,timestamp 2115193485 372499607> (DF) (ttl 64, id 35283)
21:28:15.268876 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 58412+% [1au] A? reviews.cnet.com. (45) (ttl 64, id 63889)
21:28:15.281113 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  58412 2/3/1 reviews.cnet.com. CNAME c10-ssa-xw-lb.cnet.com., c10-ssa-xw-lb.cnet.com. (142) (ttl 250, id 61980)
21:28:15.282626 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 63597+% [1au] A? c10-ssa-xw-lb.cnet.com. (51) (ttl 64, id 61864)
21:28:15.293208 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  63597 1/3/1 c10-ssa-xw-lb.cnet.com. A 216.239.115.141 (120) (ttl 250, id 61984)
21:28:15.295152 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2500538629:2500538629(0) win 5840 <mss 1460,sackOK,timestamp 144800107 0,nop,wscale 0> (DF) (ttl 63, id 18542)
21:28:15.315232 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: S [tcp sum ok] 2921573046:2921573046(0) ack 2500538630 win 8190 <mss 1452> (ttl 241, id 20196)
21:28:15.315591 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 18543)
21:28:15.315782 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 1:660(659) ack 1 win 5840 (DF) (ttl 63, id 18544)
21:28:15.344899 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . [tcp sum ok] ack 660 win 6980 (DF) (ttl 50, id 42797)
21:28:17.092301 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 44:50(6) ack 136 win 16384 <nop,nop,timestamp 2115193490 372499607> (DF) (ttl 64, id 62847)
21:28:17.102599 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: . [tcp sum ok] ack 50 win 65535 <nop,nop,timestamp 372499910 2115193490> (DF) (ttl 52, id 36370)
21:28:17.105308 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: P [tcp sum ok] 136:145(9) ack 50 win 65535 <nop,nop,timestamp 372499910 2115193490> (DF) (ttl 52, id 36371)
21:28:17.105601 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 50:56(6) ack 145 win 16384 <nop,nop,timestamp 2115193490 372499910> (DF) (ttl 64, id 40982)
21:28:17.116826 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: . [tcp sum ok] ack 56 win 65535 <nop,nop,timestamp 372499911 2115193490> (DF) (ttl 52, id 36373)
21:28:17.117087 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: P [tcp sum ok] 145:155(10) ack 56 win 65535 <nop,nop,timestamp 372499911 2115193490> (DF) (ttl 52, id 36374)
21:28:17.117301 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 56:56(0) ack 155 win 16384 <nop,nop,timestamp 2115193490 372499911> (DF) (ttl 64, id 54642)
21:28:17.121119 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: F [tcp sum ok] 155:155(0) ack 56 win 65535 <nop,nop,timestamp 372499911 2115193490> (DF) (ttl 52, id 36375)
21:28:17.121299 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 156 win 16384 <nop,nop,timestamp 2115193490 372499911> (DF) (ttl 64, id 44105)
21:28:17.123839 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 219101253:219101253(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193490 0> (DF) (ttl 64, id 37907)
21:28:17.135315 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.37052: F [tcp sum ok] 155:155(0) ack 57 win 65534 <nop,nop,timestamp 372499912 2115193490> (DF) (ttl 52, id 36376)
21:28:17.135462 hhh.hhh.hhh.hhh.37052 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 156 win 16384 <nop,nop,timestamp 2115193490 372499912> (DF) (ttl 64, id 39145)
21:28:17.293231 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: S [tcp sum ok] 4282863313:4282863313(0) ack 219101254 win 5792 <mss 1452,sackOK,timestamp 28745753 2115193490,nop,wscale 7> (DF) (ttl 43, id 0)
21:28:17.293386 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193491 28745753> (DF) (ttl 64, id 54250)
21:28:17.470708 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: P 1:57(56) ack 1 win 46 <nop,nop,timestamp 28745933 2115193491> (DF) (ttl 43, id 60946)
21:28:17.470981 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:25(24) ack 57 win 16384 <nop,nop,timestamp 2115193491 28745933> (DF) (ttl 64, id 45690)
21:28:17.636688 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: . [tcp sum ok] ack 25 win 46 <nop,nop,timestamp 28746098 2115193491> (DF) (ttl 43, id 60947)
21:28:17.637121 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: P [tcp sum ok] 57:96(39) ack 25 win 46 <nop,nop,timestamp 28746098 2115193491> (DF) (ttl 43, id 60948)
21:28:17.637341 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 25:38(13) ack 96 win 16384 <nop,nop,timestamp 2115193491 28746098> (DF) (ttl 64, id 43734)
21:28:17.818335 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: P [tcp sum ok] 96:135(39) ack 38 win 46 <nop,nop,timestamp 28746281 2115193491> (DF) (ttl 43, id 60949)
21:28:18.015279 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 135 win 16384 <nop,nop,timestamp 2115193492 28746281> (DF) (ttl 64, id 33029)
21:28:18.579890 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 1:1453(1452) ack 660 win 6980 (ttl 241, id 33930)
21:28:18.580529 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1453 win 8712 (DF) (ttl 63, id 18545)
21:28:18.588905 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 1453:2905(1452) ack 660 win 6980 (ttl 241, id 34442)
21:28:18.589517 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2905 win 11616 (DF) (ttl 63, id 18546)
21:28:18.605375 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 2905:4357(1452) ack 660 win 6980 (ttl 241, id 53900)
21:28:18.606006 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4357 win 14520 (DF) (ttl 63, id 18547)
21:28:18.608522 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 63799+% [1au] A? a868.g.akamai.net. (46) (ttl 64, id 44221)
21:28:18.609024 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 62696+% [1au] A? n0g.akamai.net. (43) (ttl 64, id 58962)
21:28:18.609462 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 37528+% [1au] A? n1g.akamai.net. (43) (ttl 64, id 54654)
21:28:18.609897 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 44412+% [1au] A? n2g.akamai.net. (43) (ttl 64, id 48795)
21:28:18.610365 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 64001+% [1au] A? n3g.akamai.net. (43) (ttl 64, id 50843)
21:28:18.610841 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 38427+% [1au] A? n4g.akamai.net. (43) (ttl 64, id 52812)
21:28:18.611407 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 4357:5809(1452) ack 660 win 6980 (ttl 241, id 54412)
21:28:18.611982 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5809 win 17424 (DF) (ttl 63, id 18548)
21:28:18.612258 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 37459+% [1au] A? n5g.akamai.net. (43) (ttl 64, id 46690)
21:28:18.612746 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 36196+% [1au] A? n6g.akamai.net. (43) (ttl 64, id 53152)
21:28:18.613231 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 41634+% [1au] A? n7g.akamai.net. (43) (ttl 64, id 63625)
21:28:18.613738 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 41279+% [1au] A? n8g.akamai.net. (43) (ttl 64, id 60749)
21:28:18.621367 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 5809:7261(1452) ack 660 win 6980 (ttl 241, id 54924)
21:28:18.621982 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7261 win 20328 (DF) (ttl 63, id 18549)
21:28:18.629112 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 7261:8713(1452) ack 660 win 6980 (ttl 241, id 22669)
21:28:18.629712 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8713 win 23232 (DF) (ttl 63, id 18550)
21:28:18.644801 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 8713:10165(1452) ack 660 win 6980 (ttl 241, id 23181)
21:28:18.645489 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10165 win 26136 (DF) (ttl 63, id 18551)
21:28:18.652614 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 10165:11617(1452) ack 660 win 6980 (ttl 241, id 23693)
21:28:18.653219 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 11617 win 29040 (DF) (ttl 63, id 18552)
21:28:18.655620 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 11617:13069(1452) ack 660 win 6980 (ttl 241, id 8079)
21:28:18.656207 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13069 win 31944 (DF) (ttl 63, id 18553)
21:28:18.665401 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 13069:14521(1452) ack 660 win 6980 (ttl 241, id 8591)
21:28:18.665957 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 14521 win 34848 (DF) (ttl 63, id 18554)
21:28:18.674489 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 14521:15866(1345) ack 660 win 6980 (ttl 241, id 9103)
21:28:18.674813 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  63799 2/9/1 a868.g.akamai.net. A 64.164.108.155, a868.g.akamai.net. A[|domain] (ttl 250, id 63207)
21:28:18.675072 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15866 win 34848 (DF) (ttl 63, id 18555)
21:28:18.677514 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  62696 1/8/9 n0g.akamai.net. A 69.225.175.44 (334) (ttl 250, id 63209)
21:28:18.677872 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2515053958:2515053958(0) win 5840 <mss 1460,sackOK,timestamp 144800445 0,nop,wscale 0> (DF) (ttl 63, id 55099)
21:28:18.679548 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  37528 1/8/9 n1g.akamai.net. A 69.225.175.53 (334) (ttl 250, id 63216)
21:28:18.681893 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  44412 1/8/9 n2g.akamai.net. A 69.225.175.60 (334) (ttl 250, id 63221)
21:28:18.684349 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  64001 1/8/9 n3g.akamai.net. A 69.225.175.70 (334) (ttl 250, id 63222)
21:28:18.689259 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  38427 1/8/9 n4g.akamai.net. A 69.225.175.44 (334) (ttl 250, id 63223)
21:28:18.690885 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  37459 1/8/9 n5g.akamai.net. A 69.225.175.44 (334) (ttl 250, id 63225)
21:28:18.692044 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  36196 1/8/9 n6g.akamai.net. A 166.90.133.228 (334) (ttl 250, id 63235)
21:28:18.695384 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  41634 1/8/9 n7g.akamai.net. A 205.161.7.99 (334) (ttl 250, id 63236)
21:28:18.697046 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  41279 1/8/9 n8g.akamai.net. A 69.225.175.44 (334) (ttl 250, id 63241)
21:28:18.697645 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: S [tcp sum ok] 2690733719:2690733719(0) ack 2515053959 win 5792 <mss 1452,sackOK,timestamp 3552036714 144800445,nop,wscale 0> (DF) (ttl 57, id 0)
21:28:18.698088 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800447 3552036714> (DF) (ttl 63, id 55100)
21:28:18.698266 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 1:514(513) ack 1 win 5840 <nop,nop,timestamp 144800447 3552036714> (DF) (ttl 63, id 55101)
21:28:18.722884 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . [tcp sum ok] ack 514 win 6432 <nop,nop,timestamp 3552036744 144800447> (DF) (ttl 57, id 37345)
21:28:18.736289 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 1:1441(1440) ack 514 win 6432 <nop,nop,timestamp 3552036746 144800447> (DF) (ttl 57, id 37346)
21:28:18.736927 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1441 win 8640 <nop,nop,timestamp 144800451 3552036746> (DF) (ttl 63, id 55102)
21:28:18.745423 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 1441:2881(1440) ack 514 win 6432 <nop,nop,timestamp 3552036746 144800447> (DF) (ttl 57, id 37347)
21:28:18.746067 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2881 win 11520 <nop,nop,timestamp 144800452 3552036746> (DF) (ttl 63, id 55103)
21:28:18.754174 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 2881:4321(1440) ack 514 win 6432 <nop,nop,timestamp 3552036746 144800447> (DF) (ttl 57, id 37348)
21:28:18.754779 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4321 win 14400 <nop,nop,timestamp 144800453 3552036746> (DF) (ttl 63, id 55104)
21:28:18.761988 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 4321:5761(1440) ack 514 win 6432 <nop,nop,timestamp 3552036768 144800451> (DF) (ttl 57, id 37349)
21:28:18.762645 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5761 win 17280 <nop,nop,timestamp 144800453 3552036768> (DF) (ttl 63, id 55105)
21:28:18.769808 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 5761:7201(1440) ack 514 win 6432 <nop,nop,timestamp 3552036768 144800451> (DF) (ttl 57, id 37350)
21:28:18.770394 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7201 win 20160 <nop,nop,timestamp 144800454 3552036768> (DF) (ttl 63, id 55106)
21:28:18.777627 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 7201:8641(1440) ack 514 win 6432 <nop,nop,timestamp 3552036777 144800452> (DF) (ttl 57, id 37351)
21:28:18.778264 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8641 win 23040 <nop,nop,timestamp 144800455 3552036777> (DF) (ttl 63, id 55107)
21:28:18.785619 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 8641:10081(1440) ack 514 win 6432 <nop,nop,timestamp 3552036777 144800452> (DF) (ttl 57, id 37352)
21:28:18.786268 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10081 win 25920 <nop,nop,timestamp 144800456 3552036777> (DF) (ttl 63, id 55108)
21:28:18.791347 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 10081:10704(623) ack 514 win 6432 <nop,nop,timestamp 3552036786 144800453> (DF) (ttl 57, id 37353)
21:28:18.791889 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10704 win 25920 <nop,nop,timestamp 144800456 3552036786> (DF) (ttl 63, id 55109)
21:28:18.798596 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 660:1192(532) ack 15866 win 34848 (DF) (ttl 63, id 18556)
21:28:18.832291 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . [tcp sum ok] ack 1192 win 31672 (DF) (ttl 50, id 1561)
21:28:18.839090 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 17326:17523(197) ack 1192 win 31672 (ttl 241, id 5790)
21:28:18.839509 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15866 win 34848 (DF) (ttl 63, id 18557)
21:28:18.840209 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . [tcp sum ok] 17318:17326(8) ack 1192 win 31672 (ttl 241, id 5278)
21:28:18.840488 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15866 win 34848 (DF) (ttl 63, id 18558)
21:28:18.849138 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 15866:17318(1452) ack 1192 win 31672 (ttl 241, id 4766)
21:28:18.849774 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17523 win 34848 (DF) (ttl 63, id 18559)
21:28:18.853001 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 514:1023(509) ack 10704 win 25920 <nop,nop,timestamp 144800462 3552036786> (DF) (ttl 63, id 55110)
21:28:18.886319 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 10704:12144(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036899 144800462> (DF) (ttl 57, id 37354)
21:28:18.886995 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 12144 win 28800 <nop,nop,timestamp 144800466 3552036899> (DF) (ttl 63, id 55111)
21:28:18.895179 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 12144:13584(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036900 144800462> (DF) (ttl 57, id 37355)
21:28:18.895875 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13584 win 31680 <nop,nop,timestamp 144800467 3552036900> (DF) (ttl 63, id 55112)
21:28:18.904916 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 13584:15024(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036900 144800462> (DF) (ttl 57, id 37356)
21:28:18.905462 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15024 win 34560 <nop,nop,timestamp 144800468 3552036900> (DF) (ttl 63, id 55113)
21:28:18.912911 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 15024:16464(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036900 144800462> (DF) (ttl 57, id 37357)
21:28:18.925431 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 16464:17904(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036900 144800462> (DF) (ttl 57, id 37358)
21:28:18.926087 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17904 win 34560 <nop,nop,timestamp 144800470 3552036900> (DF) (ttl 63, id 55114)
21:28:18.933894 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 17904:19344(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036900 144800462> (DF) (ttl 57, id 37359)
21:28:18.939700 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 19344:20784(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036918 144800466> (DF) (ttl 57, id 37360)
21:28:18.940316 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 20784 win 34560 <nop,nop,timestamp 144800471 3552036900> (DF) (ttl 63, id 55115)
21:28:18.948398 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 20784:22224(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036918 144800466> (DF) (ttl 57, id 37361)
21:28:18.957353 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 22224:23664(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036933 144800467> (DF) (ttl 57, id 37362)
21:28:18.957930 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 23664 win 34560 <nop,nop,timestamp 144800473 3552036918> (DF) (ttl 63, id 55116)
21:28:18.972958 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 23664:25104(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036933 144800467> (DF) (ttl 57, id 37363)
21:28:18.975435 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 25104:26544(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036936 144800468> (DF) (ttl 57, id 37364)
21:28:18.976049 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 26544 win 34560 <nop,nop,timestamp 144800475 3552036933> (DF) (ttl 63, id 55117)
21:28:18.985449 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 26544:27984(1440) ack 1023 win 7504 <nop,nop,timestamp 3552036936 144800468> (DF) (ttl 57, id 37365)
21:28:18.988944 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 27984:28760(776) ack 1023 win 7504 <nop,nop,timestamp 3552036957 144800470> (DF) (ttl 57, id 37366)
21:28:18.989413 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 28760 win 34560 <nop,nop,timestamp 144800476 3552036936> (DF) (ttl 63, id 55118)
21:28:18.998797 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 1192:1703(511) ack 17523 win 34848 (DF) (ttl 63, id 18560)
21:28:19.035428 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 17523:17928(405) ack 1703 win 15990 (ttl 241, id 9131)
21:28:19.035892 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17928 win 34848 (DF) (ttl 63, id 18561)
21:28:19.039787 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 17928:18949(1021) ack 1703 win 15990 (ttl 241, id 9643)
21:28:19.040248 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18949 win 34848 (DF) (ttl 63, id 18562)
21:28:19.043367 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 1703:2224(521) ack 18949 win 34848 (DF) (ttl 63, id 18563)
21:28:19.073211 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 18949:19354(405) ack 2224 win 16562 (ttl 241, id 11949)
21:28:19.073594 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P [tcp sum ok] 20806:20814(8) ack 2224 win 16562 (ttl 241, id 12973)
21:28:19.073985 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 19354 win 34848 (DF) (ttl 63, id 18564)
21:28:19.075404 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 20814:21006(192) ack 2224 win 16562 (ttl 241, id 13741)
21:28:19.075747 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 19354 win 34848 (DF) (ttl 63, id 18565)
21:28:19.085445 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 19354:20806(1452) ack 2224 win 16562 (ttl 241, id 12461)
21:28:19.086099 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 21006 win 34848 (DF) (ttl 63, id 18566)
21:28:19.090323 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 2224:2743(519) ack 21006 win 34848 (DF) (ttl 63, id 18567)
21:28:19.119945 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . [tcp sum ok] ack 2743 win 19584 (DF) (ttl 50, id 48741)
21:28:19.120309 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 21006:21412(406) ack 2743 win 19584 (ttl 241, id 433)
21:28:19.120618 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P [tcp sum ok] 22864:22872(8) ack 2743 win 19584 (ttl 241, id 2993)
21:28:19.120953 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 21412 win 34848 (DF) (ttl 63, id 18568)
21:28:19.129787 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 21412:22864(1452) ack 2743 win 19584 (ttl 241, id 2481)
21:28:19.130454 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 22872 win 34848 (DF) (ttl 63, id 18569)
21:28:19.136606 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P [tcp sum ok] 24324:24332(8) ack 2743 win 19584 (ttl 241, id 4017)
21:28:19.136966 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 22872 win 34848 (DF) (ttl 63, id 18570)
21:28:19.139518 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 22872:24324(1452) ack 2743 win 19584 (ttl 241, id 3505)
21:28:19.139847 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P [tcp sum ok] 25784:25792(8) ack 2743 win 19584 (ttl 241, id 5553)
21:28:19.140232 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 24332 win 34848 (DF) (ttl 63, id 18571)
21:28:19.140312 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 24332 win 34848 (DF) (ttl 63, id 18572)
21:28:19.143924 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 25792:26448(656) ack 2743 win 19584 (ttl 241, id 6065)
21:28:19.144448 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 24332 win 34848 (DF) (ttl 63, id 18573)
21:28:19.155436 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: . 24332:25784(1452) ack 2743 win 19584 (ttl 241, id 5041)
21:28:19.156073 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 26448 win 34848 (DF) (ttl 63, id 18574)
21:28:19.161287 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 39345+% [1au] A? c1.zedo.com. (40) (ttl 64, id 59710)
21:28:19.190986 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  39345 10/9/10 c1.zedo.com. CNAME[|domain] (ttl 250, id 63564)
21:28:19.193228 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 52314+% [1au] A? a1979.g.akamai.net. (47) (ttl 64, id 40925)
21:28:19.215108 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  52314 8/9/10 a1979.g.akamai.net. A 64.164.108.165, a1979.g.akamai.net. A[|domain] (ttl 250, id 63570)
21:28:19.218451 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2511746800:2511746800(0) win 5840 <mss 1460,sackOK,timestamp 144800499 0,nop,wscale 0> (DF) (ttl 63, id 19459)
21:28:19.235395 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: S [tcp sum ok] 2677759761:2677759761(0) ack 2511746801 win 5792 <mss 1452,sackOK,timestamp 103625170 144800499,nop,wscale 0> (DF) (ttl 57, id 0)
21:28:19.235797 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800501 103625170> (DF) (ttl 63, id 19460)
21:28:19.235944 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: P 1:485(484) ack 1 win 5840 <nop,nop,timestamp 144800501 103625170> (DF) (ttl 63, id 19461)
21:28:19.257388 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: . [tcp sum ok] ack 485 win 6432 <nop,nop,timestamp 103625195 144800501> (DF) (ttl 57, id 28367)
21:28:19.269824 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: . 1:1441(1440) ack 485 win 6432 <nop,nop,timestamp 103625196 144800501> (DF) (ttl 57, id 28368)
21:28:19.270381 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1441 win 8640 <nop,nop,timestamp 144800504 103625196> (DF) (ttl 63, id 19462)
21:28:19.277488 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: . 1441:2881(1440) ack 485 win 6432 <nop,nop,timestamp 103625196 144800501> (DF) (ttl 57, id 28369)
21:28:19.278110 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2881 win 11520 <nop,nop,timestamp 144800505 103625196> (DF) (ttl 63, id 19463)
21:28:19.285594 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: P 2881:4321(1440) ack 485 win 6432 <nop,nop,timestamp 103625196 144800501> (DF) (ttl 57, id 28370)
21:28:19.286239 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4321 win 14400 <nop,nop,timestamp 144800506 103625196> (DF) (ttl 63, id 19464)
21:28:19.290166 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61372: P 4321:5010(689) ack 485 win 6432 <nop,nop,timestamp 103625222 144800504> (DF) (ttl 57, id 28371)
21:28:19.290585 hhh.hhh.hhh.hhh.61372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5010 win 17280 <nop,nop,timestamp 144800506 103625222> (DF) (ttl 63, id 19465)
21:28:19.306283 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 1023:1542(519) ack 28760 win 34560 <nop,nop,timestamp 144800508 3552036936> (DF) (ttl 63, id 55119)
21:28:19.306883 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2512298195:2512298195(0) win 5840 <mss 1460,sackOK,timestamp 144800508 0,nop,wscale 0> (DF) (ttl 63, id 55855)
21:28:19.307588 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2509533012:2509533012(0) win 5840 <mss 1460,sackOK,timestamp 144800508 0,nop,wscale 0> (DF) (ttl 63, id 5544)
21:28:19.307980 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 2743:3257(514) ack 26448 win 34848 (DF) (ttl 63, id 18575)
21:28:19.327110 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2513750098:2513750098(0) win 5840 <mss 1460,sackOK,timestamp 144800510 0,nop,wscale 0> (DF) (ttl 63, id 45740)
21:28:19.328097 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 63896+% [1au] A? ad.3ad.doubleclick.net. (51) (ttl 64, id 34936)
21:28:19.330255 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2511875914:2511875914(0) win 5840 <mss 1460,sackOK,timestamp 144800510 0,nop,wscale 0> (DF) (ttl 63, id 21940)
21:28:19.332048 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 28760:29225(465) ack 1542 win 8576 <nop,nop,timestamp 3552037351 144800508> (DF) (ttl 57, id 37367)
21:28:19.332481 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 29225 win 34560 <nop,nop,timestamp 144800510 3552037351> (DF) (ttl 63, id 55120)
21:28:19.332806 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 1542:2059(517) ack 29225 win 34560 <nop,nop,timestamp 144800510 3552037351> (DF) (ttl 63, id 55121)
21:28:19.333215 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: S [tcp sum ok] 2690822807:2690822807(0) ack 2512298196 win 5792 <mss 1452,sackOK,timestamp 3552037352 144800508,nop,wscale 0> (DF) (ttl 57, id 0)
21:28:19.333596 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800510 3552037352> (DF) (ttl 63, id 55856)
21:28:19.333911 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 1:522(521) ack 1 win 5840 <nop,nop,timestamp 144800510 3552037352> (DF) (ttl 63, id 55857)
21:28:19.335547 hhh.hhh.hhh.hhh.62259 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2508311470:2508311470(0) win 5840 <mss 1460,sackOK,timestamp 144800511 0,nop,wscale 0> (DF) (ttl 63, id 45393)
21:28:19.336101 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: S [tcp sum ok] 4234304766:4234304766(0) ack 2509533013 win 8190 <mss 1452> (ttl 241, id 50931)
21:28:19.336463 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 5545)
21:28:19.336628 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: P 1:627(626) ack 1 win 5840 (DF) (ttl 63, id 5546)
21:28:19.354712 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60845: S [tcp sum ok] 2988691628:2988691628(0) ack 2513750099 win 8190 <mss 1452> (ttl 241, id 19447)
21:28:19.355083 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 45741)
21:28:19.355259 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: P 1:627(626) ack 1 win 5840 (DF) (ttl 63, id 45742)
21:28:19.358704 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 26448:26950(502) ack 3257 win 15764 (ttl 241, id 19137)
21:28:19.359179 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 26950 win 34848 (DF) (ttl 63, id 18576)
21:28:19.361401 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  63896 1/8/9 ad.3ad.doubleclick.net. A 216.73.86.58 (387) (ttl 250, id 63627)
21:28:19.364415 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2515042965:2515042965(0) win 5840 <mss 1460,sackOK,timestamp 144800513 0,nop,wscale 0> (DF) (ttl 63, id 63892)
21:28:19.364596 hhh.hhh.hhh.hhh.55298 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2505957287:2505957287(0) win 5840 <mss 1460,sackOK,timestamp 144800513 0,nop,wscale 0> (DF) (ttl 63, id 42150)
21:28:19.364644 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: S [tcp sum ok] 289903208:289903208(0) ack 2511875915 win 8190 <mss 1452> (ttl 241, id 29377)
21:28:19.365055 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 21941)
21:28:19.365271 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: P 1:525(524) ack 1 win 5840 (DF) (ttl 63, id 21942)
21:28:19.382482 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 29225:30374(1149) ack 2059 win 9648 <nop,nop,timestamp 3552037398 144800510> (DF) (ttl 57, id 37368)
21:28:19.383413 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 2059:2577(518) ack 30374 win 34560 <nop,nop,timestamp 144800515 3552037398> (DF) (ttl 63, id 55122)
21:28:19.383866 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 3257:3784(527) ack 26950 win 34848 (DF) (ttl 63, id 18577)
21:28:19.391609 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 56397+% [1au] A? reviews-related.search.com. (55) (ttl 64, id 64610)
21:28:19.391809 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . [tcp sum ok] ack 522 win 6432 <nop,nop,timestamp 3552037413 144800510> (DF) (ttl 57, id 30863)
21:28:19.396767 hhh.hhh.hhh.hhh.56513 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2504918592:2504918592(0) win 5840 <mss 1460,sackOK,timestamp 144800517 0,nop,wscale 0> (DF) (ttl 63, id 32069)
21:28:19.400806 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 1:1441(1440) ack 522 win 6432 <nop,nop,timestamp 3552037414 144800510> (DF) (ttl 57, id 30864)
21:28:19.401482 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1441 win 8640 <nop,nop,timestamp 144800517 3552037414> (DF) (ttl 63, id 55858)
21:28:19.409396 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 1441:2881(1440) ack 522 win 6432 <nop,nop,timestamp 3552037414 144800510> (DF) (ttl 57, id 30865)
21:28:19.410045 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2881 win 11520 <nop,nop,timestamp 144800518 3552037414> (DF) (ttl 63, id 55859)
21:28:19.417277 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 2881:4159(1278) ack 522 win 6432 <nop,nop,timestamp 3552037414 144800510> (DF) (ttl 57, id 30866)
21:28:19.417912 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4159 win 14400 <nop,nop,timestamp 144800519 3552037414> (DF) (ttl 63, id 55860)
21:28:19.418187 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 522:1040(518) ack 4159 win 14400 <nop,nop,timestamp 144800519 3552037414> (DF) (ttl 63, id 55861)
21:28:19.418239 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.62259: S [tcp sum ok] 1504899513:1504899513(0) ack 2508311471 win 8190 <mss 1452> (ttl 241, id 62206)
21:28:19.418527 hhh.hhh.hhh.hhh.62259 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 45394)
21:28:19.418698 hhh.hhh.hhh.hhh.62259 > xxx.xxx.xxx.xxx.80: P 1:520(519) ack 1 win 5840 (DF) (ttl 63, id 45395)
21:28:19.420562 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: P 1:393(392) ack 627 win 32967 (ttl 241, id 12803)
21:28:19.421037 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 393 win 6432 (DF) (ttl 63, id 5547)
21:28:19.421429 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: P 627:1253(626) ack 393 win 6432 (DF) (ttl 63, id 5548)
21:28:19.442244 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60845: P 1:393(392) ack 627 win 13984 (ttl 241, id 11015)
21:28:19.442691 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 393 win 6432 (DF) (ttl 63, id 45743)
21:28:19.443109 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: P 627:1253(626) ack 393 win 6432 (DF) (ttl 63, id 45744)
21:28:19.445418 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  56397 2/3/1 reviews-related.search.com. CNAME[|domain] (ttl 250, id 63657)
21:28:19.447163 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 33007+% [1au] A? c10-ss-2-lb.cnet.com. (49) (ttl 64, id 60937)
21:28:19.468784 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 1:437(436) ack 525 win 18370 (ttl 241, id 32968)
21:28:19.469263 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 437 win 6432 (DF) (ttl 63, id 21943)
21:28:19.469792 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: P 525:1051(526) ack 437 win 6432 (DF) (ttl 63, id 21944)
21:28:19.497996 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 30374:31814(1440) ack 2577 win 10720 <nop,nop,timestamp 3552037509 144800515> (DF) (ttl 57, id 37369)
21:28:19.498569 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P [tcp sum ok] 31814:31832(18) ack 2577 win 10720 <nop,nop,timestamp 3552037510 144800515> (DF) (ttl 57, id 37370)
21:28:19.498856 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  33007 1/3/1 c10-ss-2-lb.cnet.com. A 216.239.115.152 (118) (ttl 250, id 63690)
21:28:19.499027 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 31832 win 34560 <nop,nop,timestamp 144800527 3552037509> (DF) (ttl 63, id 55123)
21:28:19.499276 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 2577:3096(519) ack 31832 win 34560 <nop,nop,timestamp 144800527 3552037509> (DF) (ttl 63, id 55124)
21:28:19.501466 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2510383018:2510383018(0) win 5840 <mss 1460,sackOK,timestamp 144800527 0,nop,wscale 0> (DF) (ttl 63, id 7333)
21:28:19.510472 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 57154+% [1au] A? image.com.com. (42) (ttl 64, id 52652)
21:28:19.512224 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 26950:27387(437) ack 3784 win 32900 (ttl 241, id 24779)
21:28:19.536172 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 4159:5599(1440) ack 1040 win 7504 <nop,nop,timestamp 3552037549 144800519> (DF) (ttl 57, id 30867)
21:28:19.537041 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P [tcp sum ok] 5599:5634(35) ack 1040 win 7504 <nop,nop,timestamp 3552037549 144800519> (DF) (ttl 57, id 30868)
21:28:19.537452 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5634 win 17280 <nop,nop,timestamp 144800531 3552037549> (DF) (ttl 63, id 55862)
21:28:19.537727 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 1040:1557(517) ack 5634 win 17280 <nop,nop,timestamp 144800531 3552037549> (DF) (ttl 63, id 55863)
21:28:19.539475 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  57154 2/3/1 image.com.com. CNAME c10-image-lb.cnet.com., [|domain] (ttl 250, id 63730)
21:28:19.540954 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 36262+% [1au] A? c10-image-lb.cnet.com. (50) (ttl 64, id 55817)
21:28:19.541240 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: S [tcp sum ok] 727534306:727534306(0) ack 2515042966 win 17424 <mss 1452,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 111, id 4116)
21:28:19.541604 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800531 0> (DF) (ttl 63, id 63893)
21:28:19.541640 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.55298: S [tcp sum ok] 727652680:727652680(0) ack 2505957288 win 17424 <mss 1452,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 111, id 4121)
21:28:19.541853 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: P 1:605(604) ack 1 win 5840 <nop,nop,timestamp 144800531 0> (DF) (ttl 63, id 63894)
21:28:19.541949 hhh.hhh.hhh.hhh.55298 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800531 0> (DF) (ttl 63, id 42151)
21:28:19.542094 hhh.hhh.hhh.hhh.55298 > xxx.xxx.xxx.xxx.80: P 1:608(607) ack 1 win 5840 <nop,nop,timestamp 144800531 0> (DF) (ttl 63, id 42152)
21:28:19.544745 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 27387 win 34848 (DF) (ttl 63, id 18578)
21:28:19.555412 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.62259: P 1:547(546) ack 520 win 9142 (ttl 241, id 39961)
21:28:19.555838 hhh.hhh.hhh.hhh.62259 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 547 win 6552 (DF) (ttl 63, id 45396)
21:28:19.574461 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: P 393:785(392) ack 1253 win 16905 (ttl 241, id 49948)
21:28:19.582261 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.56513: S [tcp sum ok] 1254799168:1254799168(0) ack 2504918593 win 6144 <mss 1452,wscale 0,nop,sackOK,nop,nop> (DF) (ttl 110, id 3205)
21:28:19.582581 hhh.hhh.hhh.hhh.56513 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 32070)
21:28:19.590077 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  36262 1/3/1 c10-image-lb.cnet.com. A 216.239.115.147 (119) (ttl 250, id 63751)
21:28:19.606984 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2506766829:2506766829(0) win 5840 <mss 1460,sackOK,timestamp 144800538 0,nop,wscale 0> (DF) (ttl 63, id 17143)
21:28:19.607108 hhh.hhh.hhh.hhh.56513 > xxx.xxx.xxx.xxx.80: P 1:631(630) ack 1 win 5840 (DF) (ttl 63, id 32071)
21:28:19.608064 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60845: P 393:785(392) ack 1253 win 26712 (ttl 241, id 17956)
21:28:19.614805 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 785 win 7504 (DF) (ttl 63, id 5549)
21:28:19.635394 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: . [tcp sum ok] ack 1051 win 8850 (DF) (ttl 50, id 17475)
21:28:19.636956 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 437:826(389) ack 1051 win 8850 (ttl 241, id 19923)
21:28:19.644799 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 785 win 7504 (DF) (ttl 63, id 45745)
21:28:19.644902 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 826:1533(707) ack 1051 win 8850 (ttl 241, id 21203)
21:28:19.645377 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1533 win 9191 (DF) (ttl 63, id 21945)
21:28:19.662875 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 31832:33189(1357) ack 3096 win 11792 <nop,nop,timestamp 3552037676 144800527> (DF) (ttl 57, id 37371)
21:28:19.663251 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: S [tcp sum ok] 4252547210:4252547210(0) ack 2510383019 win 8190 <mss 1452> (ttl 241, id 59182)
21:28:19.663538 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 7334)
21:28:19.663937 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: P 1:601(600) ack 1 win 5840 (DF) (ttl 63, id 7335)
21:28:19.664062 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 3096:3615(519) ack 33189 win 34560 <nop,nop,timestamp 144800543 3552037676> (DF) (ttl 63, id 55125)
21:28:19.691682 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 5634:7074(1440) ack 1557 win 8576 <nop,nop,timestamp 3552037701 144800531> (DF) (ttl 57, id 30869)
21:28:19.696026 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 7074:7867(793) ack 1557 win 8576 <nop,nop,timestamp 3552037701 144800531> (DF) (ttl 57, id 30870)
21:28:19.696670 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7867 win 20160 <nop,nop,timestamp 144800547 3552037701> (DF) (ttl 63, id 55864)
21:28:19.696943 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 1557:2078(521) ack 7867 win 20160 <nop,nop,timestamp 144800547 3552037701> (DF) (ttl 63, id 55865)
21:28:19.745404 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.62331: S [tcp sum ok] 1245363236:1245363236(0) ack 2506766830 win 8190 <mss 1452> (ttl 241, id 31804)
21:28:19.745744 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 17144)
21:28:19.745974 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: P 1:598(597) ack 1 win 5840 (DF) (ttl 63, id 17145)
21:28:19.787090 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: P 1:391(390) ack 601 win 7668 (ttl 241, id 9283)
21:28:19.787545 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 391 win 6432 (DF) (ttl 63, id 7336)
21:28:19.812067 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 33189:33653(464) ack 3615 win 12864 <nop,nop,timestamp 3552037832 144800543> (DF) (ttl 57, id 37372)
21:28:19.812947 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 3615:4133(518) ack 33653 win 34560 <nop,nop,timestamp 144800558 3552037832> (DF) (ttl 63, id 55126)
21:28:19.821315 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: . 1:1441(1440) ack 605 win 16820 <nop,nop,timestamp 807959 144800531> (DF) (ttl 111, id 4363)
21:28:19.821970 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1441 win 8640 <nop,nop,timestamp 144800559 807959> (DF) (ttl 63, id 63895)
21:28:19.831835 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: . 1441:2881(1440) ack 605 win 16820 <nop,nop,timestamp 807959 144800531> (DF) (ttl 111, id 4364)
21:28:19.832460 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2881 win 11520 <nop,nop,timestamp 144800560 807959> (DF) (ttl 63, id 63896)
21:28:19.832484 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: . [tcp sum ok] 2881:2905(24) ack 605 win 16820 <nop,nop,timestamp 807959 144800531> (DF) (ttl 111, id 4365)
21:28:19.832826 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2905 win 11520 <nop,nop,timestamp 144800560 807959> (DF) (ttl 63, id 63897)
21:28:19.835460 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.55298: FP 1:580(579) ack 608 win 16817 <nop,nop,timestamp 807959 144800531> (DF) (ttl 111, id 4385)
21:28:19.835921 hhh.hhh.hhh.hhh.55298 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 581 win 6948 <nop,nop,timestamp 144800561 807959> (DF) (ttl 63, id 42153)
21:28:19.836111 hhh.hhh.hhh.hhh.55298 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 608:608(0) ack 581 win 6948 <nop,nop,timestamp 144800561 807959> (DF) (ttl 63, id 42154)
21:28:19.843492 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 7867:9307(1440) ack 2078 win 9648 <nop,nop,timestamp 3552037852 144800547> (DF) (ttl 57, id 30871)
21:28:19.845131 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 36874+% [1au] A? m2.doubleclick.net. (47) (ttl 64, id 37767)
21:28:19.852620 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 9307:10747(1440) ack 2078 win 9648 <nop,nop,timestamp 3552037852 144800547> (DF) (ttl 57, id 30872)
21:28:19.853281 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10747 win 25920 <nop,nop,timestamp 144800562 3552037852> (DF) (ttl 63, id 55866)
21:28:19.860298 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 10747:11934(1187) ack 2078 win 9648 <nop,nop,timestamp 3552037852 144800547> (DF) (ttl 57, id 30873)
21:28:19.860985 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: P [tcp sum ok] 1843:1851(8) ack 601 win 7668 (ttl 241, id 63566)
21:28:19.861226 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 2078:2595(517) ack 11934 win 28800 <nop,nop,timestamp 144800563 3552037852> (DF) (ttl 63, id 55867)
21:28:19.861301 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 391 win 6432 (DF) (ttl 63, id 7337)
21:28:19.861477 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: P [tcp sum ok] 3303:3311(8) ack 601 win 7668 (ttl 241, id 64846)
21:28:19.861857 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 391 win 6432 (DF) (ttl 63, id 7338)
21:28:19.870351 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: . 391:1843(1452) ack 601 win 7668 (ttl 241, id 63054)
21:28:19.871052 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1851 win 8712 (DF) (ttl 63, id 7339)
21:28:19.879791 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: . 1851:3303(1452) ack 601 win 7668 (ttl 241, id 64334)
21:28:19.880168 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2511483002:2511483002(0) win 5840 <mss 1460,sackOK,timestamp 144800565 0,nop,wscale 0> (DF) (ttl 63, id 19279)
21:28:19.880378 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3311 win 11616 (DF) (ttl 63, id 7340)
21:28:19.885582 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: P [tcp sum ok] 4763:4771(8) ack 601 win 7668 (ttl 241, id 4431)
21:28:19.885907 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3311 win 11616 (DF) (ttl 63, id 7341)
21:28:19.886002 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: P 4771:5615(844) ack 601 win 7668 (ttl 241, id 5199)
21:28:19.886472 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3311 win 11616 (DF) (ttl 63, id 7342)
21:28:19.893532 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53816: . 3311:4763(1452) ack 601 win 7668 (ttl 241, id 3919)
21:28:19.894111 hhh.hhh.hhh.hhh.53816 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5615 win 14520 (DF) (ttl 63, id 7343)
21:28:19.902648 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.56513: P 1:1428(1427) ack 631 win 5514 (DF) (ttl 110, id 52615)
21:28:19.903317 hhh.hhh.hhh.hhh.56513 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1428 win 8562 (DF) (ttl 63, id 32072)
21:28:19.904943 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.62331: P 1:388(387) ack 598 win 33040 (ttl 241, id 14929)
21:28:19.905428 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 388 win 6432 (DF) (ttl 63, id 17146)
21:28:19.908889 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  45980+% [1au] A? cnet.links.origin.channelintelligence.com. (70) (ttl 64, id 62605)
21:28:19.909092 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  36874 3/7/8 m2.doubleclick.net. CNAME[|domain] (ttl 250, id 63912)
21:28:19.909335 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: P 1253:1899(646) ack 785 win 7504 (DF) (ttl 63, id 5550)
21:28:19.909874 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 50820+% [1au] A? ns1.channelintelligence.com. (56) (ttl 64, id 50726)
21:28:19.910383 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 64536+% [1au] A? ns2.channelintelligence.com. (56) (ttl 64, id 43047)
21:28:19.910908 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: P 1253:1879(626) ack 785 win 7504 (DF) (ttl 63, id 45746)
21:28:19.911680 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 33653:34234(581) ack 4133 win 13936 <nop,nop,timestamp 3552037925 144800558> (DF) (ttl 57, id 37373)
21:28:19.912644 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 4133:4652(519) ack 34234 win 34560 <nop,nop,timestamp 144800568 3552037925> (DF) (ttl 63, id 55127)
21:28:19.912913 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 60053+% [1au] A? dclick-cname.speedera.net. (54) (ttl 64, id 35399)
21:28:19.919404 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 3784:4318(534) ack 27387 win 34848 (DF) (ttl 63, id 18579)
21:28:19.919937 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: P 1051:1585(534) ack 1533 win 9191 (DF) (ttl 63, id 21946)
21:28:19.935330 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 11934:12645(711) ack 2595 win 10720 <nop,nop,timestamp 3552037953 144800563> (DF) (ttl 57, id 30874)
21:28:19.936195 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 2595:3122(527) ack 12645 win 28800 <nop,nop,timestamp 144800571 3552037953> (DF) (ttl 63, id 55868)
21:28:19.936438 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2512007040:2512007040(0) win 5840 <mss 1460,sackOK,timestamp 144800571 0,nop,wscale 0> (DF) (ttl 63, id 21691)
21:28:19.943764 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: FP 2905:4274(1369) ack 605 win 16820 <nop,nop,timestamp 807960 144800559> (DF) (ttl 111, id 4494)
21:28:19.944603 hhh.hhh.hhh.hhh.53372 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 605:605(0) ack 4275 win 14400 <nop,nop,timestamp 144800571 807960> (DF) (ttl 63, id 63898)
21:28:19.944762 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  45980 1/2/1 cnet.links.origin.channelintelligence.com. (122) (ttl 250, id 63938)
21:28:19.946714 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2508750949:2508750949(0) win 5840 <mss 1460,sackOK,timestamp 144800572 0,nop,wscale 0> (DF) (ttl 63, id 64345)
21:28:19.948027 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2502793574:2502793574(0) win 5840 <mss 1460,sackOK,timestamp 144800572 0,nop,wscale 0> (DF) (ttl 63, id 57946)
21:28:19.956463 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  60053 2/7/8 dclick-cname.speedera.net. A 216.73.85.156, dclick-cname.speedera.net. (310) (ttl 250, id 63950)
21:28:19.959254 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2514948604:2514948604(0) win 5840 <mss 1460,sackOK,timestamp 144800573 0,nop,wscale 0> (DF) (ttl 63, id 27329)
21:28:19.959630 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: S [tcp sum ok] 3316786219:3316786219(0) ack 2511483003 win 8190 <mss 1452> (ttl 241, id 17382)
21:28:19.960031 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 19280)
21:28:19.960179 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: P 1:507(506) ack 1 win 5840 (DF) (ttl 63, id 19281)
21:28:19.962784 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  50820 1/4/1 ns1.channelintelligence.com. A 66.77.3.55 (169) (ttl 250, id 63952)
21:28:19.963854 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  64536 1/4/1 ns2.channelintelligence.com. A 63.240.227.185 (169) (ttl 250, id 63953)
21:28:19.965036 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.55298: . [tcp sum ok] ack 609 win 16817 <nop,nop,timestamp 807961 144800561> (DF) (ttl 111, id 4523)
21:28:19.981012 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: P 785:1198(413) ack 1899 win 35040 (ttl 241, id 41061)
21:28:19.981428 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1198 win 8576 (DF) (ttl 63, id 5551)
21:28:19.981832 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: P 1899:2543(644) ack 1198 win 8576 (DF) (ttl 63, id 5552)
21:28:20.014938 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60845: P 785:1177(392) ack 1879 win 32967 (ttl 241, id 3692)
21:28:20.015432 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1177 win 8576 (DF) (ttl 63, id 45747)
21:28:20.015792 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: P 1879:2505(626) ack 1177 win 8576 (DF) (ttl 63, id 45748)
21:28:20.031605 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 34234:34667(433) ack 4652 win 15008 <nop,nop,timestamp 3552038051 144800568> (DF) (ttl 57, id 37374)
21:28:20.032422 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 4652:5167(515) ack 34667 win 34560 <nop,nop,timestamp 144800580 3552038051> (DF) (ttl 63, id 55128)
21:28:20.038026 hhh.hhh.hhh.hhh.56128 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2508704179:2508704179(0) win 5840 <mss 1460,sackOK,timestamp 144800581 0,nop,wscale 0> (DF) (ttl 63, id 45814)
21:28:20.049066 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: S [tcp sum ok] 2966509438:2966509438(0) win 59464 <mss 1408,nop,wscale 1,nop,nop,sackOK> (DF) [tos 0x20] (ttl 40, id 43925)
21:28:20.049543 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: S [tcp sum ok] 4048203775:4048203775(0) ack 2966509439 win 65535 <mss 1460,nop,wscale 0,nop,nop,sackOK> (DF) (ttl 127, id 48561)
21:28:20.058888 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 27387:27895(508) ack 4318 win 16580 (ttl 241, id 50666)
21:28:20.059342 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 27895 win 34848 (DF) (ttl 63, id 18580)
21:28:20.059744 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 4318:4851(533) ack 27895 win 34848 (DF) (ttl 63, id 18581)
21:28:20.082298 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 1533:2039(506) ack 1585 win 19375 (ttl 241, id 5356)
21:28:20.083233 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: P 1585:2122(537) ack 2039 win 10605 (DF) (ttl 63, id 21947)
21:28:20.083387 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53372: . [tcp sum ok] ack 606 win 16820 <nop,nop,timestamp 807962 144800571> (DF) (ttl 111, id 4647)
21:28:20.105461 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 12645:13159(514) ack 3122 win 11792 <nop,nop,timestamp 3552038122 144800571> (DF) (ttl 57, id 30875)
21:28:20.106339 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 3122:3636(514) ack 13159 win 28800 <nop,nop,timestamp 144800588 3552038122> (DF) (ttl 63, id 55869)
21:28:20.110125 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: S [tcp sum ok] 261789713:261789713(0) ack 2512007041 win 8190 <mss 1452> (ttl 241, id 41197)
21:28:20.110524 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 21692)
21:28:20.110688 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: P 1:475(474) ack 1 win 5840 (DF) (ttl 63, id 21693)
21:28:20.117723 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.63968: S [tcp sum ok] 3391412346:3391412346(0) ack 2502793575 win 8190 <mss 1452> (ttl 241, id 4479)
21:28:20.118045 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: S [tcp sum ok] 2690293533:2690293533(0) ack 2514948605 win 5792 <mss 1452,sackOK,timestamp 3857502513 144800573,nop,wscale 0> (DF) (ttl 56, id 0)
21:28:20.118250 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 57947)
21:28:20.118405 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: P 1:742(741) ack 1 win 5840 (DF) (ttl 63, id 57948)
21:28:20.118519 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800589 3857502513> (DF) (ttl 63, id 27330)
21:28:20.118701 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: P 1:518(517) ack 1 win 5840 <nop,nop,timestamp 144800589 3857502513> (DF) (ttl 63, id 27331)
21:28:20.135988 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 1453:1461(8) ack 507 win 31226 (ttl 241, id 23791)
21:28:20.136313 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 19282)
21:28:20.144800 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: P 1461:2154(693) ack 507 win 31226 (ttl 241, id 24815)
21:28:20.145270 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 19283)
21:28:20.150822 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 1:1453(1452) ack 507 win 31226 (ttl 241, id 23279)
21:28:20.151349 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52107: S [tcp sum ok] 1274314935:1274314935(0) ack 2508750950 win 17424 <mss 1452,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 112, id 47815)
21:28:20.151564 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2154 win 8712 (DF) (ttl 63, id 19284)
21:28:20.151747 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800592 0> (DF) (ttl 63, id 64346)
21:28:20.152040 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: P 1:655(654) ack 1 win 5840 <nop,nop,timestamp 144800592 0> (DF) (ttl 63, id 64347)
21:28:20.152151 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: P 507:988(481) ack 2154 win 8712 (DF) (ttl 63, id 19285)
21:28:20.162639 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: P 1198:1595(397) ack 2543 win 11920 (ttl 241, id 40582)
21:28:20.163476 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: P 2543:3169(626) ack 1595 win 8576 (DF) (ttl 63, id 5553)
21:28:20.193683 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60845: P 1177:1569(392) ack 2505 win 32967 (ttl 241, id 42379)
21:28:20.194180 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 55920+% [1au] A? z1.adserver.com. (44) (ttl 64, id 35711)
21:28:20.194817 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 56945+% [1au] A? ns1.ptld.twtelecom.net. (51) (ttl 64, id 63790)
21:28:20.195298 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 63201+% [1au] A? ns1.fastclick.net. (46) (ttl 64, id 61064)
21:28:20.195776 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 55345+% [1au] A? ns2.fastclick.net. (46) (ttl 64, id 38913)
21:28:20.224862 hhh.hhh.hhh.hhh.60845 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1569 win 8576 (DF) (ttl 63, id 45749)
21:28:20.228958 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 34667:36107(1440) ack 5167 win 16080 <nop,nop,timestamp 3552038239 144800580> (DF) (ttl 57, id 37375)
21:28:20.247598 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 36107:36556(449) ack 5167 win 16080 <nop,nop,timestamp 3552038239 144800580> (DF) (ttl 57, id 37376)
21:28:20.247963 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  55920 1/3/1 z1.adserver.com. A 205.180.86.3 (142) (ttl 250, id 64054)
21:28:20.248204 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 36556 win 34560 <nop,nop,timestamp 144800602 3552038239> (DF) (ttl 63, id 55129)
21:28:20.248522 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 5167:5713(546) ack 36556 win 34560 <nop,nop,timestamp 144800602 3552038239> (DF) (ttl 63, id 55130)
21:28:20.250515 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2512489768:2512489768(0) win 5840 <mss 1460,sackOK,timestamp 144800602 0,nop,wscale 0> (DF) (ttl 63, id 63090)
21:28:20.258736 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  56945 1/2/3 ns1.ptld.twtelecom.net. A 207.170.210.162 (145) (ttl 250, id 64067)
21:28:20.261971 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  63201 1/4/2 ns1.fastclick.net. A 205.180.85.6 (166) (ttl 250, id 64068)
21:28:20.263118 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  55345 1/4/3 ns2.fastclick.net. A 205.180.85.26 (182) (ttl 250, id 64069)
21:28:20.275480 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 27895:28441(546) ack 4851 win 18147 (ttl 241, id 21240)
21:28:20.283543 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: . [tcp sum ok] ack 2122 win 16537 (DF) (ttl 50, id 6043)
21:28:20.289748 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 2039:2428(389) ack 2122 win 16537 (ttl 241, id 27897)
21:28:20.290074 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53890: P 2428:2750(322) ack 2122 win 16537 (ttl 241, id 28409)
21:28:20.290580 hhh.hhh.hhh.hhh.53890 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2750 win 10605 (DF) (ttl 63, id 21948)
21:28:20.305464 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 13159:13943(784) ack 3636 win 12864 <nop,nop,timestamp 3552038320 144800588> (DF) (ttl 57, id 30876)
21:28:20.306455 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 3636:4151(515) ack 13943 win 28800 <nop,nop,timestamp 144800608 3552038320> (DF) (ttl 63, id 55870)
21:28:20.314855 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 28441 win 34848 (DF) (ttl 63, id 18582)
21:28:20.328602 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: P 1:503(502) ack 475 win 23635 (ttl 241, id 50939)
21:28:20.329006 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 503 win 6432 (DF) (ttl 63, id 21694)
21:28:20.329414 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: P 475:994(519) ack 503 win 6432 (DF) (ttl 63, id 21695)
21:28:20.340089 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.56128: S [tcp sum ok] 736513620:736513620(0) ack 2508704180 win 17424 <mss 1452,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 111, id 4877)
21:28:20.340438 hhh.hhh.hhh.hhh.56128 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800611 0> (DF) (ttl 63, id 45815)
21:28:20.340627 hhh.hhh.hhh.hhh.56128 > xxx.xxx.xxx.xxx.80: P 1:608(607) ack 1 win 5840 <nop,nop,timestamp 144800611 0> (DF) (ttl 63, id 45816)
21:28:20.355453 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.63968: P 1:374(373) ack 742 win 29204 (ttl 241, id 48805)
21:28:20.355904 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 374 win 6432 (DF) (ttl 63, id 57949)
21:28:20.385487 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . [tcp sum ok] ack 518 win 6432 <nop,nop,timestamp 3857502539 144800589> (DF) (ttl 56, id 20013)
21:28:20.385825 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 1:211(210) ack 518 win 6432 <nop,nop,timestamp 3857502539 144800589> (DF) (ttl 56, id 20014)
21:28:20.386253 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 211 win 5840 <nop,nop,timestamp 144800616 3857502539> (DF) (ttl 63, id 27332)
21:28:20.394820 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 211:1651(1440) ack 518 win 6432 <nop,nop,timestamp 3857502539 144800589> (DF) (ttl 56, id 20015)
21:28:20.395426 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1651 win 8640 <nop,nop,timestamp 144800617 3857502539> (DF) (ttl 63, id 27333)
21:28:20.401928 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2509206184:2509206184(0) win 5840 <mss 1460,sackOK,timestamp 144800617 0,nop,wscale 0> (DF) (ttl 63, id 2497)
21:28:20.428828 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 1651:3091(1440) ack 518 win 6432 <nop,nop,timestamp 3857502542 144800616> (DF) (ttl 56, id 20016)
21:28:20.429456 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3091 win 11520 <nop,nop,timestamp 144800620 3857502542> (DF) (ttl 63, id 27334)
21:28:20.429474 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 3091:4531(1440) ack 518 win 6432 <nop,nop,timestamp 3857502542 144800616> (DF) (ttl 56, id 20017)
21:28:20.430230 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4531 win 14400 <nop,nop,timestamp 144800620 3857502542> (DF) (ttl 63, id 27335)
21:28:20.437518 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 4531:5971(1440) ack 518 win 6432 <nop,nop,timestamp 3857502542 144800617> (DF) (ttl 56, id 20018)
21:28:20.438241 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5971 win 17280 <nop,nop,timestamp 144800621 3857502542> (DF) (ttl 63, id 27336)
21:28:20.446623 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 5971:7411(1440) ack 518 win 6432 <nop,nop,timestamp 3857502542 144800617> (DF) (ttl 56, id 20019)
21:28:20.447385 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7411 win 20160 <nop,nop,timestamp 144800622 3857502542> (DF) (ttl 63, id 27337)
21:28:20.447559 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 3606:3614(8) ack 988 win 25536 (ttl 241, id 46338)
21:28:20.447930 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2154 win 8712 (DF) (ttl 63, id 19286)
21:28:20.456299 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 2154:3606(1452) ack 988 win 25536 (ttl 241, id 45826)
21:28:20.456710 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 5066:5074(8) ack 988 win 25536 (ttl 241, id 47874)
21:28:20.456975 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3614 win 11616 (DF) (ttl 63, id 19287)
21:28:20.457040 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3614 win 11616 (DF) (ttl 63, id 19288)
21:28:20.465341 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 3614:5066(1452) ack 988 win 25536 (ttl 241, id 47362)
21:28:20.466094 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5074 win 14520 (DF) (ttl 63, id 19289)
21:28:20.466315 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 6526:6534(8) ack 988 win 25536 (ttl 241, id 50946)
21:28:20.466638 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5074 win 14520 (DF) (ttl 63, id 19290)
21:28:20.466866 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: P 6534:6613(79) ack 988 win 25536 (ttl 241, id 51458)
21:28:20.467213 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5074 win 14520 (DF) (ttl 63, id 19291)
21:28:20.475979 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 5074:6526(1452) ack 988 win 25536 (ttl 241, id 50434)
21:28:20.476633 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6613 win 17424 (DF) (ttl 63, id 19292)
21:28:20.478512 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53902: P 1595:1987(392) ack 3169 win 32928 (ttl 241, id 19385)
21:28:20.488564 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 7411:8851(1440) ack 518 win 6432 <nop,nop,timestamp 3857502548 144800620> (DF) (ttl 56, id 20020)
21:28:20.489191 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8851 win 23040 <nop,nop,timestamp 144800626 3857502548> (DF) (ttl 63, id 27338)
21:28:20.496639 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 8851:10291(1440) ack 518 win 6432 <nop,nop,timestamp 3857502548 144800620> (DF) (ttl 56, id 20021)
21:28:20.497214 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10291 win 25920 <nop,nop,timestamp 144800627 3857502548> (DF) (ttl 63, id 27339)
21:28:20.497829 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 10291:10417(126) ack 518 win 6432 <nop,nop,timestamp 3857502548 144800620> (DF) (ttl 56, id 20022)
21:28:20.498155 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10417 win 25920 <nop,nop,timestamp 144800627 3857502548> (DF) (ttl 63, id 27340)
21:28:20.504164 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52107: P 1:755(754) ack 655 win 16770 <nop,nop,timestamp 4078004 144800592> (DF) (ttl 112, id 47852)
21:28:20.504660 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 755 win 6786 <nop,nop,timestamp 144800627 4078004> (DF) (ttl 63, id 64348)
21:28:20.508126 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 36556:37438(882) ack 5713 win 16080 <nop,nop,timestamp 3552038519 144800602> (DF) (ttl 57, id 37377)
21:28:20.508499 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: . [tcp sum ok] ack 1 win 30976 (DF) [tos 0x20] (ttl 40, id 43950)
21:28:20.509005 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 5713:6229(516) ack 37438 win 34560 <nop,nop,timestamp 144800628 3552038519> (DF) (ttl 63, id 55131)
21:28:20.509982 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: P 1:69(68) ack 1 win 30976 (DF) [tos 0x20] (ttl 40, id 43951)
21:28:20.514848 hhh.hhh.hhh.hhh.53902 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1987 win 8576 (DF) (ttl 63, id 5554)
21:28:20.516537 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: P 1:69(68) ack 69 win 65467 (DF) (ttl 127, id 48562)
21:28:20.528924 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.54251: S [tcp sum ok] 2659975173:2659975173(0) ack 2512489769 win 8190 <mss 1452> (ttl 238, id 54082)
21:28:20.529315 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 63091)
21:28:20.529552 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: P 1:558(557) ack 1 win 5840 (DF) (ttl 63, id 63092)
21:28:20.543215 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 13943:14340(397) ack 4151 win 13936 <nop,nop,timestamp 3552038556 144800608> (DF) (ttl 57, id 30877)
21:28:20.543995 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 4151:4669(518) ack 14340 win 28800 <nop,nop,timestamp 144800631 3552038556> (DF) (ttl 63, id 55871)
21:28:20.553822 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: . [tcp sum ok] ack 994 win 24990 (DF) (ttl 50, id 30349)
21:28:20.555431 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: . [tcp sum ok] 1955:1963(8) ack 994 win 24990 (ttl 241, id 34824)
21:28:20.555844 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 503 win 6432 (DF) (ttl 63, id 21696)
21:28:20.565523 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: . 503:1955(1452) ack 994 win 24990 (ttl 241, id 34312)
21:28:20.566171 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1963 win 8712 (DF) (ttl 63, id 21697)
21:28:20.572213 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.60446: P 1963:2160(197) ack 994 win 24990 (ttl 241, id 35336)
21:28:20.572653 hhh.hhh.hhh.hhh.60446 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2160 win 8712 (DF) (ttl 63, id 21698)
21:28:20.605512 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: S [tcp sum ok] 2690052724:2690052724(0) ack 2509206185 win 5792 <mss 1452,sackOK,timestamp 3857502561 144800617,nop,wscale 0> (DF) (ttl 56, id 0)
21:28:20.606082 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800638 3857502561> (DF) (ttl 63, id 2498)
21:28:20.606335 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: P 1:833(832) ack 1 win 5840 <nop,nop,timestamp 144800638 3857502561> (DF) (ttl 63, id 2499)
21:28:20.629348 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 37438:38878(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038641 144800628> (DF) (ttl 57, id 37378)
21:28:20.635207 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: P 655:1327(672) ack 755 win 6786 <nop,nop,timestamp 144800641 4078004> (DF) (ttl 63, id 64349)
21:28:20.636995 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 38878:40318(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038641 144800628> (DF) (ttl 57, id 37379)
21:28:20.637599 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 40318 win 34560 <nop,nop,timestamp 144800641 3552038641> (DF) (ttl 63, id 55132)
21:28:20.638049 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: P 988:1494(506) ack 6613 win 17424 (DF) (ttl 63, id 19293)
21:28:20.644926 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 40318:41758(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038641 144800628> (DF) (ttl 57, id 37380)
21:28:20.654603 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 41758:43198(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038641 144800628> (DF) (ttl 57, id 37381)
21:28:20.654967 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.54251: . [tcp sum ok] ack 558 win 6567 (ttl 46, id 13536)
21:28:20.655207 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 43198 win 34560 <nop,nop,timestamp 144800643 3552038641> (DF) (ttl 63, id 55133)
21:28:20.664761 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.54251: P 1:751(750) ack 558 win 6567 (ttl 238, id 52065)
21:28:20.665267 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 751 win 6750 (DF) (ttl 63, id 63093)
21:28:20.665598 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 14340:14956(616) ack 4669 win 15008 <nop,nop,timestamp 3552038680 144800631> (DF) (ttl 57, id 30878)
21:28:20.666370 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 4669:5188(519) ack 14956 win 28800 <nop,nop,timestamp 144800644 3552038680> (DF) (ttl 63, id 55872)
21:28:20.700261 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: P 558:1120(562) ack 751 win 6750 (DF) (ttl 63, id 63094)
21:28:20.826644 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.56128: FP 1:598(597) ack 608 win 16817 <nop,nop,timestamp 807968 144800611> (DF) (ttl 111, id 5215)
21:28:20.827232 hhh.hhh.hhh.hhh.56128 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 599 win 6567 <nop,nop,timestamp 144800660 807968> (DF) (ttl 63, id 45817)
21:28:20.827283 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 43198:44638(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038698 144800641> (DF) (ttl 57, id 37382)
21:28:20.827508 hhh.hhh.hhh.hhh.56128 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 608:608(0) ack 599 win 6567 <nop,nop,timestamp 144800660 807968> (DF) (ttl 63, id 45818)
21:28:20.827746 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 44638:46078(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038698 144800641> (DF) (ttl 57, id 37383)
21:28:20.828333 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 46078 win 34560 <nop,nop,timestamp 144800660 3552038698> (DF) (ttl 63, id 55134)
21:28:20.829858 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 38:44(6) ack 135 win 16384 <nop,nop,timestamp 2115193498 28746281> (DF) (ttl 64, id 33074)
21:28:20.830277 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 46078:47518(1440) ack 6229 win 16080 <nop,nop,timestamp 3552038698 144800641> (DF) (ttl 57, id 37384)
21:28:20.830803 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 47518:47998(480) ack 6229 win 16080 <nop,nop,timestamp 3552038700 144800643> (DF) (ttl 57, id 37385)
21:28:20.831191 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 47998 win 34560 <nop,nop,timestamp 144800660 3552038698> (DF) (ttl 63, id 55135)
21:28:20.831211 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . [tcp sum ok] ack 833 win 6656 <nop,nop,timestamp 3857502571 144800638> (DF) (ttl 56, id 8982)
21:28:20.831418 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 6229:6745(516) ack 47998 win 34560 <nop,nop,timestamp 144800660 3552038698> (DF) (ttl 63, id 55136)
21:28:20.831609 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 1:231(230) ack 833 win 6656 <nop,nop,timestamp 3857502571 144800638> (DF) (ttl 56, id 8983)
21:28:20.831960 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 231 win 6432 <nop,nop,timestamp 144800660 3857502571> (DF) (ttl 63, id 2500)
21:28:20.832219 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 231:1671(1440) ack 833 win 6656 <nop,nop,timestamp 3857502571 144800638> (DF) (ttl 56, id 8984)
21:28:20.832915 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1671 win 8640 <nop,nop,timestamp 144800660 3857502571> (DF) (ttl 63, id 2501)
21:28:20.863568 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: P 69:181(112) ack 69 win 30976 (DF) [tos 0x20] (ttl 40, id 43968)
21:28:20.864158 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: P 69:169(100) ack 181 win 65355 (DF) (ttl 127, id 48563)
21:28:20.882131 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 8065:8073(8) ack 1494 win 18600 (ttl 241, id 23583)
21:28:20.882615 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6613 win 17424 (DF) (ttl 63, id 19294)
21:28:20.891671 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 6613:8065(1452) ack 1494 win 18600 (ttl 241, id 23071)
21:28:20.892048 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 9525:9533(8) ack 1494 win 18600 (ttl 241, id 24863)
21:28:20.892352 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8073 win 20328 (DF) (ttl 63, id 19295)
21:28:20.892427 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8073 win 20328 (DF) (ttl 63, id 19296)
21:28:20.901273 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 8073:9525(1452) ack 1494 win 18600 (ttl 241, id 24351)
21:28:20.901617 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 10985:10993(8) ack 1494 win 18600 (ttl 241, id 26143)
21:28:20.901920 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 9533 win 23232 (DF) (ttl 63, id 19297)
21:28:20.901995 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 9533 win 23232 (DF) (ttl 63, id 19298)
21:28:20.910510 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 9533:10985(1452) ack 1494 win 18600 (ttl 241, id 25631)
21:28:20.911081 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 12445:12453(8) ack 1494 win 18600 (ttl 241, id 27423)
21:28:20.911291 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10993 win 26136 (DF) (ttl 63, id 19299)
21:28:20.911421 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10993 win 26136 (DF) (ttl 63, id 19300)
21:28:20.919704 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 10993:12445(1452) ack 1494 win 18600 (ttl 241, id 26911)
21:28:20.920140 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 13905:13913(8) ack 1494 win 18600 (ttl 241, id 28703)
21:28:20.920426 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 12453 win 29040 (DF) (ttl 63, id 19301)
21:28:20.920502 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 12453 win 29040 (DF) (ttl 63, id 19302)
21:28:20.929409 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 12453:13905(1452) ack 1494 win 18600 (ttl 241, id 28191)
21:28:20.929840 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 15365:15373(8) ack 1494 win 18600 (ttl 241, id 29983)
21:28:20.930184 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13913 win 31944 (DF) (ttl 63, id 19303)
21:28:20.930267 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13913 win 31944 (DF) (ttl 63, id 19304)
21:28:20.939314 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 13913:15365(1452) ack 1494 win 18600 (ttl 241, id 29471)
21:28:20.939904 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15373 win 34848 (DF) (ttl 63, id 19305)
21:28:20.940003 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 16825:16833(8) ack 1494 win 18600 (ttl 241, id 31263)
21:28:20.940265 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15373 win 34848 (DF) (ttl 63, id 19306)
21:28:20.948082 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 15373:16825(1452) ack 1494 win 18600 (ttl 241, id 30751)
21:28:20.948424 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 18285:18293(8) ack 1494 win 18600 (ttl 241, id 32543)
21:28:20.948706 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 16833 win 34848 (DF) (ttl 63, id 19307)
21:28:20.948772 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 16833 win 34848 (DF) (ttl 63, id 19308)
21:28:20.957331 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 16833:18285(1452) ack 1494 win 18600 (ttl 241, id 32031)
21:28:20.957705 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . [tcp sum ok] 19745:19753(8) ack 1494 win 18600 (ttl 241, id 33823)
21:28:20.958053 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18293 win 34848 (DF) (ttl 63, id 19309)
21:28:20.958133 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18293 win 34848 (DF) (ttl 63, id 19310)
21:28:20.971465 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 18293:19745(1452) ack 1494 win 18600 (ttl 241, id 33311)
21:28:20.972184 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 19753 win 34848 (DF) (ttl 63, id 19311)
21:28:20.975521 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 19753:21133(1380) ack 1494 win 18600 (ttl 241, id 34591)
21:28:20.976118 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 21133 win 34848 (DF) (ttl 63, id 19312)
21:28:20.977582 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52107: P 755:1071(316) ack 1327 win 16098 <nop,nop,timestamp 4078008 144800641> (DF) (ttl 112, id 47873)
21:28:20.978094 hhh.hhh.hhh.hhh.52107 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1071 win 8294 <nop,nop,timestamp 144800675 4078008> (DF) (ttl 63, id 64350)
21:28:20.985521 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 14956:15599(643) ack 5188 win 16080 <nop,nop,timestamp 3552038920 144800644> (DF) (ttl 57, id 30879)
21:28:20.986388 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 5188:5707(519) ack 15599 win 28800 <nop,nop,timestamp 144800676 3552038920> (DF) (ttl 63, id 55873)
21:28:20.990901 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 1671:3111(1440) ack 833 win 6656 <nop,nop,timestamp 3857502591 144800660> (DF) (ttl 56, id 8985)
21:28:20.991654 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 3111 win 11520 <nop,nop,timestamp 144800676 3857502591> (DF) (ttl 63, id 2502)
21:28:21.004240 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 3111:4551(1440) ack 833 win 6656 <nop,nop,timestamp 3857502591 144800660> (DF) (ttl 56, id 8986)
21:28:21.004849 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4551 win 14400 <nop,nop,timestamp 144800677 3857502591> (DF) (ttl 63, id 2503)
21:28:21.012019 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 4551:5991(1440) ack 833 win 6656 <nop,nop,timestamp 3857502591 144800660> (DF) (ttl 56, id 8987)
21:28:21.012658 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5991 win 17280 <nop,nop,timestamp 144800678 3857502591> (DF) (ttl 63, id 2504)
21:28:21.017549 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 5991:7431(1440) ack 833 win 6656 <nop,nop,timestamp 3857502591 144800660> (DF) (ttl 56, id 8988)
21:28:21.017921 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.54251: . [tcp sum ok] ack 1120 win 6622 (ttl 46, id 64137)
21:28:21.018187 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 7431 win 20160 <nop,nop,timestamp 144800679 3857502591> (DF) (ttl 63, id 2505)
21:28:21.022694 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.54251: P 751:1423(672) ack 1120 win 6622 (ttl 238, id 3753)
21:28:21.022994 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.56128: . [tcp sum ok] ack 609 win 16817 <nop,nop,timestamp 807971 144800660> (DF) (ttl 111, id 5515)
21:28:21.026463 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 47998:48491(493) ack 6745 win 16080 <nop,nop,timestamp 3552038963 144800660> (DF) (ttl 57, id 37386)
21:28:21.027200 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 6745:7263(518) ack 48491 win 34560 <nop,nop,timestamp 144800680 3552038963> (DF) (ttl 63, id 55137)
21:28:21.035850 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: P 24037:24702(665) ack 1494 win 18600 (ttl 241, id 11299)
21:28:21.036530 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 21133 win 34848 (DF) (ttl 63, id 19313)
21:28:21.040071 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 21133:22585(1452) ack 1494 win 18600 (ttl 241, id 10275)
21:28:21.040724 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 22585 win 34848 (DF) (ttl 63, id 19314)
21:28:21.048644 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52215: . 22585:24037(1452) ack 1494 win 18600 (ttl 241, id 10787)
21:28:21.049330 hhh.hhh.hhh.hhh.52215 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 24702 win 34848 (DF) (ttl 63, id 19315)
21:28:21.053143 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 15599:16288(689) ack 5707 win 16080 <nop,nop,timestamp 3552039032 144800676> (DF) (ttl 57, id 30880)
21:28:21.053958 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 5707:6229(522) ack 16288 win 28800 <nop,nop,timestamp 144800682 3552039032> (DF) (ttl 63, id 55874)
21:28:21.054878 hhh.hhh.hhh.hhh.54251 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1423 win 8250 (DF) (ttl 63, id 63095)
21:28:21.062081 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 7431:8871(1440) ack 833 win 6656 <nop,nop,timestamp 3857502602 144800676> (DF) (ttl 56, id 8989)
21:28:21.062734 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8871 win 23040 <nop,nop,timestamp 144800683 3857502602> (DF) (ttl 63, id 2506)
21:28:21.070942 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 8871:10311(1440) ack 833 win 6656 <nop,nop,timestamp 3857502602 144800676> (DF) (ttl 56, id 8990)
21:28:21.071701 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10311 win 25920 <nop,nop,timestamp 144800684 3857502602> (DF) (ttl 63, id 2507)
21:28:21.082375 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 10311:11751(1440) ack 833 win 6656 <nop,nop,timestamp 3857502602 144800677> (DF) (ttl 56, id 8991)
21:28:21.083158 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 11751 win 28800 <nop,nop,timestamp 144800685 3857502602> (DF) (ttl 63, id 2508)
21:28:21.088685 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 11751:13191(1440) ack 833 win 6656 <nop,nop,timestamp 3857502602 144800677> (DF) (ttl 56, id 8992)
21:28:21.089274 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13191 win 31680 <nop,nop,timestamp 144800686 3857502602> (DF) (ttl 63, id 2509)
21:28:21.097314 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 13191:14631(1440) ack 833 win 6656 <nop,nop,timestamp 3857502603 144800678> (DF) (ttl 56, id 8993)
21:28:21.098038 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 14631 win 31680 <nop,nop,timestamp 144800687 3857502603> (DF) (ttl 63, id 2510)
21:28:21.099380 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: P 518:1017(499) ack 10417 win 25920 <nop,nop,timestamp 144800687 3857502548> (DF) (ttl 63, id 27341)
21:28:21.114696 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 14631:16071(1440) ack 833 win 6656 <nop,nop,timestamp 3857502603 144800678> (DF) (ttl 56, id 8994)
21:28:21.115237 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 16071:17511(1440) ack 833 win 6656 <nop,nop,timestamp 3857502604 144800679> (DF) (ttl 56, id 8995)
21:28:21.115510 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 16071 win 31680 <nop,nop,timestamp 144800689 3857502603> (DF) (ttl 63, id 2511)
21:28:21.115972 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17511 win 31680 <nop,nop,timestamp 144800689 3857502604> (DF) (ttl 63, id 2512)
21:28:21.125143 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 17511:18951(1440) ack 833 win 6656 <nop,nop,timestamp 3857502604 144800679> (DF) (ttl 56, id 8996)
21:28:21.125927 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18951 win 31680 <nop,nop,timestamp 144800690 3857502604> (DF) (ttl 63, id 2513)
21:28:21.128968 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 54211+% [1au] A? chkpt.zdnet.com. (44) (ttl 64, id 40856)
21:28:21.130684 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 48491:49108(617) ack 7263 win 16080 <nop,nop,timestamp 3552039073 144800680> (DF) (ttl 57, id 37387)
21:28:21.131091 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: P [tcp sum ok] 135:144(9) ack 44 win 46 <nop,nop,timestamp 28749539 2115193498> (DF) (ttl 43, id 60950)
21:28:21.131570 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 44:50(6) ack 144 win 16384 <nop,nop,timestamp 2115193498 28749539> (DF) (ttl 64, id 37519)
21:28:21.131659 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 7263:7786(523) ack 49108 win 34560 <nop,nop,timestamp 144800690 3552039073> (DF) (ttl 63, id 55138)
21:28:21.135965 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 16288:17430(1142) ack 6229 win 16080 <nop,nop,timestamp 3552039104 144800682> (DF) (ttl 57, id 30881)
21:28:21.137008 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 6229:6759(530) ack 17430 win 31680 <nop,nop,timestamp 144800691 3552039104> (DF) (ttl 63, id 55875)
21:28:21.148383 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 18951:20391(1440) ack 833 win 6656 <nop,nop,timestamp 3857502609 144800683> (DF) (ttl 56, id 8997)
21:28:21.155570 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 20391:21831(1440) ack 833 win 6656 <nop,nop,timestamp 3857502609 144800683> (DF) (ttl 56, id 8998)
21:28:21.156330 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 21831 win 31680 <nop,nop,timestamp 144800693 3857502609> (DF) (ttl 63, id 2514)
21:28:21.166927 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 21831:23271(1440) ack 833 win 6656 <nop,nop,timestamp 3857502609 144800684> (DF) (ttl 56, id 8999)
21:28:21.168512 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 55434+% [1au] A? cdn.fastclick.net. (46) (ttl 64, id 65061)
21:28:21.169389 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 45448+% [1au] A? ns1.orng.twtelecom.net. (51) (ttl 64, id 37444)
21:28:21.174181 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 23271:24711(1440) ack 833 win 6656 <nop,nop,timestamp 3857502609 144800684> (DF) (ttl 56, id 9000)
21:28:21.174832 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 24711 win 31680 <nop,nop,timestamp 144800694 3857502609> (DF) (ttl 63, id 2515)
21:28:21.180323 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 24711:26151(1440) ack 833 win 6656 <nop,nop,timestamp 3857502610 144800685> (DF) (ttl 56, id 9001)
21:28:21.192712 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 26151:27591(1440) ack 833 win 6656 <nop,nop,timestamp 3857502610 144800685> (DF) (ttl 56, id 9002)
21:28:21.193547 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 27591 win 31680 <nop,nop,timestamp 144800696 3857502610> (DF) (ttl 63, id 2516)
21:28:21.199957 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 27591:29031(1440) ack 833 win 6656 <nop,nop,timestamp 3857502611 144800686> (DF) (ttl 56, id 9003)
21:28:21.206931 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 29031:30471(1440) ack 833 win 6656 <nop,nop,timestamp 3857502611 144800686> (DF) (ttl 56, id 9004)
21:28:21.207682 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 30471 win 31680 <nop,nop,timestamp 144800698 3857502611> (DF) (ttl 63, id 2517)
21:28:21.215564 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 30471:31911(1440) ack 833 win 6656 <nop,nop,timestamp 3857502612 144800687> (DF) (ttl 56, id 9005)
21:28:21.224407 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 31911:33351(1440) ack 833 win 6656 <nop,nop,timestamp 3857502612 144800687> (DF) (ttl 56, id 9006)
21:28:21.225014 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 33351 win 31680 <nop,nop,timestamp 144800700 3857502612> (DF) (ttl 63, id 2518)
21:28:21.230839 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 10417:10625(208) ack 1017 win 7504 <nop,nop,timestamp 3857502614 144800687> (DF) (ttl 56, id 20023)
21:28:21.231332 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 10625 win 25920 <nop,nop,timestamp 144800700 3857502614> (DF) (ttl 63, id 27342)
21:28:21.235199 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 10625:12065(1440) ack 1017 win 7504 <nop,nop,timestamp 3857502614 144800687> (DF) (ttl 56, id 20024)
21:28:21.235886 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 12065 win 28800 <nop,nop,timestamp 144800701 3857502614> (DF) (ttl 63, id 27343)
21:28:21.244125 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 33351:34791(1440) ack 833 win 6656 <nop,nop,timestamp 3857502614 144800689> (DF) (ttl 56, id 9007)
21:28:21.254191 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 34791:36231(1440) ack 833 win 6656 <nop,nop,timestamp 3857502614 144800689> (DF) (ttl 56, id 9008)
21:28:21.254816 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 36231 win 31680 <nop,nop,timestamp 144800702 3857502614> (DF) (ttl 63, id 2519)
21:28:21.262325 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 36231:37671(1440) ack 833 win 6656 <nop,nop,timestamp 3857502614 144800689> (DF) (ttl 56, id 9009)
21:28:21.271013 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 37671:39111(1440) ack 833 win 6656 <nop,nop,timestamp 3857502614 144800689> (DF) (ttl 56, id 9010)
21:28:21.271625 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 39111 win 31680 <nop,nop,timestamp 144800704 3857502614> (DF) (ttl 63, id 2520)
21:28:21.285512 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 39111:40551(1440) ack 833 win 6656 <nop,nop,timestamp 3857502615 144800690> (DF) (ttl 56, id 9011)
21:28:21.289172 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 40551:41991(1440) ack 833 win 6656 <nop,nop,timestamp 3857502615 144800690> (DF) (ttl 56, id 9012)
21:28:21.289606 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  54211 2/3/1 chkpt.zdnet.com. CNAME[|domain] (ttl 250, id 64225)
21:28:21.289799 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 41991 win 31680 <nop,nop,timestamp 144800706 3857502615> (DF) (ttl 63, id 2521)
21:28:21.292384 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2515051300:2515051300(0) win 5840 <mss 1460,sackOK,timestamp 144800706 0,nop,wscale 0> (DF) (ttl 63, id 55526)
21:28:21.292577 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2511440470:2511440470(0) win 5840 <mss 1460,sackOK,timestamp 144800706 0,nop,wscale 0> (DF) (ttl 63, id 61844)
21:28:21.292887 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150377:150542(165) ack 2325 win 57600 <nop,nop,timestamp 576373772 144799960> (DF) (ttl 44, id 48909)
21:28:21.293433 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150542 win 34560 <nop,nop,timestamp 144800706 576373772> (DF) (ttl 63, id 42564)
21:28:21.301094 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 49108:50281(1173) ack 7786 win 16080 <nop,nop,timestamp 3552039182 144800690> (DF) (ttl 57, id 37388)
21:28:21.302159 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 7786:8316(530) ack 50281 win 34560 <nop,nop,timestamp 144800707 3552039182> (DF) (ttl 63, id 55139)
21:28:21.307464 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 41991:43431(1440) ack 833 win 6656 <nop,nop,timestamp 3857502618 144800693> (DF) (ttl 56, id 9013)
21:28:21.316387 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . 43431:44871(1440) ack 833 win 6656 <nop,nop,timestamp 3857502618 144800693> (DF) (ttl 56, id 9014)
21:28:21.317072 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 44871 win 31680 <nop,nop,timestamp 144800709 3857502618> (DF) (ttl 63, id 2522)
21:28:21.322808 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: P 44871:45738(867) ack 833 win 6656 <nop,nop,timestamp 3857502618 144800693> (DF) (ttl 56, id 9015)
21:28:21.323384 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 45738 win 31680 <nop,nop,timestamp 144800709 3857502618> (DF) (ttl 63, id 2523)
21:28:21.328833 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 17430:18508(1078) ack 6759 win 16080 <nop,nop,timestamp 3552039203 144800691> (DF) (ttl 57, id 30882)
21:28:21.329201 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: P [tcp sum ok] 181:192(11) ack 169 win 30976 (DF) [tos 0x20] (ttl 40, id 43980)
21:28:21.329701 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: P [tcp sum ok] 169:180(11) ack 192 win 65344 (DF) (ttl 127, id 48564)
21:28:21.329815 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 6759:7281(522) ack 18508 win 34560 <nop,nop,timestamp 144800710 3552039203> (DF) (ttl 63, id 55876)
21:28:21.339139 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 12065:13505(1440) ack 1017 win 7504 <nop,nop,timestamp 3857502625 144800700> (DF) (ttl 56, id 20025)
21:28:21.339801 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 13505 win 31680 <nop,nop,timestamp 144800711 3857502625> (DF) (ttl 63, id 27344)
21:28:21.347634 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 13505:14945(1440) ack 1017 win 7504 <nop,nop,timestamp 3857502625 144800700> (DF) (ttl 56, id 20026)
21:28:21.348385 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 14945 win 34560 <nop,nop,timestamp 144800712 3857502625> (DF) (ttl 63, id 27345)
21:28:21.355859 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 14945:16385(1440) ack 1017 win 7504 <nop,nop,timestamp 3857502626 144800701> (DF) (ttl 56, id 20027)
21:28:21.356585 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 16385 win 34560 <nop,nop,timestamp 144800713 3857502626> (DF) (ttl 63, id 27346)
21:28:21.366406 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . 16385:17825(1440) ack 1017 win 7504 <nop,nop,timestamp 3857502626 144800701> (DF) (ttl 56, id 20028)
21:28:21.366684 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: P [tcp sum ok] 144:153(9) ack 50 win 46 <nop,nop,timestamp 28749763 2115193498> (DF) (ttl 43, id 60951)
21:28:21.367110 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17825 win 34560 <nop,nop,timestamp 144800714 3857502626> (DF) (ttl 63, id 27347)
21:28:21.367262 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 50:50(0) ack 153 win 16384 <nop,nop,timestamp 2115193499 28749763> (DF) (ttl 64, id 63012)
21:28:21.367705 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: F [tcp sum ok] 153:153(0) ack 50 win 46 <nop,nop,timestamp 28749763 2115193498> (DF) (ttl 43, id 60952)
21:28:21.367841 hhh.hhh.hhh.hhh.24816 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 154 win 16384 <nop,nop,timestamp 2115193499 28749763> (DF) (ttl 64, id 57127)
21:28:21.368009 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52870: S [tcp sum ok] 3393322052:3393322052(0) ack 2515051301 win 8190 <mss 1452> (ttl 241, id 40008)
21:28:21.368444 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 55527)
21:28:21.368622 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: P 1:516(515) ack 1 win 5840 (DF) (ttl 63, id 55528)
21:28:21.368689 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53621: S [tcp sum ok] 3446487550:3446487550(0) ack 2511440471 win 8190 <mss 1452> (ttl 241, id 51273)
21:28:21.368995 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 (DF) (ttl 63, id 61845)
21:28:21.369154 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: P 1:517(516) ack 1 win 5840 (DF) (ttl 63, id 61846)
21:28:21.372423 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 50281:51114(833) ack 8316 win 16080 <nop,nop,timestamp 3552039349 144800707> (DF) (ttl 57, id 37389)
21:28:21.373464 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 8316:8838(522) ack 51114 win 34560 <nop,nop,timestamp 144800714 3552039349> (DF) (ttl 63, id 55140)
21:28:21.374993 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: P 17825:18127(302) ack 1017 win 7504 <nop,nop,timestamp 3857502637 144800711> (DF) (ttl 56, id 20029)
21:28:21.375518 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18127 win 34560 <nop,nop,timestamp 144800715 3857502637> (DF) (ttl 63, id 27348)
21:28:21.394967 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . [tcp sum ok] ack 7281 win 16080 <nop,nop,timestamp 3552039417 144800710> (DF) (ttl 57, id 30883)
21:28:21.405958 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52870: P 1:447(446) ack 516 win 21192 (ttl 241, id 2392)
21:28:21.406474 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 447 win 6432 (DF) (ttl 63, id 55529)
21:28:21.406721 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: P 516:1032(516) ack 447 win 6432 (DF) (ttl 63, id 55530)
21:28:21.421615 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53621: P 1:447(446) ack 517 win 23058 (ttl 241, id 37466)
21:28:21.422129 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 447 win 6432 (DF) (ttl 63, id 61847)
21:28:21.422389 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: P 517:1033(516) ack 447 win 6432 (DF) (ttl 63, id 61848)
21:28:21.442986 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 51114:52554(1440) ack 8838 win 16080 <nop,nop,timestamp 3552039457 144800714> (DF) (ttl 57, id 37390)
21:28:21.452431 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 52554:53405(851) ack 8838 win 16080 <nop,nop,timestamp 3552039457 144800714> (DF) (ttl 57, id 37391)
21:28:21.453060 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 53405 win 34560 <nop,nop,timestamp 144800722 3552039457> (DF) (ttl 63, id 55141)
21:28:21.453273 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 8838:9360(522) ack 53405 win 34560 <nop,nop,timestamp 144800722 3552039457> (DF) (ttl 63, id 55142)
21:28:21.453725 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52870: P 447:893(446) ack 1032 win 29977 (ttl 241, id 12895)
21:28:21.472952 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53621: P 447:893(446) ack 1033 win 25100 (ttl 241, id 47969)
21:28:21.484910 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 893 win 7504 (DF) (ttl 63, id 55531)
21:28:21.491952 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 53405:54845(1440) ack 9360 win 16080 <nop,nop,timestamp 3552039505 144800722> (DF) (ttl 57, id 37392)
21:28:21.495495 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 54845:55545(700) ack 9360 win 16080 <nop,nop,timestamp 3552039505 144800722> (DF) (ttl 57, id 37393)
21:28:21.496030 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 55545 win 34560 <nop,nop,timestamp 144800727 3552039505> (DF) (ttl 63, id 55143)
21:28:21.496843 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 9360:9880(520) ack 55545 win 34560 <nop,nop,timestamp 144800727 3552039505> (DF) (ttl 63, id 55144)
21:28:21.504939 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 893 win 7504 (DF) (ttl 63, id 61849)
21:28:21.525491 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 55545:56153(608) ack 9880 win 16080 <nop,nop,timestamp 3552039545 144800727> (DF) (ttl 57, id 37394)
21:28:21.526368 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 9880:10402(522) ack 56153 win 34560 <nop,nop,timestamp 144800730 3552039545> (DF) (ttl 63, id 55145)
21:28:21.535054 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.24816: . [tcp sum ok] ack 51 win 46 <nop,nop,timestamp 28749998 2115193499> (DF) (ttl 43, id 60953)
21:28:21.539343 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: P [tcp sum ok] 192:243(51) ack 180 win 30976 (DF) [tos 0x20] (ttl 40, id 43995)
21:28:21.539756 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: P 180:235(55) ack 243 win 65293 (DF) (ttl 127, id 48565)
21:28:21.557767 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 56153:57593(1440) ack 10402 win 16080 <nop,nop,timestamp 3552039572 144800730> (DF) (ttl 57, id 37395)
21:28:21.559308 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 57593:57783(190) ack 10402 win 16080 <nop,nop,timestamp 3552039572 144800730> (DF) (ttl 57, id 37396)
21:28:21.559799 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 57783 win 34560 <nop,nop,timestamp 144800733 3552039572> (DF) (ttl 63, id 55146)
21:28:21.560089 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 10402:10924(522) ack 57783 win 34560 <nop,nop,timestamp 144800733 3552039572> (DF) (ttl 63, id 55147)
21:28:21.593700 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 57783:58965(1182) ack 10924 win 16080 <nop,nop,timestamp 3552039609 144800733> (DF) (ttl 57, id 37397)
21:28:21.594783 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 10924:11453(529) ack 58965 win 34560 <nop,nop,timestamp 144800736 3552039609> (DF) (ttl 63, id 55148)
21:28:21.612828 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 18508:19948(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039625 144800710> (DF) (ttl 57, id 30884)
21:28:21.613331 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 19948:20326(378) ack 7281 win 16080 <nop,nop,timestamp 3552039625 144800710> (DF) (ttl 57, id 30885)
21:28:21.613831 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 20326 win 34560 <nop,nop,timestamp 144800738 3552039625> (DF) (ttl 63, id 55877)
21:28:21.622585 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 20326:21766(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039627 144800710> (DF) (ttl 57, id 30886)
21:28:21.629255 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 58965:59903(938) ack 11453 win 16080 <nop,nop,timestamp 3552039640 144800736> (DF) (ttl 57, id 37398)
21:28:21.633863 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 11453:11982(529) ack 59903 win 34560 <nop,nop,timestamp 144800740 3552039640> (DF) (ttl 63, id 55149)
21:28:21.638659 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 21766:23206(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039647 144800738> (DF) (ttl 57, id 30887)
21:28:21.639436 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 23206 win 34560 <nop,nop,timestamp 144800741 3552039627> (DF) (ttl 63, id 55878)
21:28:21.646080 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 23206:24646(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039647 144800738> (DF) (ttl 57, id 30888)
21:28:21.655558 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 24646:26086(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039647 144800738> (DF) (ttl 57, id 30889)
21:28:21.656261 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 26086 win 34560 <nop,nop,timestamp 144800743 3552039647> (DF) (ttl 63, id 55879)
21:28:21.664445 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 59903:60562(659) ack 11982 win 16080 <nop,nop,timestamp 3552039681 144800740> (DF) (ttl 57, id 37399)
21:28:21.665577 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 11982:12501(519) ack 60562 win 34560 <nop,nop,timestamp 144800744 3552039681> (DF) (ttl 63, id 55150)
21:28:21.671636 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 26086:27526(1440) ack 7281 win 16080 <nop,nop,timestamp 3552039682 144800741> (DF) (ttl 57, id 30890)
21:28:21.683852 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 27526:28671(1145) ack 7281 win 16080 <nop,nop,timestamp 3552039682 144800741> (DF) (ttl 57, id 30891)
21:28:21.684538 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 28671 win 34560 <nop,nop,timestamp 144800745 3552039682> (DF) (ttl 63, id 55880)
21:28:21.684841 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 7281:7800(519) ack 28671 win 34560 <nop,nop,timestamp 144800745 3552039682> (DF) (ttl 63, id 55881)
21:28:21.692173 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 60562:61028(466) ack 12501 win 16080 <nop,nop,timestamp 3552039712 144800744> (DF) (ttl 57, id 37400)
21:28:21.693015 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 12501:13022(521) ack 61028 win 34560 <nop,nop,timestamp 144800746 3552039712> (DF) (ttl 63, id 55151)
21:28:21.707380 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . [tcp sum ok] ack 7800 win 16080 <nop,nop,timestamp 3552039730 144800745> (DF) (ttl 57, id 30892)
21:28:21.715080 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 28671:29137(466) ack 7800 win 16080 <nop,nop,timestamp 3552039731 144800745> (DF) (ttl 57, id 30893)
21:28:21.715835 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 7800:8320(520) ack 29137 win 34560 <nop,nop,timestamp 144800749 3552039731> (DF) (ttl 63, id 55882)
21:28:21.733927 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 61028:62468(1440) ack 13022 win 16080 <nop,nop,timestamp 3552039746 144800746> (DF) (ttl 57, id 37401)
21:28:21.734379 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 62468:62546(78) ack 13022 win 16080 <nop,nop,timestamp 3552039746 144800746> (DF) (ttl 57, id 37402)
21:28:21.734759 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 62546 win 34560 <nop,nop,timestamp 144800750 3552039746> (DF) (ttl 63, id 55152)
21:28:21.734943 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 13022:13546(524) ack 62546 win 34560 <nop,nop,timestamp 144800750 3552039746> (DF) (ttl 63, id 55153)
21:28:21.743145 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 29137:29573(436) ack 8320 win 16080 <nop,nop,timestamp 3552039764 144800749> (DF) (ttl 57, id 30894)
21:28:21.743922 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 8320:8846(526) ack 29573 win 34560 <nop,nop,timestamp 144800751 3552039764> (DF) (ttl 63, id 55883)
21:28:21.753202 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: P 243:298(55) ack 235 win 30976 (DF) [tos 0x20] (ttl 40, id 44003)
21:28:21.753595 hhh.hhh.hhh.hhh.44662 > xxx.xxx.xxx.xxx.4390: P [tcp sum ok] 235:257(22) ack 298 win 65238 (DF) (ttl 127, id 48566)
21:28:21.768227 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 62546:63986(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039782 144800750> (DF) (ttl 57, id 37403)
21:28:21.777658 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 63986:65426(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039782 144800750> (DF) (ttl 57, id 37404)
21:28:21.778501 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 65426 win 34560 <nop,nop,timestamp 144800755 3552039782> (DF) (ttl 63, id 55154)
21:28:21.786897 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 65426:66866(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039782 144800750> (DF) (ttl 57, id 37405)
21:28:21.795579 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 66866:68306(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039782 144800750> (DF) (ttl 57, id 37406)
21:28:21.796326 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 68306 win 34560 <nop,nop,timestamp 144800757 3552039782> (DF) (ttl 63, id 55155)
21:28:21.803666 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 29573:31013(1440) ack 8846 win 16080 <nop,nop,timestamp 3552039797 144800751> (DF) (ttl 57, id 30895)
21:28:21.815548 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 31013:32453(1440) ack 8846 win 16080 <nop,nop,timestamp 3552039797 144800751> (DF) (ttl 57, id 30896)
21:28:21.816320 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 32453 win 34560 <nop,nop,timestamp 144800759 3552039797> (DF) (ttl 63, id 55884)
21:28:21.824508 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 32453:33893(1440) ack 8846 win 16080 <nop,nop,timestamp 3552039797 144800751> (DF) (ttl 57, id 30897)
21:28:21.825555 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 33893:34568(675) ack 8846 win 16080 <nop,nop,timestamp 3552039797 144800751> (DF) (ttl 57, id 30898)
21:28:21.826069 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 34568 win 34560 <nop,nop,timestamp 144800760 3552039797> (DF) (ttl 63, id 55885)
21:28:21.826373 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 8846:9375(529) ack 34568 win 34560 <nop,nop,timestamp 144800760 3552039797> (DF) (ttl 63, id 55886)
21:28:21.834237 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 68306:69746(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039819 144800755> (DF) (ttl 57, id 37407)
21:28:21.846751 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 69746:71186(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039819 144800755> (DF) (ttl 57, id 37408)
21:28:21.847438 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 71186 win 34560 <nop,nop,timestamp 144800762 3552039819> (DF) (ttl 63, id 55156)
21:28:21.855554 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 71186:72626(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039819 144800755> (DF) (ttl 57, id 37409)
21:28:21.863574 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 72626:74066(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039831 144800757> (DF) (ttl 57, id 37410)
21:28:21.864285 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 74066 win 34560 <nop,nop,timestamp 144800763 3552039819> (DF) (ttl 63, id 55157)
21:28:21.871396 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 74066:75506(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039831 144800757> (DF) (ttl 57, id 37411)
21:28:21.879247 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 75506:76946(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039831 144800757> (DF) (ttl 57, id 37412)
21:28:21.879935 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 76946 win 34560 <nop,nop,timestamp 144800765 3552039831> (DF) (ttl 63, id 55158)
21:28:21.887024 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 34568:35885(1317) ack 9375 win 16080 <nop,nop,timestamp 3552039875 144800760> (DF) (ttl 57, id 30899)
21:28:21.888090 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 9375:9905(530) ack 35885 win 34560 <nop,nop,timestamp 144800766 3552039875> (DF) (ttl 63, id 55887)
21:28:21.901534 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 76946:78386(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039880 144800762> (DF) (ttl 57, id 37413)
21:28:21.905549 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 78386:79826(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039880 144800762> (DF) (ttl 57, id 37414)
21:28:21.906188 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 79826 win 34560 <nop,nop,timestamp 144800768 3552039880> (DF) (ttl 63, id 55159)
21:28:21.916717 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 79826:81266(1440) ack 13546 win 16080 <nop,nop,timestamp 3552039880 144800762> (DF) (ttl 57, id 37415)
21:28:21.917847 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 81266:81608(342) ack 13546 win 16080 <nop,nop,timestamp 3552039897 144800763> (DF) (ttl 57, id 37416)
21:28:21.918346 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 81608 win 34560 <nop,nop,timestamp 144800769 3552039880> (DF) (ttl 63, id 55160)
21:28:21.918652 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 13546:14075(529) ack 81608 win 34560 <nop,nop,timestamp 144800769 3552039880> (DF) (ttl 63, id 55161)
21:28:21.933889 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 35885:37325(1440) ack 9905 win 16080 <nop,nop,timestamp 3552039943 144800766> (DF) (ttl 57, id 30900)
21:28:21.938442 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 37325:38765(1440) ack 9905 win 16080 <nop,nop,timestamp 3552039943 144800766> (DF) (ttl 57, id 30901)
21:28:21.939035 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 38765 win 34560 <nop,nop,timestamp 144800771 3552039943> (DF) (ttl 63, id 55888)
21:28:21.945551 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 38765:39709(944) ack 9905 win 16080 <nop,nop,timestamp 3552039943 144800766> (DF) (ttl 57, id 30902)
21:28:21.946449 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 9905:10427(522) ack 39709 win 34560 <nop,nop,timestamp 144800772 3552039943> (DF) (ttl 63, id 55889)
21:28:21.965640 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 81608:82823(1215) ack 14075 win 16080 <nop,nop,timestamp 3552039980 144800769> (DF) (ttl 57, id 37417)
21:28:21.966694 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 14075:14597(522) ack 82823 win 34560 <nop,nop,timestamp 144800774 3552039980> (DF) (ttl 63, id 55162)
21:28:21.976763 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 39709:40519(810) ack 10427 win 16080 <nop,nop,timestamp 3552039994 144800772> (DF) (ttl 57, id 30903)
21:28:21.977765 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 10427:10959(532) ack 40519 win 34560 <nop,nop,timestamp 144800775 3552039994> (DF) (ttl 63, id 55890)
21:28:22.001473 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 82823:84228(1405) ack 14597 win 16080 <nop,nop,timestamp 3552040013 144800774> (DF) (ttl 57, id 37418)
21:28:22.002658 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 14597:15126(529) ack 84228 win 34560 <nop,nop,timestamp 144800777 3552040013> (DF) (ttl 63, id 55163)
21:28:22.013150 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 40519:41959(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040027 144800775> (DF) (ttl 57, id 30904)
21:28:22.021768 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 41959:43399(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040027 144800775> (DF) (ttl 57, id 30905)
21:28:22.022487 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 43399 win 34560 <nop,nop,timestamp 144800779 3552040027> (DF) (ttl 63, id 55891)
21:28:22.033516 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 43399:44839(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040027 144800775> (DF) (ttl 57, id 30906)
21:28:22.043182 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 44839:46279(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040027 144800775> (DF) (ttl 57, id 30907)
21:28:22.043623 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 84228:84693(465) ack 15126 win 16080 <nop,nop,timestamp 3552040060 144800777> (DF) (ttl 57, id 37419)
21:28:22.043847 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 46279 win 34560 <nop,nop,timestamp 144800781 3552040027> (DF) (ttl 63, id 55892)
21:28:22.044314 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 15126:15655(529) ack 84693 win 34560 <nop,nop,timestamp 144800781 3552040060> (DF) (ttl 63, id 55164)
21:28:22.051531 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 46279:47719(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040060 144800779> (DF) (ttl 57, id 30908)
21:28:22.065580 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 47719:49159(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040060 144800779> (DF) (ttl 57, id 30909)
21:28:22.066259 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 49159 win 34560 <nop,nop,timestamp 144800784 3552040060> (DF) (ttl 63, id 55893)
21:28:22.074192 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 49159:50599(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040060 144800779> (DF) (ttl 57, id 30910)
21:28:22.078144 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 50599:52039(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040076 144800781> (DF) (ttl 57, id 30911)
21:28:22.078778 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 52039 win 34560 <nop,nop,timestamp 144800785 3552040060> (DF) (ttl 63, id 55894)
21:28:22.090174 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 52039:53479(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040076 144800781> (DF) (ttl 57, id 30912)
21:28:22.095926 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 53479:54919(1440) ack 10959 win 16080 <nop,nop,timestamp 3552040076 144800781> (DF) (ttl 57, id 30913)
21:28:22.096690 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 54919 win 34560 <nop,nop,timestamp 144800787 3552040076> (DF) (ttl 63, id 55895)
21:28:22.105686 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 84693:86133(1440) ack 15655 win 16080 <nop,nop,timestamp 3552040092 144800781> (DF) (ttl 57, id 37420)
21:28:22.114276 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 86133:87471(1338) ack 15655 win 16080 <nop,nop,timestamp 3552040092 144800781> (DF) (ttl 57, id 37421)
21:28:22.114936 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 87471 win 34560 <nop,nop,timestamp 144800788 3552040092> (DF) (ttl 63, id 55165)
21:28:22.115173 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 15655:16181(526) ack 87471 win 34560 <nop,nop,timestamp 144800789 3552040092> (DF) (ttl 63, id 55166)
21:28:22.122222 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 54919:56204(1285) ack 10959 win 16080 <nop,nop,timestamp 3552040098 144800784> (DF) (ttl 57, id 30914)
21:28:22.123225 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 10959:11485(526) ack 56204 win 34560 <nop,nop,timestamp 144800789 3552040098> (DF) (ttl 63, id 55896)
21:28:22.129231 xxx.xxx.xxx.xxx.4390 > hhh.hhh.hhh.hhh.44662: . [tcp sum ok] ack 257 win 30976 (DF) [tos 0x20] (ttl 40, id 44017)
21:28:22.152113 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 87471:88366(895) ack 16181 win 16080 <nop,nop,timestamp 3552040166 144800789> (DF) (ttl 57, id 37422)
21:28:22.153166 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 16181:16709(528) ack 88366 win 34560 <nop,nop,timestamp 144800792 3552040166> (DF) (ttl 63, id 55167)
21:28:22.165597 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 56204:57644(1440) ack 11485 win 16080 <nop,nop,timestamp 3552040179 144800789> (DF) (ttl 57, id 30915)
21:28:22.175592 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 57644:59084(1440) ack 11485 win 16080 <nop,nop,timestamp 3552040179 144800789> (DF) (ttl 57, id 30916)
21:28:22.176283 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 59084 win 34560 <nop,nop,timestamp 144800795 3552040179> (DF) (ttl 63, id 55897)
21:28:22.183857 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 59084:59720(636) ack 11485 win 16080 <nop,nop,timestamp 3552040179 144800789> (DF) (ttl 57, id 30917)
21:28:22.184569 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 11485:12015(530) ack 59720 win 34560 <nop,nop,timestamp 144800795 3552040179> (DF) (ttl 63, id 55898)
21:28:22.199244 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 88366:89806(1440) ack 16709 win 16080 <nop,nop,timestamp 3552040212 144800792> (DF) (ttl 57, id 37423)
21:28:22.206904 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 89806:90278(472) ack 16709 win 16080 <nop,nop,timestamp 3552040212 144800792> (DF) (ttl 57, id 37424)
21:28:22.207405 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 90278 win 34560 <nop,nop,timestamp 144800798 3552040212> (DF) (ttl 63, id 55168)
21:28:22.207615 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 16709:17239(530) ack 90278 win 34560 <nop,nop,timestamp 144800798 3552040212> (DF) (ttl 63, id 55169)
21:28:22.223683 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 59720:61160(1440) ack 12015 win 16080 <nop,nop,timestamp 3552040237 144800795> (DF) (ttl 57, id 30918)
21:28:22.231664 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 61160:62600(1440) ack 12015 win 16080 <nop,nop,timestamp 3552040237 144800795> (DF) (ttl 57, id 30919)
21:28:22.232270 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 62600 win 34560 <nop,nop,timestamp 144800800 3552040237> (DF) (ttl 63, id 55899)
21:28:22.240539 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 62600:64040(1440) ack 12015 win 16080 <nop,nop,timestamp 3552040237 144800795> (DF) (ttl 57, id 30920)
21:28:22.251925 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 64040:65424(1384) ack 12015 win 16080 <nop,nop,timestamp 3552040237 144800795> (DF) (ttl 57, id 30921)
21:28:22.252614 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 65424 win 34560 <nop,nop,timestamp 144800802 3552040237> (DF) (ttl 63, id 55900)
21:28:22.252875 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 12015:12617(602) ack 65424 win 34560 <nop,nop,timestamp 144800802 3552040237> (DF) (ttl 63, id 55901)
21:28:22.259131 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 90278:91718(1440) ack 17239 win 16080 <nop,nop,timestamp 3552040258 144800798> (DF) (ttl 57, id 37425)
21:28:22.268589 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 91718:93158(1440) ack 17239 win 16080 <nop,nop,timestamp 3552040258 144800798> (DF) (ttl 57, id 37426)
21:28:22.268959 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 93158:93224(66) ack 17239 win 16080 <nop,nop,timestamp 3552040258 144800798> (DF) (ttl 57, id 37427)
21:28:22.269289 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 93158 win 34560 <nop,nop,timestamp 144800804 3552040258> (DF) (ttl 63, id 55170)
21:28:22.269505 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 17239:17766(527) ack 93224 win 34560 <nop,nop,timestamp 144800804 3552040258> (DF) (ttl 63, id 55171)
21:28:22.288161 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 65424:65821(397) ack 12617 win 16080 <nop,nop,timestamp 3552040309 144800802> (DF) (ttl 57, id 30922)
21:28:22.288908 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 12617:13150(533) ack 65821 win 34560 <nop,nop,timestamp 144800806 3552040309> (DF) (ttl 63, id 55902)
21:28:22.313778 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 93224:94664(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37428)
21:28:22.322577 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 94664:96104(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37429)
21:28:22.323175 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 96104 win 34560 <nop,nop,timestamp 144800809 3552040328> (DF) (ttl 63, id 55172)
21:28:22.332055 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 96104:97544(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37430)
21:28:22.340044 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 97544:98984(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37431)
21:28:22.340718 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 98984 win 34560 <nop,nop,timestamp 144800811 3552040328> (DF) (ttl 63, id 55173)
21:28:22.350478 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 98984:100424(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37432)
21:28:22.358925 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 100424:101864(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37433)
21:28:22.359679 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 101864 win 34560 <nop,nop,timestamp 144800813 3552040328> (DF) (ttl 63, id 55174)
21:28:22.368029 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 101864:103304(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040328 144800804> (DF) (ttl 57, id 37434)
21:28:22.376647 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 65821:67261(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30923)
21:28:22.384477 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 67261:68701(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30924)
21:28:22.385240 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 68701 win 34560 <nop,nop,timestamp 144800816 3552040351> (DF) (ttl 63, id 55903)
21:28:22.393891 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 68701:70141(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30925)
21:28:22.403264 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 70141:71581(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30926)
21:28:22.403987 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 71581 win 34560 <nop,nop,timestamp 144800817 3552040351> (DF) (ttl 63, id 55904)
21:28:22.404959 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 103304 win 34560 <nop,nop,timestamp 144800818 3552040328> (DF) (ttl 63, id 55175)
21:28:22.411656 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 71581:73021(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30927)
21:28:22.426161 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 73021:74461(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30928)
21:28:22.426950 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 74461 win 34560 <nop,nop,timestamp 144800820 3552040351> (DF) (ttl 63, id 55905)
21:28:22.428645 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 74461:75901(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040351 144800806> (DF) (ttl 57, id 30929)
21:28:22.437338 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 103304:104744(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040357 144800809> (DF) (ttl 57, id 37435)
21:28:22.449493 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 104744:106184(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040357 144800809> (DF) (ttl 57, id 37436)
21:28:22.450059 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 106184 win 34560 <nop,nop,timestamp 144800822 3552040357> (DF) (ttl 63, id 55176)
21:28:22.455239 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 106184:107624(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040357 144800809> (DF) (ttl 57, id 37437)
21:28:22.465009 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 75901 win 34560 <nop,nop,timestamp 144800824 3552040351> (DF) (ttl 63, id 55906)
21:28:22.465279 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 107624:109064(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040380 144800811> (DF) (ttl 57, id 37438)
21:28:22.465871 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 109064 win 34560 <nop,nop,timestamp 144800824 3552040357> (DF) (ttl 63, id 55177)
21:28:22.472939 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 109064:110504(1440) ack 17766 win 16080 <nop,nop,timestamp 3552040380 144800811> (DF) (ttl 57, id 37439)
21:28:22.477182 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 110504:111193(689) ack 17766 win 16080 <nop,nop,timestamp 3552040380 144800811> (DF) (ttl 57, id 37440)
21:28:22.477694 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 111193 win 34560 <nop,nop,timestamp 144800825 3552040380> (DF) (ttl 63, id 55178)
21:28:22.477935 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 17766:18291(525) ack 111193 win 34560 <nop,nop,timestamp 144800825 3552040380> (DF) (ttl 63, id 55179)
21:28:22.486190 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 75901:77341(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040417 144800816> (DF) (ttl 57, id 30930)
21:28:22.495604 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 77341:78781(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040417 144800816> (DF) (ttl 57, id 30931)
21:28:22.496325 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 78781 win 34560 <nop,nop,timestamp 144800827 3552040417> (DF) (ttl 63, id 55907)
21:28:22.504186 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 78781:80221(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040417 144800816> (DF) (ttl 57, id 30932)
21:28:22.512552 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 80221:81661(1440) ack 13150 win 16080 <nop,nop,timestamp 3552040437 144800817> (DF) (ttl 57, id 30933)
21:28:22.513334 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 81661 win 34560 <nop,nop,timestamp 144800828 3552040417> (DF) (ttl 63, id 55908)
21:28:22.514462 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 81661:81866(205) ack 13150 win 16080 <nop,nop,timestamp 3552040437 144800817> (DF) (ttl 57, id 30934)
21:28:22.514906 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 81866 win 34560 <nop,nop,timestamp 144800828 3552040437> (DF) (ttl 63, id 55909)
21:28:22.515440 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 13150:13676(526) ack 81866 win 34560 <nop,nop,timestamp 144800829 3552040437> (DF) (ttl 63, id 55910)
21:28:22.518752 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 111193:111593(400) ack 18291 win 16080 <nop,nop,timestamp 3552040526 144800825> (DF) (ttl 57, id 37441)
21:28:22.519658 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 18291:18838(547) ack 111593 win 34560 <nop,nop,timestamp 144800829 3552040526> (DF) (ttl 63, id 55180)
21:28:22.551104 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 81866:83265(1399) ack 13676 win 16080 <nop,nop,timestamp 3552040564 144800829> (DF) (ttl 57, id 30935)
21:28:22.552106 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 13676:14224(548) ack 83265 win 34560 <nop,nop,timestamp 144800832 3552040564> (DF) (ttl 63, id 55911)
21:28:22.635444 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . [tcp sum ok] ack 18838 win 16080 <nop,nop,timestamp 3552040658 144800829> (DF) (ttl 57, id 37442)
21:28:22.636033 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . [tcp sum ok] ack 14224 win 16080 <nop,nop,timestamp 3552040659 144800832> (DF) (ttl 57, id 30936)
21:28:22.705008 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 111593:113033(1440) ack 18838 win 16080 <nop,nop,timestamp 3552040719 144800829> (DF) (ttl 57, id 37443)
21:28:22.705946 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 113033:113151(118) ack 18838 win 16080 <nop,nop,timestamp 3552040719 144800829> (DF) (ttl 57, id 37444)
21:28:22.706452 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 113151 win 34560 <nop,nop,timestamp 144800848 3552040719> (DF) (ttl 63, id 55181)
21:28:22.706898 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: P 18838:19386(548) ack 113151 win 34560 <nop,nop,timestamp 144800848 3552040719> (DF) (ttl 63, id 55182)
21:28:22.715021 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 83265:84705(1440) ack 14224 win 16080 <nop,nop,timestamp 3552040729 144800832> (DF) (ttl 57, id 30937)
21:28:22.723624 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P 84705:86091(1386) ack 14224 win 16080 <nop,nop,timestamp 3552040729 144800832> (DF) (ttl 57, id 30938)
21:28:22.724327 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 86091 win 34560 <nop,nop,timestamp 144800849 3552040729> (DF) (ttl 63, id 55912)
21:28:22.724600 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: P 14224:14772(548) ack 86091 win 34560 <nop,nop,timestamp 144800849 3552040729> (DF) (ttl 63, id 55913)
21:28:22.770264 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . [tcp sum ok] ack 19386 win 16080 <nop,nop,timestamp 3552040794 144800848> (DF) (ttl 57, id 37445)
21:28:22.788027 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . [tcp sum ok] ack 14772 win 16080 <nop,nop,timestamp 3552040812 144800849> (DF) (ttl 57, id 30939)
21:28:22.863460 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: . 86091:87531(1440) ack 14772 win 16080 <nop,nop,timestamp 3552040877 144800849> (DF) (ttl 57, id 30940)
21:28:22.863801 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.57772: P [tcp sum ok] 87531:87544(13) ack 14772 win 16080 <nop,nop,timestamp 3552040877 144800849> (DF) (ttl 57, id 30941)
21:28:22.864139 hhh.hhh.hhh.hhh.57772 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 87544 win 34560 <nop,nop,timestamp 144800863 3552040877> (DF) (ttl 63, id 55914)
21:28:22.920299 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: . 113151:114591(1440) ack 19386 win 16080 <nop,nop,timestamp 3552040935 144800848> (DF) (ttl 57, id 37446)
21:28:22.926073 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59450: P 114591:115432(841) ack 19386 win 16080 <nop,nop,timestamp 3552040935 144800848> (DF) (ttl 57, id 37447)
21:28:22.926693 hhh.hhh.hhh.hhh.59450 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 115432 win 34560 <nop,nop,timestamp 144800870 3552040935> (DF) (ttl 63, id 55183)
21:28:23.025172 hhh.hhh.hhh.hhh.64462 > xxx.xxx.xxx.xxx.1863: P [tcp sum ok] 335:340(5) ack 405 win 6432 <nop,nop,timestamp 144800880 45782378> (DF) (ttl 63, id 21153)
21:28:23.027975 hhh.hhh.hhh.hhh.61797 > xxx.xxx.xxx.xxx.5050: P [tcp sum ok] 1340:1360(20) ack 26086 win 16398 <nop,nop,timestamp 144800880 1634999968> (DF) (ttl 63, id 21760)
21:28:23.035879 xxx.xxx.xxx.xxx.1863 > hhh.hhh.hhh.hhh.64462: P [tcp sum ok] 405:410(5) ack 340 win 17194 <nop,nop,timestamp 45783078 144800880> (ttl 118, id 52274)
21:28:23.036212 hhh.hhh.hhh.hhh.64462 > xxx.xxx.xxx.xxx.1863: . [tcp sum ok] ack 410 win 6432 <nop,nop,timestamp 144800881 45783078> (DF) (ttl 63, id 21154)
21:28:23.121422 xxx.xxx.xxx.xxx.5050 > hhh.hhh.hhh.hhh.61797: P 26086:26464(378) ack 1360 win 33120 <nop,nop,timestamp 1635006960 144800880> (DF) (ttl 47, id 64955)
21:28:23.121870 hhh.hhh.hhh.hhh.61797 > xxx.xxx.xxx.xxx.5050: . [tcp sum ok] ack 26464 win 16398 <nop,nop,timestamp 144800889 1635006960> (DF) (ttl 63, id 21761)
21:28:23.192132 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 65028+% [1au] A? cdn.fastclick.net. (46) (ttl 64, id 60442)
21:28:23.192694 hhh.hhh.hhh.hhh.53 > xxx.xxx.xxx.xxx.53:  [udp sum ok] 34082+% [1au] A? ns1.orng.twtelecom.net. (51) (ttl 64, id 49096)
21:28:23.199476 xxx.xxx.xxx.xxx.5050 > hhh.hhh.hhh.hhh.61797: P [tcp sum ok] 26464:26492(28) ack 1360 win 33120 <nop,nop,timestamp 1635006968 144800889> (DF) (ttl 47, id 65269)
21:28:23.199922 hhh.hhh.hhh.hhh.61797 > xxx.xxx.xxx.xxx.5050: . [tcp sum ok] ack 26492 win 16398 <nop,nop,timestamp 144800897 1635006968> (DF) (ttl 63, id 21762)
21:28:23.217214 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  65028 2/1/1 cdn.fastclick.net. A 69.25.57.192, cdn.fastclick.net. A[|domain] (ttl 244, id 61732)
21:28:23.219324 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: S [tcp sum ok] 2514202572:2514202572(0) win 5840 <mss 1460,sackOK,timestamp 144800899 0,nop,wscale 0> (DF) (ttl 63, id 54095)
21:28:23.226463 xxx.xxx.xxx.xxx.53 > hhh.hhh.hhh.hhh.53:  34082 1/13/16 ns1.orng.twtelecom.net. A 168.215.210.50 (552) (ttl 244, id 61737)
21:28:23.232501 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: S [tcp sum ok] 4102729741:4102729741(0) ack 2514202573 win 65535 <mss 1452,nop,wscale 1,nop,nop,timestamp 2963653408 144800899,nop,nop,sackOK> (DF) (ttl 54, id 34282)
21:28:23.232969 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1 win 5840 <nop,nop,timestamp 144800900 2963653408> (DF) (ttl 63, id 54096)
21:28:23.233158 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: P 1:639(638) ack 1 win 5840 <nop,nop,timestamp 144800900 2963653408> (DF) (ttl 63, id 54097)
21:28:23.270320 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 1:1441(1440) ack 639 win 33120 <nop,nop,timestamp 2963653437 144800900> (DF) (ttl 54, id 34327)
21:28:23.271029 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 1441 win 8640 <nop,nop,timestamp 144800904 2963653437> (DF) (ttl 63, id 54098)
21:28:23.283769 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 1441:2881(1440) ack 639 win 33120 <nop,nop,timestamp 2963653437 144800900> (DF) (ttl 54, id 34328)
21:28:23.284401 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 2881 win 11520 <nop,nop,timestamp 144800905 2963653437> (DF) (ttl 63, id 54099)
21:28:23.293054 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: P 2881:4109(1228) ack 639 win 33120 <nop,nop,timestamp 2963653437 144800900> (DF) (ttl 54, id 34329)
21:28:23.293598 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 4109 win 14400 <nop,nop,timestamp 144800906 2963653437> (DF) (ttl 63, id 54100)
21:28:23.294911 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 4109:5549(1440) ack 639 win 33120 <nop,nop,timestamp 2963653437 144800900> (DF) (ttl 54, id 34333)
21:28:23.295527 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 5549 win 17280 <nop,nop,timestamp 144800907 2963653437> (DF) (ttl 63, id 54101)
21:28:23.303601 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 5549:6989(1440) ack 639 win 33120 <nop,nop,timestamp 2963653459 144800904> (DF) (ttl 54, id 34359)
21:28:23.304224 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 6989 win 20160 <nop,nop,timestamp 144800907 2963653459> (DF) (ttl 63, id 54102)
21:28:23.315593 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 6989:8429(1440) ack 639 win 33120 <nop,nop,timestamp 2963653459 144800904> (DF) (ttl 54, id 34360)
21:28:23.316211 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 8429 win 23040 <nop,nop,timestamp 144800909 2963653459> (DF) (ttl 63, id 54103)
21:28:23.321347 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 8429:9869(1440) ack 639 win 33120 <nop,nop,timestamp 2963653482 144800906> (DF) (ttl 54, id 34389)
21:28:23.321949 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 9869 win 25920 <nop,nop,timestamp 144800909 2963653482> (DF) (ttl 63, id 54104)
21:28:23.332323 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 9869:11309(1440) ack 639 win 33120 <nop,nop,timestamp 2963653486 144800907> (DF) (ttl 54, id 34398)
21:28:23.332896 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 11309 win 28800 <nop,nop,timestamp 144800910 2963653486> (DF) (ttl 63, id 54105)
21:28:23.338863 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 11309:12749(1440) ack 639 win 33120 <nop,nop,timestamp 2963653492 144800907> (DF) (ttl 54, id 34404)
21:28:23.339482 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 12749 win 31680 <nop,nop,timestamp 144800911 2963653492> (DF) (ttl 63, id 54106)
21:28:23.347795 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 12749:14189(1440) ack 639 win 33120 <nop,nop,timestamp 2963653504 144800909> (DF) (ttl 54, id 34422)
21:28:23.348357 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 14189 win 34560 <nop,nop,timestamp 144800912 2963653504> (DF) (ttl 63, id 54107)
21:28:23.363562 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 14189:15629(1440) ack 639 win 33120 <nop,nop,timestamp 2963653511 144800909> (DF) (ttl 54, id 34443)
21:28:23.364161 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 15629 win 34560 <nop,nop,timestamp 144800913 2963653511> (DF) (ttl 63, id 54108)
21:28:23.365589 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 15629:17069(1440) ack 639 win 33120 <nop,nop,timestamp 2963653525 144800910> (DF) (ttl 54, id 34456)
21:28:23.366311 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 17069 win 34560 <nop,nop,timestamp 144800914 2963653525> (DF) (ttl 63, id 54109)
21:28:23.374321 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 17069:18509(1440) ack 639 win 33120 <nop,nop,timestamp 2963653528 144800911> (DF) (ttl 54, id 34462)
21:28:23.383196 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 18509:19949(1440) ack 639 win 33120 <nop,nop,timestamp 2963653543 144800912> (DF) (ttl 54, id 34480)
21:28:23.383806 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 19949 win 34560 <nop,nop,timestamp 144800915 2963653528> (DF) (ttl 63, id 54110)
21:28:23.394817 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 19949:21389(1440) ack 639 win 33120 <nop,nop,timestamp 2963653552 144800913> (DF) (ttl 54, id 34488)
21:28:23.402624 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 21389:22829(1440) ack 639 win 33120 <nop,nop,timestamp 2963653560 144800914> (DF) (ttl 54, id 34499)
21:28:23.403282 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 22829 win 34560 <nop,nop,timestamp 144800917 2963653552> (DF) (ttl 63, id 54111)
21:28:23.409567 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 22829:24269(1440) ack 639 win 33120 <nop,nop,timestamp 2963653575 144800915> (DF) (ttl 54, id 34521)
21:28:23.419988 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . 24269:25709(1440) ack 639 win 33120 <nop,nop,timestamp 2963653575 144800915> (DF) (ttl 54, id 34522)
21:28:23.420329 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: P 25709:25873(164) ack 639 win 33120 <nop,nop,timestamp 2963653575 144800915> (DF) (ttl 54, id 34523)
21:28:23.420666 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 25709 win 34560 <nop,nop,timestamp 144800919 2963653575> (DF) (ttl 63, id 54112)
21:28:23.420773 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 25873 win 34560 <nop,nop,timestamp 144800919 2963653575> (DF) (ttl 63, id 54113)
21:28:23.721043 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: P 4851:5279(428) ack 28441 win 34848 (DF) (ttl 63, id 18583)
21:28:23.753496 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.58569: P 28441:29022(581) ack 5279 win 8190 (ttl 241, id 25043)
21:28:23.753985 hhh.hhh.hhh.hhh.58569 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 29022 win 34848 (DF) (ttl 63, id 18584)
21:28:23.839171 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 598021891:598021891(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193504 0> (DF) (ttl 64, id 59135)
21:28:23.855641 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: S [tcp sum ok] 3505607068:3505607068(0) ack 598021892 win 5792 <mss 1452,sackOK,timestamp 365144248 2115193504,nop,wscale 0> (DF) (ttl 52, id 0)
21:28:23.855814 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193504 365144248> (DF) (ttl 64, id 64415)
21:28:23.885603 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: P 1:99(98) ack 1 win 5792 <nop,nop,timestamp 365144251 2115193504> (DF) (ttl 52, id 63783)
21:28:23.885863 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:15(14) ack 99 win 16384 <nop,nop,timestamp 2115193504 365144251> (DF) (ttl 64, id 42432)
21:28:23.897211 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: . [tcp sum ok] ack 15 win 5792 <nop,nop,timestamp 365144253 2115193504> (DF) (ttl 52, id 63784)
21:28:23.915030 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: P [tcp sum ok] 99:135(36) ack 15 win 5792 <nop,nop,timestamp 365144253 2115193504> (DF) (ttl 52, id 63785)
21:28:23.916246 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 15:34(19) ack 135 win 16384 <nop,nop,timestamp 2115193504 365144253> (DF) (ttl 64, id 62623)
21:28:23.935615 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: P 135:195(60) ack 34 win 5792 <nop,nop,timestamp 365144257 2115193504> (DF) (ttl 52, id 63786)
21:28:24.075240 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: F [tcp sum ok] 18127:18127(0) ack 1017 win 7504 <nop,nop,timestamp 3857502909 144800715> (DF) (ttl 56, id 20030)
21:28:24.075705 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: F [tcp sum ok] 45738:45738(0) ack 833 win 6656 <nop,nop,timestamp 3857502909 144800709> (DF) (ttl 56, id 9016)
21:28:24.115236 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 18128 win 34560 <nop,nop,timestamp 144800989 3857502909> (DF) (ttl 63, id 27349)
21:28:24.115331 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 45739 win 31680 <nop,nop,timestamp 144800989 3857502909> (DF) (ttl 63, id 2524)
21:28:24.135572 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 195 win 16384 <nop,nop,timestamp 2115193504 365144257> (DF) (ttl 64, id 37598)
21:28:26.945725 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 34:40(6) ack 195 win 16384 <nop,nop,timestamp 2115193510 365144257> (DF) (ttl 64, id 54357)
21:28:26.957322 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: P [tcp sum ok] 195:204(9) ack 40 win 5792 <nop,nop,timestamp 365144559 2115193510> (DF) (ttl 52, id 63787)
21:28:26.957626 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 40:46(6) ack 204 win 16384 <nop,nop,timestamp 2115193510 365144559> (DF) (ttl 64, id 58480)
21:28:26.969076 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: P 204:254(50) ack 46 win 5792 <nop,nop,timestamp 365144560 2115193510> (DF) (ttl 52, id 63788)
21:28:26.969306 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 46:46(0) ack 254 win 16384 <nop,nop,timestamp 2115193510 365144560> (DF) (ttl 64, id 61784)
21:28:26.973297 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: F [tcp sum ok] 254:254(0) ack 46 win 5792 <nop,nop,timestamp 365144560 2115193510> (DF) (ttl 52, id 63789)
21:28:26.973450 hhh.hhh.hhh.hhh.12164 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 255 win 16384 <nop,nop,timestamp 2115193510 365144560> (DF) (ttl 64, id 55147)
21:28:26.976061 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 1214252835:1214252835(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193510 0> (DF) (ttl 64, id 38437)
21:28:26.982870 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.12164: . [tcp sum ok] ack 47 win 5792 <nop,nop,timestamp 365144562 2115193510> (DF) (ttl 52, id 63790)
21:28:27.144835 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: S [tcp sum ok] 2457375314:2457375314(0) ack 1214252836 win 5792 <mss 1452,sackOK,timestamp 384841276 2115193510,nop,wscale 0> (DF) (ttl 43, id 0)
21:28:27.144992 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193510 384841276> (DF) (ttl 64, id 39297)
21:28:27.315740 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: P 1:58(57) ack 1 win 5792 <nop,nop,timestamp 384841292 2115193510> (DF) (ttl 43, id 42015)
21:28:27.315985 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:25(24) ack 58 win 16384 <nop,nop,timestamp 2115193511 384841292> (DF) (ttl 64, id 57640)
21:28:27.480794 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: . [tcp sum ok] ack 25 win 5792 <nop,nop,timestamp 384841309 2115193511> (DF) (ttl 43, id 42016)
21:28:27.483196 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: P [tcp sum ok] 58:97(39) ack 25 win 5792 <nop,nop,timestamp 384841309 2115193511> (DF) (ttl 43, id 42017)
21:28:27.483409 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 25:39(14) ack 97 win 16384 <nop,nop,timestamp 2115193511 384841309> (DF) (ttl 64, id 59995)
21:28:27.483592 xxx.xxx.xxx.xxx.2561 > hhh.hhh.hhh.hhh.45662: S [tcp sum ok] 1914225817:1914225817(0) win 64240 <mss 1360,nop,nop,sackOK> (DF) (ttl 108, id 56609)
21:28:27.484003 hhh.hhh.hhh.hhh.45662 > xxx.xxx.xxx.xxx.2561: R [tcp sum ok] 0:0(0) ack 1914225818 win 0 (DF) (ttl 63, id 23997)
21:28:27.659674 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150542:150659(117) ack 2325 win 57600 <nop,nop,timestamp 576374423 144800706> (DF) (ttl 44, id 50332)
21:28:27.660160 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150659 win 34560 <nop,nop,timestamp 144801343 576374423> (DF) (ttl 63, id 42565)
21:28:27.666165 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: P [tcp sum ok] 97:136(39) ack 39 win 5792 <nop,nop,timestamp 384841328 2115193511> (DF) (ttl 43, id 42018)
21:28:27.865672 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 136 win 16384 <nop,nop,timestamp 2115193512 384841328> (DF) (ttl 64, id 62338)
21:28:27.972945 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: F [tcp sum ok] 25873:25873(0) ack 639 win 33120 <nop,nop,timestamp 2963658258 144800919> (DF) (ttl 54, id 43718)
21:28:28.005413 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 25874 win 34560 <nop,nop,timestamp 144801378 2963658258> (DF) (ttl 63, id 54114)
21:28:28.144824 xxx.xxx.xxx.xxx.2561 > hhh.hhh.hhh.hhh.45662: S [tcp sum ok] 1914225817:1914225817(0) win 64240 <mss 1360,nop,nop,sackOK> (DF) (ttl 108, id 56671)
21:28:28.145168 hhh.hhh.hhh.hhh.45662 > xxx.xxx.xxx.xxx.2561: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 63, id 23998)
21:28:28.845847 xxx.xxx.xxx.xxx.2561 > hhh.hhh.hhh.hhh.45662: S [tcp sum ok] 1914225817:1914225817(0) win 64240 <mss 1360,nop,nop,sackOK> (DF) (ttl 108, id 56733)
21:28:28.846136 hhh.hhh.hhh.hhh.45662 > xxx.xxx.xxx.xxx.2561: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 63, id 23999)
21:28:30.675842 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 39:45(6) ack 136 win 16384 <nop,nop,timestamp 2115193517 384841328> (DF) (ttl 64, id 41202)
21:28:30.845917 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: P [tcp sum ok] 136:145(9) ack 45 win 5792 <nop,nop,timestamp 384841646 2115193517> (DF) (ttl 43, id 42019)
21:28:30.846219 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 45:51(6) ack 145 win 16384 <nop,nop,timestamp 2115193518 384841646> (DF) (ttl 64, id 59802)
21:28:31.010450 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: P [tcp sum ok] 145:154(9) ack 51 win 5792 <nop,nop,timestamp 384841662 2115193518> (DF) (ttl 43, id 42020)
21:28:31.010689 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 51:51(0) ack 154 win 16384 <nop,nop,timestamp 2115193518 384841662> (DF) (ttl 64, id 36381)
21:28:31.014672 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: F [tcp sum ok] 154:154(0) ack 51 win 5792 <nop,nop,timestamp 384841662 2115193518> (DF) (ttl 43, id 42021)
21:28:31.014824 hhh.hhh.hhh.hhh.15032 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 155 win 16384 <nop,nop,timestamp 2115193518 384841662> (DF) (ttl 64, id 33018)
21:28:31.017531 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: S [tcp sum ok] 313339567:313339567(0) win 16384 <mss 1452,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2115193518 0> (DF) (ttl 64, id 62165)
21:28:31.030631 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: S [tcp sum ok] 1804064777:1804064777(0) ack 313339568 win 65535 <mss 1452,nop,wscale 0,nop,nop,timestamp 372501302 2115193518> (ttl 52, id 38047)
21:28:31.030786 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 1 win 16384 <nop,nop,timestamp 2115193518 372501302> (DF) (ttl 64, id 59377)
21:28:31.043236 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: P 1:58(57) ack 1 win 65535 <nop,nop,timestamp 372501303 2115193518> (DF) (ttl 52, id 38050)
21:28:31.043476 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 1:28(27) ack 58 win 16384 <nop,nop,timestamp 2115193518 372501303> (DF) (ttl 64, id 32933)
21:28:31.054981 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: . [tcp sum ok] ack 28 win 65535 <nop,nop,timestamp 372501305 2115193518> (DF) (ttl 52, id 38052)
21:28:31.055247 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: P [tcp sum ok] 58:86(28) ack 28 win 65535 <nop,nop,timestamp 372501305 2115193518> (DF) (ttl 52, id 38053)
21:28:31.055449 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 28:43(15) ack 86 win 16384 <nop,nop,timestamp 2115193518 372501305> (DF) (ttl 64, id 55853)
21:28:31.066840 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: . [tcp sum ok] ack 43 win 65535 <nop,nop,timestamp 372501306 2115193518> (DF) (ttl 52, id 38060)
21:28:31.074481 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: P 86:136(50) ack 43 win 65535 <nop,nop,timestamp 372501306 2115193518> (DF) (ttl 52, id 38066)
21:28:31.183886 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.15032: . [tcp sum ok] ack 52 win 5792 <nop,nop,timestamp 384841679 2115193518> (DF) (ttl 43, id 42022)
21:28:31.265807 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 136 win 16384 <nop,nop,timestamp 2115193519 372501306> (DF) (ttl 64, id 45316)
21:28:32.232786 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150659:150725(66) ack 2325 win 57600 <nop,nop,timestamp 576374881 144801343> (DF) (ttl 44, id 51766)
21:28:32.233154 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150725 win 34560 <nop,nop,timestamp 144801800 576374881> (DF) (ttl 63, id 42566)
21:28:33.015984 xxx.xxx.xxx.xxx.9898 > hhh.hhh.hhh.hhh.64452: P [tcp sum ok] 1396:1406(10) ack 1 win 16384 (DF) (ttl 100, id 44713)
21:28:33.016324 hhh.hhh.hhh.hhh.64452 > xxx.xxx.xxx.xxx.9898: . [tcp sum ok] ack 1406 win 6432 (DF) (ttl 63, id 6780)
21:28:33.301062 xxx.xxx.xxx.xxx.6667 > hhh.hhh.hhh.hhh.59086: P 150725:150800(75) ack 2325 win 57600 <nop,nop,timestamp 576374988 144801800> (DF) (ttl 44, id 52203)
21:28:33.301396 hhh.hhh.hhh.hhh.59086 > xxx.xxx.xxx.xxx.6667: . [tcp sum ok] ack 150800 win 34560 <nop,nop,timestamp 144801907 576374988> (DF) (ttl 63, id 42567)
21:28:34.082311 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 43:49(6) ack 136 win 16384 <nop,nop,timestamp 2115193524 372501306> (DF) (ttl 64, id 46641)
21:28:34.093838 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: . [tcp sum ok] ack 49 win 65535 <nop,nop,timestamp 372501608 2115193524> (DF) (ttl 52, id 38341)
21:28:34.094108 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: P [tcp sum ok] 136:145(9) ack 49 win 65535 <nop,nop,timestamp 372501608 2115193524> (DF) (ttl 52, id 38342)
21:28:34.094360 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: P [tcp sum ok] 49:55(6) ack 145 win 16384 <nop,nop,timestamp 2115193524 372501608> (DF) (ttl 64, id 51781)
21:28:34.105669 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: . [tcp sum ok] ack 55 win 65535 <nop,nop,timestamp 372501610 2115193524> (DF) (ttl 52, id 38343)
21:28:34.105949 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: P [tcp sum ok] 145:155(10) ack 55 win 65535 <nop,nop,timestamp 372501610 2115193524> (DF) (ttl 52, id 38344)
21:28:34.106193 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: F [tcp sum ok] 55:55(0) ack 155 win 16384 <nop,nop,timestamp 2115193524 372501610> (DF) (ttl 64, id 41992)
21:28:34.106561 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: F [tcp sum ok] 155:155(0) ack 55 win 65535 <nop,nop,timestamp 372501610 2115193524> (DF) (ttl 52, id 38345)
21:28:34.106697 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 156 win 16384 <nop,nop,timestamp 2115193524 372501610> (DF) (ttl 64, id 64241)
21:28:34.115767 xxx.xxx.xxx.xxx.110 > hhh.hhh.hhh.hhh.22745: F [tcp sum ok] 155:155(0) ack 56 win 65534 <nop,nop,timestamp 372501611 2115193524> (DF) (ttl 52, id 38346)
21:28:34.115910 hhh.hhh.hhh.hhh.22745 > xxx.xxx.xxx.xxx.110: . [tcp sum ok] ack 156 win 16384 <nop,nop,timestamp 2115193524 372501611> (DF) (ttl 64, id 47657)
21:28:34.156308 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 1033:1033(0) ack 893 win 7504 (DF) (ttl 63, id 61850)
21:28:34.156385 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 1032:1032(0) ack 893 win 7504 (DF) (ttl 63, id 55532)
21:28:34.156453 hhh.hhh.hhh.hhh.51201 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 1017:1017(0) ack 18128 win 34560 <nop,nop,timestamp 144801993 3857502909> (DF) (ttl 63, id 27350)
21:28:34.156512 hhh.hhh.hhh.hhh.61272 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 833:833(0) ack 45739 win 31680 <nop,nop,timestamp 144801993 3857502909> (DF) (ttl 63, id 2525)
21:28:34.156574 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 742:742(0) ack 374 win 6432 (DF) (ttl 63, id 57950)
21:28:34.156643 hhh.hhh.hhh.hhh.59055 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 639:639(0) ack 25874 win 34560 <nop,nop,timestamp 144801993 2963658258> (DF) (ttl 63, id 54115)
21:28:34.156742 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: F [tcp sum ok] 598:598(0) ack 388 win 6432 (DF) (ttl 63, id 17147)
21:28:34.169974 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.53621: F [tcp sum ok] 893:893(0) ack 1034 win 8190 (ttl 241, id 9883)
21:28:34.170375 hhh.hhh.hhh.hhh.53621 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 894 win 7504 (DF) (ttl 63, id 61851)
21:28:34.170416 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.51201: . [tcp sum ok] ack 1018 win 7504 <nop,nop,timestamp 3857503918 144801993> (DF) (ttl 56, id 0)
21:28:34.170881 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.52870: F [tcp sum ok] 893:893(0) ack 1033 win 8190 (ttl 241, id 29339)
21:28:34.171250 hhh.hhh.hhh.hhh.52870 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 894 win 7504 (DF) (ttl 63, id 55533)
21:28:34.172589 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.61272: . [tcp sum ok] ack 834 win 6656 <nop,nop,timestamp 3857503918 144801993> (DF) (ttl 56, id 0)
21:28:34.177330 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.59055: . [tcp sum ok] ack 640 win 33119 <nop,nop,timestamp 2963664603 144801993> (DF) (ttl 54, id 56186)
21:28:34.177640 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.63968: F [tcp sum ok] 374:374(0) ack 743 win 8190 (ttl 241, id 41628)
21:28:34.177992 hhh.hhh.hhh.hhh.63968 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 375 win 6432 (DF) (ttl 63, id 57951)
21:28:34.181938 xxx.xxx.xxx.xxx.80 > hhh.hhh.hhh.hhh.62331: F [tcp sum ok] 388:388(0) ack 599 win 8190 (ttl 241, id 20381)
21:28:34.182244 hhh.hhh.hhh.hhh.62331 > xxx.xxx.xxx.xxx.80: . [tcp sum ok] ack 389 win 6432 (DF) (ttl 63, id 17148)


More information about the Snort-devel mailing list