Packet analyzer

Works like Wireshark. Open a capture and find the machine that's phoning home.

A front-desk computer at Lakeshore Family Health keeps talking to an address nobody recognizes. Here are about ten minutes of office traffic, captured at the router. Find the machine, what it talks to, and how. (Lakeshore Family Health is a made-up company.)

Type a filter like dns or http.request.method == "GET" to narrow the list. In Wireshark this is called a display filter, and the same habit works there. Click any field to see its bytes.

QuickCruit Packet Analyzer

No.	Time	Source	Destination	Protocol	Length	Info
1	0.000000	10.20.37.189	10.20.1.10	DNS	86	Standard query 0x197d A update.formwiseapp.example
2	0.017271	10.20.1.10	10.20.37.189	DNS	102	Standard query response 0x197d A update.formwiseapp.example A 203.0.113.132
3	0.018892	10.20.37.189	203.0.113.132	TCP	66	55482 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
4	0.101180	203.0.113.132	10.20.37.189	TCP	66	80 → 55482 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
5	0.101537	10.20.37.189	203.0.113.132	TCP	60	55482 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
6	0.101797	10.20.37.189	203.0.113.132	HTTP	256	GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1
7	0.242752	203.0.113.132	10.20.37.189	HTTP	254	HTTP/1.1 200 OK (application/json)
8	0.243467	10.20.37.189	203.0.113.132	TCP	60	55482 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0
9	0.257727	10.20.37.189	203.0.113.132	TCP	60	55482 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0
10	0.340015	203.0.113.132	10.20.37.189	TCP	60	80 → 55482 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0
11	0.340359	10.20.37.189	203.0.113.132	TCP	60	55482 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0
12	7.997061	10.20.37.135	203.0.113.82	TCP	66	58677 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
13	8.034839	203.0.113.82	10.20.37.135	TCP	66	443 → 58677 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
14	8.034945	10.20.37.135	203.0.113.82	TCP	60	58677 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
15	8.036487	10.20.37.135	203.0.113.82	TLS	313	Client Hello (SNI=cdn.brightlane-static.example)
16	8.086611	203.0.113.82	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
17	8.086844	203.0.113.82	10.20.37.135	TCP	1514	443 → 58677 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
18	8.087048	203.0.113.82	10.20.37.135	TLS	1414	Application Data
19	8.090910	10.20.37.135	203.0.113.82	TLS	850	Application Data
20	8.197977	203.0.113.82	10.20.37.135	TLS	1514	Application Data
21	8.198009	203.0.113.82	10.20.37.135	TCP	1514	443 → 58677 [ACK] Seq=5741 Ack=1056 Win=501 Len=1460 [part of a TLS record]
22	8.198243	203.0.113.82	10.20.37.135	TLS	1514	Application Data
23	8.198290	203.0.113.82	10.20.37.135	TLS	1514	Application Data
24	8.198509	203.0.113.82	10.20.37.135	TCP	1514	443 → 58677 [ACK] Seq=10121 Ack=1056 Win=501 Len=1460 [part of a TLS record]
25	8.198640	203.0.113.82	10.20.37.135	TCP	399	443 → 58677 [ACK, PSH] Seq=11581 Ack=1056 Win=501 Len=345 [part of a TLS record]
26	8.199196	10.20.37.135	203.0.113.82	TCP	60	58677 → 443 [ACK] Seq=1056 Ack=11926 Win=1026 Len=0
27	8.233742	10.20.37.135	203.0.113.82	TCP	60	58677 → 443 [ACK, FIN] Seq=1056 Ack=11926 Win=1026 Len=0
28	8.271520	203.0.113.82	10.20.37.135	TCP	60	443 → 58677 [ACK, FIN] Seq=11926 Ack=1057 Win=501 Len=0
29	8.271839	10.20.37.135	203.0.113.82	TCP	60	58677 → 443 [ACK] Seq=1057 Ack=11927 Win=1026 Len=0
30	8.748498	10.20.32.166	10.20.1.10	DNS	98	Standard query 0x36eb A intranet.lakeshorefamilyhealth.example
31	8.757437	10.20.1.10	10.20.32.166	DNS	114	Standard query response 0x36eb A intranet.lakeshorefamilyhealth.example A 10.20.1.20
32	8.757670	10.20.32.166	10.20.1.20	TCP	66	52702 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
33	8.759072	10.20.1.20	10.20.32.166	TCP	66	80 → 52702 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
34	8.759232	10.20.32.166	10.20.1.20	TCP	60	52702 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
35	8.759747	10.20.32.166	10.20.1.20	HTTP	350	GET /directory HTTP/1.1
36	8.763381	10.20.1.20	10.20.32.166	HTTP	397	HTTP/1.1 200 OK (text/html)
37	8.763594	10.20.32.166	10.20.1.20	TCP	60	52702 → 80 [ACK] Seq=297 Ack=344 Win=1026 Len=0
38	8.766392	10.20.32.166	10.20.1.20	TCP	60	52702 → 80 [ACK, FIN] Seq=297 Ack=344 Win=1026 Len=0
39	8.767794	10.20.1.20	10.20.32.166	TCP	60	80 → 52702 [ACK, FIN] Seq=344 Ack=298 Win=501 Len=0
40	8.767967	10.20.32.166	10.20.1.20	TCP	60	52702 → 80 [ACK] Seq=298 Ack=345 Win=1026 Len=0
41	21.215011	10.20.32.166	10.20.1.10	DNS	89	Standard query 0xb95d A cdn.brightlane-static.example
42	21.238710	10.20.1.10	10.20.32.166	DNS	105	Standard query response 0xb95d A cdn.brightlane-static.example A 203.0.113.82
43	21.240028	10.20.32.166	203.0.113.82	TCP	66	52697 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
44	21.261124	203.0.113.82	10.20.32.166	TCP	66	443 → 52697 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
45	21.261350	10.20.32.166	203.0.113.82	TCP	60	52697 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
46	21.263187	10.20.32.166	203.0.113.82	TLS	313	Client Hello (SNI=cdn.brightlane-static.example)
47	21.298519	203.0.113.82	10.20.32.166	TLS	1514	Server Hello, Change Cipher Spec, Application Data
48	21.298638	203.0.113.82	10.20.32.166	TCP	1514	443 → 52697 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
49	21.298725	203.0.113.82	10.20.32.166	TLS	1474	Application Data
50	21.303642	10.20.32.166	203.0.113.82	TLS	979	Application Data
51	21.383607	203.0.113.82	10.20.32.166	TLS	959	Application Data
52	21.384100	10.20.32.166	203.0.113.82	TCP	60	52697 → 443 [ACK] Seq=1185 Ack=5246 Win=1026 Len=0
53	21.393300	10.20.32.166	203.0.113.82	TCP	60	52697 → 443 [ACK, FIN] Seq=1185 Ack=5246 Win=1026 Len=0
54	21.414396	203.0.113.82	10.20.32.166	TCP	60	443 → 52697 [ACK, FIN] Seq=5246 Ack=1186 Win=501 Len=0
55	21.414642	10.20.32.166	203.0.113.82	TCP	60	52697 → 443 [ACK] Seq=1186 Ack=5247 Win=1026 Len=0
56	35.952183	10.20.28.71	10.20.1.10	DNS	86	Standard query 0x5ec7 A update.formwiseapp.example
57	35.963269	10.20.1.10	10.20.28.71	DNS	102	Standard query response 0x5ec7 A update.formwiseapp.example A 203.0.113.132
58	35.964965	10.20.28.71	203.0.113.132	TCP	66	51844 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
59	36.025566	203.0.113.132	10.20.28.71	TCP	66	80 → 51844 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
60	36.025946	10.20.28.71	203.0.113.132	TCP	60	51844 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
61	36.026211	10.20.28.71	203.0.113.132	HTTP	256	GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1
62	36.135399	203.0.113.132	10.20.28.71	HTTP	254	HTTP/1.1 200 OK (application/json)
63	36.136228	10.20.28.71	203.0.113.132	TCP	60	51844 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0
64	36.144512	10.20.28.71	203.0.113.132	TCP	60	51844 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0
65	36.205113	203.0.113.132	10.20.28.71	TCP	60	80 → 51844 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0
66	36.205280	10.20.28.71	203.0.113.132	TCP	60	51844 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0
67	57.088830	10.20.37.135	10.20.1.10	DNS	93	Standard query 0xdca0 A www.lakeshorefamilyhealth.example
68	57.110324	10.20.1.10	10.20.37.135	DNS	165	Standard query response 0xdca0 A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183
69	57.111514	10.20.37.135	192.0.2.183	TCP	66	58676 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
70	57.131057	192.0.2.183	10.20.37.135	TCP	66	443 → 58676 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
71	57.131161	10.20.37.135	192.0.2.183	TCP	60	58676 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
72	57.131857	10.20.37.135	192.0.2.183	TLS	317	Client Hello (SNI=www.lakeshorefamilyhealth.example)
73	57.160698	192.0.2.183	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
74	57.160847	192.0.2.183	10.20.37.135	TCP	1514	443 → 58676 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]
75	57.160997	192.0.2.183	10.20.37.135	TLS	371	Application Data
76	57.163720	10.20.37.135	192.0.2.183	TLS	975	Application Data
77	57.229601	192.0.2.183	10.20.37.135	TLS	1514	Application Data
78	57.229765	192.0.2.183	10.20.37.135	TLS	1514	Application Data
79	57.229801	192.0.2.183	10.20.37.135	TLS	1514	Application Data
80	57.229935	192.0.2.183	10.20.37.135	TCP	1514	443 → 58676 [ACK] Seq=7618 Ack=1185 Win=501 Len=1460 [part of a TLS record]
81	57.230053	192.0.2.183	10.20.37.135	TCP	249	443 → 58676 [ACK, PSH] Seq=9078 Ack=1185 Win=501 Len=195 [part of a TLS record]
82	57.230355	10.20.37.135	192.0.2.183	TCP	60	58676 → 443 [ACK] Seq=1185 Ack=9273 Win=1026 Len=0
83	57.267499	10.20.37.135	192.0.2.183	TCP	60	58676 → 443 [ACK, FIN] Seq=1185 Ack=9273 Win=1026 Len=0
84	57.287042	192.0.2.183	10.20.37.135	TCP	60	443 → 58676 [ACK, FIN] Seq=9273 Ack=1186 Win=501 Len=0
85	57.287124	10.20.37.135	192.0.2.183	TCP	60	58676 → 443 [ACK] Seq=1186 Ack=9274 Win=1026 Len=0
86	67.467440	10.20.32.166	10.20.1.10	DNS	89	Standard query 0x309a A api.skyledger-weather.example
87	67.471591	10.20.1.10	10.20.32.166	DNS	105	Standard query response 0x309a A api.skyledger-weather.example A 192.0.2.182
88	67.472287	10.20.32.166	192.0.2.182	TCP	66	52695 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
89	67.504316	192.0.2.182	10.20.32.166	TCP	66	443 → 52695 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
90	67.504536	10.20.32.166	192.0.2.182	TCP	60	52695 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
91	67.505916	10.20.32.166	192.0.2.182	TLS	313	Client Hello (SNI=api.skyledger-weather.example)
92	67.546221	192.0.2.182	10.20.32.166	TLS	1514	Server Hello, Change Cipher Spec, Application Data
93	67.546295	192.0.2.182	10.20.32.166	TCP	1514	443 → 52695 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
94	67.546531	192.0.2.182	10.20.32.166	TLS	1296	Application Data
95	67.551427	10.20.32.166	192.0.2.182	TLS	477	Application Data
96	67.645851	192.0.2.182	10.20.32.166	TLS	1514	Application Data
97	67.646078	192.0.2.182	10.20.32.166	TLS	1514	Application Data
98	67.646314	192.0.2.182	10.20.32.166	TLS	1514	Application Data
99	67.646388	192.0.2.182	10.20.32.166	TCP	229	443 → 52695 [ACK, PSH] Seq=8543 Ack=683 Win=501 Len=175 [part of a TLS record]
100	67.646808	10.20.32.166	192.0.2.182	TCP	60	52695 → 443 [ACK] Seq=683 Ack=8718 Win=1026 Len=0
101	67.649172	10.20.32.166	192.0.2.182	TCP	60	52695 → 443 [ACK, FIN] Seq=683 Ack=8718 Win=1026 Len=0
102	67.681201	192.0.2.182	10.20.32.166	TCP	60	443 → 52695 [ACK, FIN] Seq=8718 Ack=684 Win=501 Len=0
103	67.681390	10.20.32.166	192.0.2.182	TCP	60	52695 → 443 [ACK] Seq=684 Ack=8719 Win=1026 Len=0
104	99.676356	10.20.32.166	10.20.1.10	DNS	84	Standard query 0xa79e A car-epointlinens.example
105	99.679265	10.20.1.10	10.20.32.166	DNS	100	Standard query response 0xa79e A car-epointlinens.example A 203.0.113.142
106	99.679533	10.20.32.166	203.0.113.142	TCP	66	52704 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
107	99.729124	203.0.113.142	10.20.32.166	TCP	66	80 → 52704 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
108	99.729343	10.20.32.166	203.0.113.142	TCP	60	52704 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
109	99.729688	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
110	99.789984	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
111	99.790468	10.20.32.166	203.0.113.142	TCP	60	52704 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
112	99.821713	10.20.32.166	203.0.113.142	TCP	60	52704 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
113	99.871304	203.0.113.142	10.20.32.166	TCP	60	80 → 52704 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
114	99.871444	10.20.32.166	203.0.113.142	TCP	60	52704 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
115	100.629508	10.20.30.75	10.20.1.10	DNS	89	Standard query 0xec31 A cdn.brightlane-static.example
116	100.640275	10.20.1.10	10.20.30.75	DNS	105	Standard query response 0xec31 A cdn.brightlane-static.example A 203.0.113.82
117	100.640503	10.20.30.75	203.0.113.82	TCP	66	57435 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
118	100.699842	203.0.113.82	10.20.30.75	TCP	66	443 → 57435 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
119	100.700047	10.20.30.75	203.0.113.82	TCP	60	57435 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
120	100.700914	10.20.30.75	203.0.113.82	TLS	313	Client Hello (SNI=cdn.brightlane-static.example)
121	100.775205	203.0.113.82	10.20.30.75	TLS	1514	Server Hello, Change Cipher Spec, Application Data
122	100.775282	203.0.113.82	10.20.30.75	TLS	1514	Application Data
123	100.775388	203.0.113.82	10.20.30.75	TCP	150	443 → 57435 [ACK, PSH] Seq=2921 Ack=260 Win=501 Len=96 [part of a TLS record]
124	100.778924	10.20.30.75	203.0.113.82	TLS	930	Application Data
125	100.850323	203.0.113.82	10.20.30.75	TLS	1514	Application Data
126	100.850416	203.0.113.82	10.20.30.75	TLS	1514	Application Data
127	100.850602	203.0.113.82	10.20.30.75	TLS	1514	Application Data
128	100.850774	203.0.113.82	10.20.30.75	TCP	689	443 → 57435 [ACK, PSH] Seq=7397 Ack=1136 Win=501 Len=635 [part of a TLS record]
129	100.850984	10.20.30.75	203.0.113.82	TCP	60	57435 → 443 [ACK] Seq=1136 Ack=8032 Win=1026 Len=0
130	100.866913	10.20.30.75	203.0.113.82	TCP	60	57435 → 443 [ACK, FIN] Seq=1136 Ack=8032 Win=1026 Len=0
131	100.926252	203.0.113.82	10.20.30.75	TCP	60	443 → 57435 [ACK, FIN] Seq=8032 Ack=1137 Win=501 Len=0
132	100.926362	10.20.30.75	203.0.113.82	TCP	60	57435 → 443 [ACK] Seq=1137 Ack=8033 Win=1026 Len=0
133	116.415580	10.20.37.135	10.20.1.10	DNS	98	Standard query 0x3c2f A intranet.lakeshorefamilyhealth.example
134	116.431495	10.20.1.10	10.20.37.135	DNS	114	Standard query response 0x3c2f A intranet.lakeshorefamilyhealth.example A 10.20.1.20
135	116.432127	10.20.37.135	10.20.1.20	TCP	66	58680 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
136	116.432611	10.20.1.20	10.20.37.135	TCP	66	80 → 58680 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
137	116.432709	10.20.37.135	10.20.1.20	TCP	60	58680 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
138	116.433533	10.20.37.135	10.20.1.20	HTTP	363	GET /schedule HTTP/1.1
139	116.452397	10.20.1.20	10.20.37.135	HTTP	407	HTTP/1.1 200 OK (text/html)
140	116.453151	10.20.37.135	10.20.1.20	TCP	60	58680 → 80 [ACK] Seq=310 Ack=354 Win=1026 Len=0
141	116.474199	10.20.37.135	10.20.1.20	TCP	60	58680 → 80 [ACK, FIN] Seq=310 Ack=354 Win=1026 Len=0
142	116.474683	10.20.1.20	10.20.37.135	TCP	60	80 → 58680 [ACK, FIN] Seq=354 Ack=311 Win=501 Len=0
143	116.475029	10.20.37.135	10.20.1.20	TCP	60	58680 → 80 [ACK] Seq=311 Ack=355 Win=1026 Len=0
144	144.169815	10.20.32.166	203.0.113.142	TCP	66	52705 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
145	144.206193	203.0.113.142	10.20.32.166	TCP	66	80 → 52705 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
146	144.206542	10.20.32.166	203.0.113.142	TCP	60	52705 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
147	144.207105	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
148	144.252256	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
149	144.252526	10.20.32.166	203.0.113.142	TCP	60	52705 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
150	144.272562	10.20.32.166	203.0.113.142	TCP	60	52705 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
151	144.308940	203.0.113.142	10.20.32.166	TCP	60	80 → 52705 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
152	144.309080	10.20.32.166	203.0.113.142	TCP	60	52705 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
153	159.878883	10.20.37.189	203.0.113.108	TCP	66	55476 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
154	159.924222	203.0.113.108	10.20.37.189	TCP	66	443 → 55476 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
155	159.924339	10.20.37.189	203.0.113.108	TCP	60	55476 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
156	159.926058	10.20.37.189	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
157	159.987695	203.0.113.108	10.20.37.189	TLS	1514	Server Hello, Change Cipher Spec, Application Data
158	159.987891	203.0.113.108	10.20.37.189	TCP	1514	443 → 55476 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]
159	159.988065	203.0.113.108	10.20.37.189	TLS	481	Application Data
160	159.989700	10.20.37.189	203.0.113.108	TLS	921	Application Data
161	160.128309	203.0.113.108	10.20.37.189	TLS	894	Application Data
162	160.128550	10.20.37.189	203.0.113.108	TCP	60	55476 → 443 [ACK] Seq=1128 Ack=4188 Win=1026 Len=0
163	160.158334	10.20.37.189	203.0.113.108	TCP	60	55476 → 443 [ACK, FIN] Seq=1128 Ack=4188 Win=1026 Len=0
164	160.203673	203.0.113.108	10.20.37.189	TCP	60	443 → 55476 [ACK, FIN] Seq=4188 Ack=1129 Win=501 Len=0
165	160.204024	10.20.37.189	203.0.113.108	TCP	60	55476 → 443 [ACK] Seq=1129 Ack=4189 Win=1026 Len=0
166	175.960711	10.20.28.71	10.20.1.10	DNS	90	Standard query 0xc998 A portal.carepointlinens.example
167	175.963856	10.20.1.10	10.20.28.71	DNS	106	Standard query response 0xc998 A portal.carepointlinens.example A 203.0.113.108
168	175.964361	10.20.28.71	203.0.113.108	TCP	66	51840 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
169	176.014168	203.0.113.108	10.20.28.71	TCP	66	443 → 51840 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
170	176.014296	10.20.28.71	203.0.113.108	TCP	60	51840 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
171	176.015368	10.20.28.71	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
172	176.082823	203.0.113.108	10.20.28.71	TLS	1514	Server Hello, Change Cipher Spec, Application Data
173	176.082983	203.0.113.108	10.20.28.71	TLS	1514	Application Data
174	176.083090	203.0.113.108	10.20.28.71	TCP	127	443 → 51840 [ACK, PSH] Seq=2921 Ack=261 Win=501 Len=73 [part of a TLS record]
175	176.086832	10.20.28.71	203.0.113.108	TLS	781	Application Data
176	176.259234	203.0.113.108	10.20.28.71	TLS	1514	Application Data
177	176.259427	203.0.113.108	10.20.28.71	TCP	624	443 → 51840 [ACK, PSH] Seq=4454 Ack=988 Win=501 Len=570 [part of a TLS record]
178	176.259954	10.20.28.71	203.0.113.108	TCP	60	51840 → 443 [ACK] Seq=988 Ack=5024 Win=1026 Len=0
179	176.276827	10.20.28.71	203.0.113.108	TCP	60	51840 → 443 [ACK, FIN] Seq=988 Ack=5024 Win=1026 Len=0
180	176.326634	203.0.113.108	10.20.28.71	TCP	60	443 → 51840 [ACK, FIN] Seq=5024 Ack=989 Win=501 Len=0
181	176.326776	10.20.28.71	203.0.113.108	TCP	60	51840 → 443 [ACK] Seq=989 Ack=5025 Win=1026 Len=0
182	186.628564	10.20.32.166	203.0.113.142	TCP	66	52706 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
183	186.707625	203.0.113.142	10.20.32.166	TCP	66	80 → 52706 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
184	186.707806	10.20.32.166	203.0.113.142	TCP	60	52706 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
185	186.708358	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
186	186.801119	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
187	186.801309	10.20.32.166	203.0.113.142	TCP	60	52706 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
188	186.816206	10.20.32.166	203.0.113.142	TCP	60	52706 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
189	186.895267	203.0.113.142	10.20.32.166	TCP	60	80 → 52706 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
190	186.895536	10.20.32.166	203.0.113.142	TCP	60	52706 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
191	201.762934	10.20.37.135	203.0.113.249	TCP	66	58678 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
192	201.817476	203.0.113.249	10.20.37.135	TCP	66	443 → 58678 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
193	201.817803	10.20.37.135	203.0.113.249	TCP	60	58678 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
194	201.818317	10.20.37.135	203.0.113.249	TLS	310	Client Hello (SNI=login.meridian-sso.example)
195	201.877828	203.0.113.249	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
196	201.878009	203.0.113.249	10.20.37.135	TCP	1514	443 → 58678 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]
197	201.878246	203.0.113.249	10.20.37.135	TLS	695	Application Data
198	201.882600	10.20.37.135	203.0.113.249	TLS	510	Application Data
199	202.003375	203.0.113.249	10.20.37.135	TLS	1514	Application Data
200	202.003533	203.0.113.249	10.20.37.135	TCP	1266	443 → 58678 [ACK, PSH] Seq=5022 Ack=713 Win=501 Len=1212 [part of a TLS record]
201	202.004084	10.20.37.135	203.0.113.249	TCP	60	58678 → 443 [ACK] Seq=713 Ack=6234 Win=1026 Len=0
202	202.033191	10.20.37.135	203.0.113.249	TCP	60	58678 → 443 [ACK, FIN] Seq=713 Ack=6234 Win=1026 Len=0
203	202.087733	203.0.113.249	10.20.37.135	TCP	60	443 → 58678 [ACK, FIN] Seq=6234 Ack=714 Win=501 Len=0
204	202.087876	10.20.37.135	203.0.113.249	TCP	60	58678 → 443 [ACK] Seq=714 Ack=6235 Win=1026 Len=0
205	213.895168	10.20.37.189	10.20.1.10	DNS	86	Standard query 0xe6f6 A login.meridian-sso.example
206	213.900350	10.20.1.10	10.20.37.189	DNS	102	Standard query response 0xe6f6 A login.meridian-sso.example A 203.0.113.249
207	213.902064	10.20.37.189	203.0.113.249	TCP	66	55478 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
208	213.979106	203.0.113.249	10.20.37.189	TCP	66	443 → 55478 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
209	213.979419	10.20.37.189	203.0.113.249	TCP	60	55478 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
210	213.980192	10.20.37.189	203.0.113.249	TLS	310	Client Hello (SNI=login.meridian-sso.example)
211	214.074875	203.0.113.249	10.20.37.189	TLS	1514	Server Hello, Change Cipher Spec, Application Data
212	214.075046	203.0.113.249	10.20.37.189	TCP	1514	443 → 55478 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]
213	214.075296	203.0.113.249	10.20.37.189	TLS	1026	Application Data
214	214.077881	10.20.37.189	203.0.113.249	TLS	558	Application Data
215	214.222829	203.0.113.249	10.20.37.189	TLS	1514	Application Data
216	214.222889	203.0.113.249	10.20.37.189	TCP	428	443 → 55478 [ACK, PSH] Seq=5353 Ack=761 Win=501 Len=374 [part of a TLS record]
217	214.223569	10.20.37.189	203.0.113.249	TCP	60	55478 → 443 [ACK] Seq=761 Ack=5727 Win=1026 Len=0
218	214.247710	10.20.37.189	203.0.113.249	TCP	60	55478 → 443 [ACK, FIN] Seq=761 Ack=5727 Win=1026 Len=0
219	214.324752	203.0.113.249	10.20.37.189	TCP	60	443 → 55478 [ACK, FIN] Seq=5727 Ack=762 Win=501 Len=0
220	214.324932	10.20.37.189	203.0.113.249	TCP	60	55478 → 443 [ACK] Seq=762 Ack=5728 Win=1026 Len=0
221	219.150606	10.20.37.135	10.20.1.10	DNS	86	Standard query 0x9ebb A login.meridian-sso.example
222	219.154650	10.20.1.10	10.20.37.135	DNS	102	Standard query response 0x9ebb A login.meridian-sso.example A 203.0.113.249
223	219.156558	10.20.37.135	203.0.113.249	TCP	66	58674 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
224	219.235377	203.0.113.249	10.20.37.135	TCP	66	443 → 58674 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
225	219.235589	10.20.37.135	203.0.113.249	TCP	60	58674 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
226	219.237133	10.20.37.135	203.0.113.249	TLS	310	Client Hello (SNI=login.meridian-sso.example)
227	219.326274	203.0.113.249	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
228	219.326486	203.0.113.249	10.20.37.135	TCP	1514	443 → 58674 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]
229	219.326561	203.0.113.249	10.20.37.135	TLS	1192	Application Data
230	219.329021	10.20.37.135	203.0.113.249	TLS	574	Application Data
231	219.437116	203.0.113.249	10.20.37.135	TLS	1514	Application Data
232	219.437222	203.0.113.249	10.20.37.135	TLS	1514	Application Data
233	219.437289	203.0.113.249	10.20.37.135	TCP	1514	443 → 58674 [ACK] Seq=6979 Ack=777 Win=501 Len=1460 [part of a TLS record]
234	219.437534	203.0.113.249	10.20.37.135	TCP	191	443 → 58674 [ACK, PSH] Seq=8439 Ack=777 Win=501 Len=137 [part of a TLS record]
235	219.438101	10.20.37.135	203.0.113.249	TCP	60	58674 → 443 [ACK] Seq=777 Ack=8576 Win=1026 Len=0
236	219.473990	10.20.37.135	203.0.113.249	TCP	60	58674 → 443 [ACK, FIN] Seq=777 Ack=8576 Win=1026 Len=0
237	219.552809	203.0.113.249	10.20.37.135	TCP	60	443 → 58674 [ACK, FIN] Seq=8576 Ack=778 Win=501 Len=0
238	219.552998	10.20.37.135	203.0.113.249	TCP	60	58674 → 443 [ACK] Seq=778 Ack=8577 Win=1026 Len=0
239	230.418536	10.20.32.166	203.0.113.142	TCP	66	52707 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
240	230.501678	203.0.113.142	10.20.32.166	TCP	66	80 → 52707 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
241	230.501896	10.20.32.166	203.0.113.142	TCP	60	52707 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
242	230.502258	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
243	230.601250	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
244	230.601375	10.20.32.166	203.0.113.142	TCP	60	52707 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
245	230.618637	10.20.32.166	203.0.113.142	TCP	60	52707 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
246	230.701779	203.0.113.142	10.20.32.166	TCP	60	80 → 52707 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
247	230.701869	10.20.32.166	203.0.113.142	TCP	60	52707 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
248	240.177908	10.20.30.75	10.20.1.10	DNS	93	Standard query 0x426c A www.lakeshorefamilyhealth.example
249	240.201890	10.20.1.10	10.20.30.75	DNS	165	Standard query response 0x426c A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183
250	240.203251	10.20.30.75	192.0.2.183	TCP	66	57433 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
251	240.235574	192.0.2.183	10.20.30.75	TCP	66	443 → 57433 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
252	240.235864	10.20.30.75	192.0.2.183	TCP	60	57433 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
253	240.237704	10.20.30.75	192.0.2.183	TLS	317	Client Hello (SNI=www.lakeshorefamilyhealth.example)
254	240.280350	192.0.2.183	10.20.30.75	TLS	1514	Server Hello, Change Cipher Spec, Application Data
255	240.280589	192.0.2.183	10.20.30.75	TCP	1514	443 → 57433 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]
256	240.280661	192.0.2.183	10.20.30.75	TLS	395	Application Data
257	240.283040	10.20.30.75	192.0.2.183	TLS	559	Application Data
258	240.429344	192.0.2.183	10.20.30.75	TLS	1514	Application Data
259	240.429401	192.0.2.183	10.20.30.75	TLS	1514	Application Data
260	240.429486	192.0.2.183	10.20.30.75	TCP	408	443 → 57433 [ACK, PSH] Seq=6182 Ack=769 Win=501 Len=354 [part of a TLS record]
261	240.430127	10.20.30.75	192.0.2.183	TCP	60	57433 → 443 [ACK] Seq=769 Ack=6536 Win=1026 Len=0
262	240.452615	10.20.30.75	192.0.2.183	TCP	60	57433 → 443 [ACK, FIN] Seq=769 Ack=6536 Win=1026 Len=0
263	240.484938	192.0.2.183	10.20.30.75	TCP	60	443 → 57433 [ACK, FIN] Seq=6536 Ack=770 Win=501 Len=0
264	240.485059	10.20.30.75	192.0.2.183	TCP	60	57433 → 443 [ACK] Seq=770 Ack=6537 Win=1026 Len=0
265	243.418156	10.20.37.189	10.20.1.10	DNS	90	Standard query 0xe2bb A portal.carepointlinens.example
266	243.419486	10.20.1.10	10.20.37.189	DNS	106	Standard query response 0xe2bb A portal.carepointlinens.example A 203.0.113.108
267	243.420923	10.20.37.189	203.0.113.108	TCP	66	55473 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
268	243.481023	203.0.113.108	10.20.37.189	TCP	66	443 → 55473 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
269	243.481129	10.20.37.189	203.0.113.108	TCP	60	55473 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
270	243.482518	10.20.37.189	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
271	243.557951	203.0.113.108	10.20.37.189	TLS	1514	Server Hello, Change Cipher Spec, Application Data
272	243.558098	203.0.113.108	10.20.37.189	TCP	1514	443 → 55473 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]
273	243.558208	203.0.113.108	10.20.37.189	TLS	572	Application Data
274	243.562317	10.20.37.189	203.0.113.108	TLS	835	Application Data
275	243.769677	203.0.113.108	10.20.37.189	TLS	1514	Application Data
276	243.769713	203.0.113.108	10.20.37.189	TLS	1514	Application Data
277	243.769761	203.0.113.108	10.20.37.189	TLS	1514	Application Data
278	243.769915	203.0.113.108	10.20.37.189	TCP	1514	443 → 55473 [ACK] Seq=7819 Ack=1042 Win=501 Len=1460 [part of a TLS record]
279	243.770127	203.0.113.108	10.20.37.189	TCP	205	443 → 55473 [ACK, PSH] Seq=9279 Ack=1042 Win=501 Len=151 [part of a TLS record]
280	243.770479	10.20.37.189	203.0.113.108	TCP	60	55473 → 443 [ACK] Seq=1042 Ack=9430 Win=1026 Len=0
281	243.799273	10.20.37.189	203.0.113.108	TCP	60	55473 → 443 [ACK, FIN] Seq=1042 Ack=9430 Win=1026 Len=0
282	243.859373	203.0.113.108	10.20.37.189	TCP	60	443 → 55473 [ACK, FIN] Seq=9430 Ack=1043 Win=501 Len=0
283	243.859487	10.20.37.189	203.0.113.108	TCP	60	55473 → 443 [ACK] Seq=1043 Ack=9431 Win=1026 Len=0
284	250.920257	10.20.32.166	10.20.1.10	DNS	90	Standard query 0x38ef A portal.carepointlinens.example
285	250.931107	10.20.1.10	10.20.32.166	DNS	106	Standard query response 0x38ef A portal.carepointlinens.example A 203.0.113.108
286	250.931751	10.20.32.166	203.0.113.108	TCP	66	52693 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
287	250.968989	203.0.113.108	10.20.32.166	TCP	66	443 → 52693 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
288	250.969324	10.20.32.166	203.0.113.108	TCP	60	52693 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
289	250.970151	10.20.32.166	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
290	251.008977	203.0.113.108	10.20.32.166	TLS	1514	Server Hello, Change Cipher Spec, Application Data
291	251.009098	203.0.113.108	10.20.32.166	TCP	1514	443 → 52693 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]
292	251.009273	203.0.113.108	10.20.32.166	TLS	838	Application Data
293	251.010699	10.20.32.166	203.0.113.108	TLS	709	Application Data
294	251.085625	203.0.113.108	10.20.32.166	TLS	1514	Application Data
295	251.085743	203.0.113.108	10.20.32.166	TLS	1514	Application Data
296	251.085840	203.0.113.108	10.20.32.166	TCP	1514	443 → 52693 [ACK] Seq=6625 Ack=916 Win=501 Len=1460 [part of a TLS record]
297	251.086041	203.0.113.108	10.20.32.166	TLS	1514	Application Data
298	251.086204	203.0.113.108	10.20.32.166	TCP	1053	443 → 52693 [ACK, PSH] Seq=9545 Ack=916 Win=501 Len=999 [part of a TLS record]
299	251.086955	10.20.32.166	203.0.113.108	TCP	60	52693 → 443 [ACK] Seq=916 Ack=10544 Win=1026 Len=0
300	251.099838	10.20.32.166	203.0.113.108	TCP	60	52693 → 443 [ACK, FIN] Seq=916 Ack=10544 Win=1026 Len=0
301	251.137076	203.0.113.108	10.20.32.166	TCP	60	443 → 52693 [ACK, FIN] Seq=10544 Ack=917 Win=501 Len=0
302	251.137232	10.20.32.166	203.0.113.108	TCP	60	52693 → 443 [ACK] Seq=917 Ack=10545 Win=1026 Len=0
303	253.419667	10.20.32.166	10.20.1.10	DNS	94	Standard query 0xe5c0 A mail.lakeshorefamilyhealth.example
304	253.439033	10.20.1.10	10.20.32.166	DNS	110	Standard query response 0xe5c0 A mail.lakeshorefamilyhealth.example A 203.0.113.75
305	253.439234	10.20.32.166	203.0.113.75	TCP	66	52699 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
306	253.491193	203.0.113.75	10.20.32.166	TCP	66	443 → 52699 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
307	253.491289	10.20.32.166	203.0.113.75	TCP	60	52699 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
308	253.492027	10.20.32.166	203.0.113.75	TLS	318	Client Hello (SNI=mail.lakeshorefamilyhealth.example)
309	253.559418	203.0.113.75	10.20.32.166	TLS	1514	Server Hello, Change Cipher Spec, Application Data
310	253.559582	203.0.113.75	10.20.32.166	TCP	1514	443 → 52699 [ACK] Seq=1461 Ack=265 Win=501 Len=1460 [part of a TLS record]
311	253.559633	203.0.113.75	10.20.32.166	TLS	1234	Application Data
312	253.562848	10.20.32.166	203.0.113.75	TLS	594	Application Data
313	253.749888	203.0.113.75	10.20.32.166	TLS	845	Application Data
314	253.750648	10.20.32.166	203.0.113.75	TCP	60	52699 → 443 [ACK] Seq=805 Ack=4892 Win=1026 Len=0
315	253.789214	10.20.32.166	203.0.113.75	TCP	60	52699 → 443 [ACK, FIN] Seq=805 Ack=4892 Win=1026 Len=0
316	253.841173	203.0.113.75	10.20.32.166	TCP	60	443 → 52699 [ACK, FIN] Seq=4892 Ack=806 Win=501 Len=0
317	253.841466	10.20.32.166	203.0.113.75	TCP	60	52699 → 443 [ACK] Seq=806 Ack=4893 Win=1026 Len=0
318	265.196074	10.20.37.189	10.20.1.10	DNS	89	Standard query 0x8e5b A api.skyledger-weather.example
319	265.203285	10.20.1.10	10.20.37.189	DNS	105	Standard query response 0x8e5b A api.skyledger-weather.example A 192.0.2.182
320	265.205226	10.20.37.189	192.0.2.182	TCP	66	55475 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
321	265.241881	192.0.2.182	10.20.37.189	TCP	66	443 → 55475 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
322	265.242063	10.20.37.189	192.0.2.182	TCP	60	55475 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
323	265.242516	10.20.37.189	192.0.2.182	TLS	313	Client Hello (SNI=api.skyledger-weather.example)
324	265.293370	192.0.2.182	10.20.37.189	TLS	1514	Server Hello, Change Cipher Spec, Application Data
325	265.293478	192.0.2.182	10.20.37.189	TCP	1514	443 → 55475 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
326	265.293711	192.0.2.182	10.20.37.189	TCP	1514	443 → 55475 [ACK] Seq=2921 Ack=260 Win=501 Len=1460 [part of a TLS record]
327	265.293831	192.0.2.182	10.20.37.189	TLS	419	Application Data
328	265.298251	10.20.37.189	192.0.2.182	TLS	648	Application Data
329	265.455585	192.0.2.182	10.20.37.189	TLS	1514	Application Data
330	265.455678	192.0.2.182	10.20.37.189	TCP	491	443 → 55475 [ACK, PSH] Seq=6206 Ack=854 Win=501 Len=437 [part of a TLS record]
331	265.456195	10.20.37.189	192.0.2.182	TCP	60	55475 → 443 [ACK] Seq=854 Ack=6643 Win=1026 Len=0
332	265.478667	10.20.37.189	192.0.2.182	TCP	60	55475 → 443 [ACK, FIN] Seq=854 Ack=6643 Win=1026 Len=0
333	265.515322	192.0.2.182	10.20.37.189	TCP	60	443 → 55475 [ACK, FIN] Seq=6643 Ack=855 Win=501 Len=0
334	265.515693	10.20.37.189	192.0.2.182	TCP	60	55475 → 443 [ACK] Seq=855 Ack=6644 Win=1026 Len=0
335	276.339406	10.20.32.166	203.0.113.142	TCP	66	52708 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
336	276.422949	203.0.113.142	10.20.32.166	TCP	66	80 → 52708 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
337	276.423225	10.20.32.166	203.0.113.142	TCP	60	52708 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
338	276.423816	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
339	276.530921	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
340	276.531571	10.20.32.166	203.0.113.142	TCP	60	52708 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
341	276.539546	10.20.32.166	203.0.113.142	TCP	60	52708 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
342	276.623089	203.0.113.142	10.20.32.166	TCP	60	80 → 52708 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
343	276.623224	10.20.32.166	203.0.113.142	TCP	60	52708 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
344	276.725724	10.20.28.71	192.0.2.183	TCP	66	51838 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
345	276.775821	192.0.2.183	10.20.28.71	TCP	66	443 → 51838 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
346	276.776018	10.20.28.71	192.0.2.183	TCP	60	51838 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
347	276.777490	10.20.28.71	192.0.2.183	TLS	317	Client Hello (SNI=www.lakeshorefamilyhealth.example)
348	276.843236	192.0.2.183	10.20.28.71	TLS	1514	Server Hello, Change Cipher Spec, Application Data
349	276.843384	192.0.2.183	10.20.28.71	TLS	1514	Application Data
350	276.843630	192.0.2.183	10.20.28.71	TCP	123	443 → 51838 [ACK, PSH] Seq=2921 Ack=264 Win=501 Len=69 [part of a TLS record]
351	276.847647	10.20.28.71	192.0.2.183	TLS	546	Application Data
352	276.948941	192.0.2.183	10.20.28.71	TLS	1165	Application Data
353	276.949785	10.20.28.71	192.0.2.183	TCP	60	51838 → 443 [ACK] Seq=756 Ack=4101 Win=1026 Len=0
354	276.962262	10.20.28.71	192.0.2.183	TCP	60	51838 → 443 [ACK, FIN] Seq=756 Ack=4101 Win=1026 Len=0
355	277.012359	192.0.2.183	10.20.28.71	TCP	60	443 → 51838 [ACK, FIN] Seq=4101 Ack=757 Win=501 Len=0
356	277.012696	10.20.28.71	192.0.2.183	TCP	60	51838 → 443 [ACK] Seq=757 Ack=4102 Win=1026 Len=0
357	319.887118	10.20.32.166	203.0.113.142	TCP	66	52709 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
358	319.951451	203.0.113.142	10.20.32.166	TCP	66	80 → 52709 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
359	319.951639	10.20.32.166	203.0.113.142	TCP	60	52709 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
360	319.952100	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
361	320.042647	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
362	320.042987	10.20.32.166	203.0.113.142	TCP	60	52709 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
363	320.078381	10.20.32.166	203.0.113.142	TCP	60	52709 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
364	320.142714	203.0.113.142	10.20.32.166	TCP	60	80 → 52709 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
365	320.142861	10.20.32.166	203.0.113.142	TCP	60	52709 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
366	363.334847	10.20.32.166	203.0.113.142	TCP	66	52710 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
367	363.354418	203.0.113.142	10.20.32.166	TCP	66	80 → 52710 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
368	363.354669	10.20.32.166	203.0.113.142	TCP	60	52710 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
369	363.355205	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
370	363.395028	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
371	363.395309	10.20.32.166	203.0.113.142	TCP	60	52710 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
372	363.411580	10.20.32.166	203.0.113.142	TCP	60	52710 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
373	363.431151	203.0.113.142	10.20.32.166	TCP	60	80 → 52710 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
374	363.431244	10.20.32.166	203.0.113.142	TCP	60	52710 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
375	405.701101	10.20.32.166	203.0.113.108	TCP	66	52700 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
376	405.729775	203.0.113.108	10.20.32.166	TCP	66	443 → 52700 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
377	405.730142	10.20.32.166	203.0.113.108	TCP	60	52700 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
378	405.730450	10.20.32.166	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
379	405.779017	203.0.113.108	10.20.32.166	TLS	1514	Server Hello, Change Cipher Spec, Application Data
380	405.779136	203.0.113.108	10.20.32.166	TCP	1514	443 → 52700 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]
381	405.779231	203.0.113.108	10.20.32.166	TLS	1268	Application Data
382	405.782705	10.20.32.166	203.0.113.108	TLS	925	Application Data
383	405.878235	203.0.113.108	10.20.32.166	TLS	1514	Application Data
384	405.878295	203.0.113.108	10.20.32.166	TLS	1514	Application Data
385	405.878469	203.0.113.108	10.20.32.166	TLS	1514	Application Data
386	405.878594	203.0.113.108	10.20.32.166	TCP	715	443 → 52700 [ACK, PSH] Seq=8515 Ack=1132 Win=501 Len=661 [part of a TLS record]
387	405.879213	10.20.32.166	203.0.113.108	TCP	60	52700 → 443 [ACK] Seq=1132 Ack=9176 Win=1026 Len=0
388	405.909033	10.20.32.166	203.0.113.108	TCP	60	52700 → 443 [ACK, FIN] Seq=1132 Ack=9176 Win=1026 Len=0
389	405.937707	203.0.113.108	10.20.32.166	TCP	60	443 → 52700 [ACK, FIN] Seq=9176 Ack=1133 Win=501 Len=0
390	405.938007	10.20.32.166	203.0.113.108	TCP	60	52700 → 443 [ACK] Seq=1133 Ack=9177 Win=1026 Len=0
391	406.832355	10.20.32.166	10.20.1.10	DNS	84	Standard query 0x2599 A car-epointlinens.example
392	406.848726	10.20.1.10	10.20.32.166	DNS	100	Standard query response 0x2599 A car-epointlinens.example A 203.0.113.142
393	406.850308	10.20.32.166	203.0.113.142	TCP	66	52712 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
394	406.918332	203.0.113.142	10.20.32.166	TCP	66	80 → 52712 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
395	406.918453	10.20.32.166	203.0.113.142	TCP	60	52712 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
396	406.918994	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
397	406.996878	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
398	406.997718	10.20.32.166	203.0.113.142	TCP	60	52712 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0
399	407.031427	10.20.32.166	203.0.113.142	TCP	60	52712 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0
400	407.099451	203.0.113.142	10.20.32.166	TCP	60	80 → 52712 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0
401	407.099751	10.20.32.166	203.0.113.142	TCP	60	52712 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0
402	450.241728	10.20.30.75	10.20.1.10	DNS	94	Standard query 0xe57c A mail.lakeshorefamilyhealth.example
403	450.244533	10.20.1.10	10.20.30.75	DNS	110	Standard query response 0xe57c A mail.lakeshorefamilyhealth.example A 203.0.113.75
404	450.244793	10.20.30.75	203.0.113.75	TCP	66	57437 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
405	450.319265	203.0.113.75	10.20.30.75	TCP	66	443 → 57437 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
406	450.319562	10.20.30.75	203.0.113.75	TCP	60	57437 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
407	450.320193	10.20.30.75	203.0.113.75	TLS	318	Client Hello (SNI=mail.lakeshorefamilyhealth.example)
408	450.397310	203.0.113.75	10.20.30.75	TLS	1514	Server Hello, Change Cipher Spec, Application Data
409	450.397446	203.0.113.75	10.20.30.75	TCP	1514	443 → 57437 [ACK] Seq=1461 Ack=265 Win=501 Len=1460 [part of a TLS record]
410	450.397536	203.0.113.75	10.20.30.75	TLS	847	Application Data
411	450.400779	10.20.30.75	203.0.113.75	TLS	500	Application Data
412	450.516664	203.0.113.75	10.20.30.75	TLS	1514	Application Data
413	450.516822	203.0.113.75	10.20.30.75	TLS	1514	Application Data
414	450.517003	203.0.113.75	10.20.30.75	TCP	1514	443 → 57437 [ACK] Seq=6634 Ack=711 Win=501 Len=1460 [part of a TLS record]
415	450.517243	203.0.113.75	10.20.30.75	TLS	1514	Application Data
416	450.517331	203.0.113.75	10.20.30.75	TCP	1007	443 → 57437 [ACK, PSH] Seq=9554 Ack=711 Win=501 Len=953 [part of a TLS record]
417	450.518007	10.20.30.75	203.0.113.75	TCP	60	57437 → 443 [ACK] Seq=711 Ack=10507 Win=1026 Len=0
418	450.528175	10.20.30.75	203.0.113.75	TCP	60	57437 → 443 [ACK, FIN] Seq=711 Ack=10507 Win=1026 Len=0
419	450.602647	203.0.113.75	10.20.30.75	TCP	60	443 → 57437 [ACK, FIN] Seq=10507 Ack=712 Win=501 Len=0
420	450.602976	10.20.30.75	203.0.113.75	TCP	60	57437 → 443 [ACK] Seq=712 Ack=10508 Win=1026 Len=0
421	450.960622	10.20.32.166	203.0.113.142	TCP	66	52713 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
422	451.010072	203.0.113.142	10.20.32.166	TCP	66	80 → 52713 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
423	451.010390	10.20.32.166	203.0.113.142	TCP	60	52713 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
424	451.010890	10.20.32.166	203.0.113.142	HTTP	305	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
425	451.064378	203.0.113.142	10.20.32.166	HTTP	193	HTTP/1.1 200 OK (text/plain)
426	451.064481	10.20.32.166	203.0.113.142	TCP	60	52713 → 80 [ACK] Seq=252 Ack=140 Win=1026 Len=0
427	451.081552	10.20.32.166	203.0.113.142	TCP	60	52713 → 80 [ACK, FIN] Seq=252 Ack=140 Win=1026 Len=0
428	451.131002	203.0.113.142	10.20.32.166	TCP	60	80 → 52713 [ACK, FIN] Seq=140 Ack=253 Win=501 Len=0
429	451.131357	10.20.32.166	203.0.113.142	TCP	60	52713 → 80 [ACK] Seq=253 Ack=141 Win=1026 Len=0
430	454.699966	10.20.30.75	10.20.1.10	DNS	86	Standard query 0x932f A update.formwiseapp.example
431	454.705645	10.20.1.10	10.20.30.75	DNS	102	Standard query response 0x932f A update.formwiseapp.example A 203.0.113.132
432	454.706955	10.20.30.75	203.0.113.132	TCP	66	57441 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
433	454.735887	203.0.113.132	10.20.30.75	TCP	66	80 → 57441 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
434	454.736144	10.20.30.75	203.0.113.132	TCP	60	57441 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
435	454.736889	10.20.30.75	203.0.113.132	HTTP	256	GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1
436	454.802582	203.0.113.132	10.20.30.75	HTTP	254	HTTP/1.1 200 OK (application/json)
437	454.803141	10.20.30.75	203.0.113.132	TCP	60	57441 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0
438	454.832517	10.20.30.75	203.0.113.132	TCP	60	57441 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0
439	454.861449	203.0.113.132	10.20.30.75	TCP	60	80 → 57441 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0
440	454.861828	10.20.30.75	203.0.113.132	TCP	60	57441 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0
441	462.541737	10.20.30.75	10.20.1.10	DNS	98	Standard query 0x25ff A intranet.lakeshorefamilyhealth.example
442	462.547712	10.20.1.10	10.20.30.75	DNS	114	Standard query response 0x25ff A intranet.lakeshorefamilyhealth.example A 10.20.1.20
443	462.549703	10.20.30.75	10.20.1.20	TCP	66	57439 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
444	462.550808	10.20.1.20	10.20.30.75	TCP	66	80 → 57439 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
445	462.551061	10.20.30.75	10.20.1.20	TCP	60	57439 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
446	462.551693	10.20.30.75	10.20.1.20	HTTP	364	GET /forms/pto HTTP/1.1
447	462.565621	10.20.1.20	10.20.30.75	HTTP	399	HTTP/1.1 200 OK (text/html)
448	462.566387	10.20.30.75	10.20.1.20	TCP	60	57439 → 80 [ACK] Seq=311 Ack=346 Win=1026 Len=0
449	462.593404	10.20.30.75	10.20.1.20	TCP	60	57439 → 80 [ACK, FIN] Seq=311 Ack=346 Win=1026 Len=0
450	462.594509	10.20.1.20	10.20.30.75	TCP	60	80 → 57439 [ACK, FIN] Seq=346 Ack=312 Win=501 Len=0
451	462.594638	10.20.30.75	10.20.1.20	TCP	60	57439 → 80 [ACK] Seq=312 Ack=347 Win=1026 Len=0
452	483.960210	10.20.37.189	10.20.1.10	DNS	89	Standard query 0x1c4f A files.harborbox-share.example
453	483.973758	10.20.1.10	10.20.37.189	DNS	105	Standard query response 0x1c4f A files.harborbox-share.example A 198.51.100.107
454	483.975716	10.20.37.189	198.51.100.107	TCP	66	55480 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
455	483.998131	198.51.100.107	10.20.37.189	TCP	66	443 → 55480 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
456	483.998297	10.20.37.189	198.51.100.107	TCP	60	55480 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
457	483.998655	10.20.37.189	198.51.100.107	TLS	313	Client Hello (SNI=files.harborbox-share.example)
458	484.026578	198.51.100.107	10.20.37.189	TLS	1514	Server Hello, Change Cipher Spec, Application Data
459	484.026616	198.51.100.107	10.20.37.189	TCP	1514	443 → 55480 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
460	484.026724	198.51.100.107	10.20.37.189	TLS	969	Application Data
461	484.028194	10.20.37.189	198.51.100.107	TLS	510	Application Data
462	484.181639	198.51.100.107	10.20.37.189	TLS	1514	Application Data
463	484.181694	198.51.100.107	10.20.37.189	TCP	1514	443 → 55480 [ACK] Seq=5296 Ack=716 Win=501 Len=1460 [part of a TLS record]
464	484.181879	198.51.100.107	10.20.37.189	TLS	1514	Application Data
465	484.182076	198.51.100.107	10.20.37.189	TLS	932	Application Data
466	484.182328	10.20.37.189	198.51.100.107	TCP	60	55480 → 443 [ACK] Seq=716 Ack=9094 Win=1026 Len=0
467	484.206160	10.20.37.189	198.51.100.107	TCP	60	55480 → 443 [ACK, FIN] Seq=716 Ack=9094 Win=1026 Len=0
468	484.228575	198.51.100.107	10.20.37.189	TCP	60	443 → 55480 [ACK, FIN] Seq=9094 Ack=717 Win=501 Len=0
469	484.228850	10.20.37.189	198.51.100.107	TCP	60	55480 → 443 [ACK] Seq=717 Ack=9095 Win=1026 Len=0
470	492.928707	10.20.37.135	10.20.1.10	DNS	89	Standard query 0x66db A cdn.brightlane-static.example
471	492.930213	10.20.1.10	10.20.37.135	DNS	105	Standard query response 0x66db A cdn.brightlane-static.example A 203.0.113.82
472	492.932192	10.20.37.135	203.0.113.82	TCP	66	58670 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
473	492.990875	203.0.113.82	10.20.37.135	TCP	66	443 → 58670 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
474	492.991113	10.20.37.135	203.0.113.82	TCP	60	58670 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
475	492.992767	10.20.37.135	203.0.113.82	TLS	313	Client Hello (SNI=cdn.brightlane-static.example)
476	493.055254	203.0.113.82	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
477	493.055380	203.0.113.82	10.20.37.135	TCP	1514	443 → 58670 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]
478	493.055442	203.0.113.82	10.20.37.135	TCP	1514	443 → 58670 [ACK] Seq=2921 Ack=260 Win=501 Len=1460 [part of a TLS record]
479	493.055632	203.0.113.82	10.20.37.135	TLS	276	Application Data
480	493.057192	10.20.37.135	203.0.113.82	TLS	888	Application Data
481	493.195056	203.0.113.82	10.20.37.135	TLS	1272	Application Data
482	493.195656	10.20.37.135	203.0.113.82	TCP	60	58670 → 443 [ACK] Seq=1094 Ack=5821 Win=1026 Len=0
483	493.203496	10.20.37.135	203.0.113.82	TCP	60	58670 → 443 [ACK, FIN] Seq=1094 Ack=5821 Win=1026 Len=0
484	493.262179	203.0.113.82	10.20.37.135	TCP	60	443 → 58670 [ACK, FIN] Seq=5821 Ack=1095 Win=501 Len=0
485	493.262304	10.20.37.135	203.0.113.82	TCP	60	58670 → 443 [ACK] Seq=1095 Ack=5822 Win=1026 Len=0
486	496.102914	10.20.32.166	203.0.113.142	TCP	66	52714 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
487	496.185253	203.0.113.142	10.20.32.166	TCP	66	80 → 52714 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
488	496.185382	10.20.32.166	203.0.113.142	TCP	60	52714 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
489	496.185752	10.20.32.166	203.0.113.142	HTTP	306	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
490	496.294272	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
491	496.294678	10.20.32.166	203.0.113.142	TCP	60	52714 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0
492	496.306136	10.20.32.166	203.0.113.142	TCP	60	52714 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0
493	496.388475	203.0.113.142	10.20.32.166	TCP	60	80 → 52714 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0
494	496.388774	10.20.32.166	203.0.113.142	TCP	60	52714 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0
495	500.747541	10.20.28.71	10.20.1.10	NTP	90	NTP Version 4, client
496	500.748292	10.20.1.10	10.20.28.71	NTP	90	NTP Version 4, server
497	539.111846	10.20.32.166	203.0.113.142	TCP	66	52715 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
498	539.188846	203.0.113.142	10.20.32.166	TCP	66	80 → 52715 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
499	539.189062	10.20.32.166	203.0.113.142	TCP	60	52715 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
500	539.189598	10.20.32.166	203.0.113.142	HTTP	306	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
501	539.291644	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
502	539.291942	10.20.32.166	203.0.113.142	TCP	60	52715 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0
503	539.313002	10.20.32.166	203.0.113.142	TCP	60	52715 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0
504	539.390002	203.0.113.142	10.20.32.166	TCP	60	80 → 52715 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0
505	539.390291	10.20.32.166	203.0.113.142	TCP	60	52715 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0
506	560.159658	10.20.37.135	10.20.1.10	DNS	90	Standard query 0x51eb A portal.carepointlinens.example
507	560.171427	10.20.1.10	10.20.37.135	DNS	106	Standard query response 0x51eb A portal.carepointlinens.example A 203.0.113.108
508	560.171924	10.20.37.135	203.0.113.108	TCP	66	58672 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
509	560.224738	203.0.113.108	10.20.37.135	TCP	66	443 → 58672 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
510	560.225021	10.20.37.135	203.0.113.108	TCP	60	58672 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
511	560.225528	10.20.37.135	203.0.113.108	TLS	314	Client Hello (SNI=portal.carepointlinens.example)
512	560.292502	203.0.113.108	10.20.37.135	TLS	1514	Server Hello, Change Cipher Spec, Application Data
513	560.292673	203.0.113.108	10.20.37.135	TCP	1514	443 → 58672 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]
514	560.292842	203.0.113.108	10.20.37.135	TLS	649	Application Data
515	560.296634	10.20.37.135	203.0.113.108	TLS	688	Application Data
516	560.419410	203.0.113.108	10.20.37.135	TLS	1514	Application Data
517	560.419631	203.0.113.108	10.20.37.135	TLS	1514	Application Data
518	560.419760	203.0.113.108	10.20.37.135	TCP	1295	443 → 58672 [ACK, PSH] Seq=6436 Ack=895 Win=501 Len=1241 [part of a TLS record]
519	560.420092	10.20.37.135	203.0.113.108	TCP	60	58672 → 443 [ACK] Seq=895 Ack=7677 Win=1026 Len=0
520	560.455746	10.20.37.135	203.0.113.108	TCP	60	58672 → 443 [ACK, FIN] Seq=895 Ack=7677 Win=1026 Len=0
521	560.508560	203.0.113.108	10.20.37.135	TCP	60	443 → 58672 [ACK, FIN] Seq=7677 Ack=896 Win=501 Len=0
522	560.508740	10.20.37.135	203.0.113.108	TCP	60	58672 → 443 [ACK] Seq=896 Ack=7678 Win=1026 Len=0
523	561.196860	10.20.28.71	10.20.1.10	DNS	93	Standard query 0x1e4b A www.lakeshorefamilyhealth.example
524	561.207221	10.20.1.10	10.20.28.71	DNS	165	Standard query response 0x1e4b A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183
525	561.207454	10.20.28.71	192.0.2.183	TCP	66	51837 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
526	561.281471	192.0.2.183	10.20.28.71	TCP	66	443 → 51837 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
527	561.281871	10.20.28.71	192.0.2.183	TCP	60	51837 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0
528	561.282793	10.20.28.71	192.0.2.183	TLS	317	Client Hello (SNI=www.lakeshorefamilyhealth.example)
529	561.373290	192.0.2.183	10.20.28.71	TLS	1514	Server Hello, Change Cipher Spec, Application Data
530	561.373395	192.0.2.183	10.20.28.71	TCP	1514	443 → 51837 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]
531	561.373430	192.0.2.183	10.20.28.71	TLS	1207	Application Data
532	561.376442	10.20.28.71	192.0.2.183	TLS	659	Application Data
533	561.543655	192.0.2.183	10.20.28.71	TLS	1514	Application Data
534	561.543706	192.0.2.183	10.20.28.71	TCP	1514	443 → 51837 [ACK] Seq=5534 Ack=869 Win=501 Len=1460 [part of a TLS record]
535	561.543839	192.0.2.183	10.20.28.71	TLS	1514	Application Data
536	561.544052	192.0.2.183	10.20.28.71	TCP	1329	443 → 51837 [ACK, PSH] Seq=8454 Ack=869 Win=501 Len=1275 [part of a TLS record]
537	561.544942	10.20.28.71	192.0.2.183	TCP	60	51837 → 443 [ACK] Seq=869 Ack=9729 Win=1026 Len=0
538	561.577288	10.20.28.71	192.0.2.183	TCP	60	51837 → 443 [ACK, FIN] Seq=869 Ack=9729 Win=1026 Len=0
539	561.651305	192.0.2.183	10.20.28.71	TCP	60	443 → 51837 [ACK, FIN] Seq=9729 Ack=870 Win=501 Len=0
540	561.651587	10.20.28.71	192.0.2.183	TCP	60	51837 → 443 [ACK] Seq=870 Ack=9730 Win=1026 Len=0
541	566.458570	10.20.28.71	10.20.1.10	DNS	98	Standard query 0xa9d3 A intranet.lakeshorefamilyhealth.example
542	566.477964	10.20.1.10	10.20.28.71	DNS	114	Standard query response 0xa9d3 A intranet.lakeshorefamilyhealth.example A 10.20.1.20
543	566.479809	10.20.28.71	10.20.1.20	TCP	66	51842 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
544	566.480914	10.20.1.20	10.20.28.71	TCP	66	80 → 51842 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
545	566.481249	10.20.28.71	10.20.1.20	TCP	60	51842 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
546	566.481671	10.20.28.71	10.20.1.20	HTTP	398	POST /timesheet/submit HTTP/1.1 (application/x-www-form-urlencoded)
547	566.505131	10.20.1.20	10.20.28.71	HTTP	186	HTTP/1.1 303 See Other
548	566.505967	10.20.28.71	10.20.1.20	TCP	60	51842 → 80 [ACK] Seq=345 Ack=133 Win=1026 Len=0
549	566.533505	10.20.28.71	10.20.1.20	TCP	60	51842 → 80 [ACK, FIN] Seq=345 Ack=133 Win=1026 Len=0
550	566.534610	10.20.1.20	10.20.28.71	TCP	60	80 → 51842 [ACK, FIN] Seq=133 Ack=346 Win=501 Len=0
551	566.534798	10.20.28.71	10.20.1.20	TCP	60	51842 → 80 [ACK] Seq=346 Ack=134 Win=1026 Len=0
552	584.991316	10.20.32.166	203.0.113.142	TCP	66	52716 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
553	585.039708	203.0.113.142	10.20.32.166	TCP	66	80 → 52716 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128
554	585.040031	10.20.32.166	203.0.113.142	TCP	60	52716 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0
555	585.040429	10.20.32.166	203.0.113.142	HTTP	306	POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)
556	585.102865	203.0.113.142	10.20.32.166	HTTP	191	HTTP/1.1 200 OK (text/plain)
557	585.103575	10.20.32.166	203.0.113.142	TCP	60	52716 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0
558	585.136141	10.20.32.166	203.0.113.142	TCP	60	52716 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0
559	585.184533	203.0.113.142	10.20.32.166	TCP	60	80 → 52716 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0
560	585.184638	10.20.32.166	203.0.113.142	TCP	60	52716 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0

Frame 1: 86 bytes on wire (688 bits), 86 bytes captured

Ethernet II, Src: 02:c3:96:3a:bc:b6, Dst: 02:a0:c2:b4:3c:ef

Internet Protocol Version 4, Src: 10.20.37.189, Dst: 10.20.1.10

User Datagram Protocol, Src Port: 55481, Dst Port: 53

Domain Name System (query)

Transaction ID: 0x197d

Flags: 0x0100 Standard query

Questions: 1

Answer RRs: 0

Authority RRs: 0

Additional RRs: 0

Queries

update.formwiseapp.example: type A, class IN

000002 a0 c2 b4 3c ef 02 c3 96 3a bc b6 08 00 45 00....<....:....E.

001000 48 97 f4 40 00 80 11 27 c2 0a 14 25 bd 0a 14.H..@...'...%...

002001 0a d8 b9 00 35 00 34 62 59 19 7d 01 00 00 01.....5.4bY.}....

003000 00 00 00 00 00 06 75 70 64 61 74 65 0b 66 6f.......update.fo

004072 6d 77 69 73 65 61 70 70 07 65 78 61 6d 70 6crmwiseapp.exampl

005065 00 00 01 00 01e.....

Frame (86 bytes)

lakeshore-family-health-week3.pcap

Packets: 560 · Displayed: 560 (100.0%) · Selected: 1

What you found

0 of 6 answered

1. Which internal IP address belongs to the infected computer?
Which internal IP address belongs to the infected computer?
2. What domain does it look up before it calls out?
What domain does it look up before it calls out?
3. What external IP address does it beacon to?
What external IP address does it beacon to?
4. Roughly how often does it check in, in seconds?
Roughly how often does it check in, in seconds?
5. Which HTTP method do the check-ins use?
Which HTTP method do the check-ins use?
6. What User-Agent does it send?
What User-Agent does it send?

No.

Time

Source

Destination

Protocol

Length

Info

0.000000

10.20.37.189

10.20.1.10

DNS

Standard query 0x197d A update.formwiseapp.example

0.017271

10.20.1.10

10.20.37.189

DNS

102

Standard query response 0x197d A update.formwiseapp.example A 203.0.113.132

0.018892

10.20.37.189

203.0.113.132

TCP

55482 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

0.101180

203.0.113.132

10.20.37.189

TCP

80 → 55482 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

0.101537

10.20.37.189

203.0.113.132

TCP

55482 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

0.101797

10.20.37.189

203.0.113.132

HTTP

256

GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1

0.242752

203.0.113.132

10.20.37.189

HTTP

254

HTTP/1.1 200 OK (application/json)

0.243467

10.20.37.189

203.0.113.132

TCP

55482 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0

0.257727

10.20.37.189

203.0.113.132

TCP

55482 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0

0.340015

203.0.113.132

10.20.37.189

TCP

80 → 55482 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0

0.340359

10.20.37.189

203.0.113.132

TCP

55482 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0

7.997061

10.20.37.135

203.0.113.82

TCP

58677 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

8.034839

203.0.113.82

10.20.37.135

TCP

443 → 58677 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

8.034945

10.20.37.135

203.0.113.82

TCP

58677 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

8.036487

10.20.37.135

203.0.113.82

TLS

313

Client Hello (SNI=cdn.brightlane-static.example)

8.086611

203.0.113.82

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

8.086844

203.0.113.82

10.20.37.135

TCP

1514

443 → 58677 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

8.087048

203.0.113.82

10.20.37.135

TLS

1414

Application Data

8.090910

10.20.37.135

203.0.113.82

TLS

850

Application Data

8.197977

203.0.113.82

10.20.37.135

TLS

1514

Application Data

8.198009

203.0.113.82

10.20.37.135

TCP

1514

443 → 58677 [ACK] Seq=5741 Ack=1056 Win=501 Len=1460 [part of a TLS record]

8.198243

203.0.113.82

10.20.37.135

TLS

1514

Application Data

8.198290

203.0.113.82

10.20.37.135

TLS

1514

Application Data

8.198509

203.0.113.82

10.20.37.135

TCP

1514

443 → 58677 [ACK] Seq=10121 Ack=1056 Win=501 Len=1460 [part of a TLS record]

8.198640

203.0.113.82

10.20.37.135

TCP

399

443 → 58677 [ACK, PSH] Seq=11581 Ack=1056 Win=501 Len=345 [part of a TLS record]

8.199196

10.20.37.135

203.0.113.82

TCP

58677 → 443 [ACK] Seq=1056 Ack=11926 Win=1026 Len=0

8.233742

10.20.37.135

203.0.113.82

TCP

58677 → 443 [ACK, FIN] Seq=1056 Ack=11926 Win=1026 Len=0

8.271520

203.0.113.82

10.20.37.135

TCP

443 → 58677 [ACK, FIN] Seq=11926 Ack=1057 Win=501 Len=0

8.271839

10.20.37.135

203.0.113.82

TCP

58677 → 443 [ACK] Seq=1057 Ack=11927 Win=1026 Len=0

8.748498

10.20.32.166

10.20.1.10

DNS

Standard query 0x36eb A intranet.lakeshorefamilyhealth.example

8.757437

10.20.1.10

10.20.32.166

DNS

114

Standard query response 0x36eb A intranet.lakeshorefamilyhealth.example A 10.20.1.20

8.757670

10.20.32.166

10.20.1.20

TCP

52702 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

8.759072

10.20.1.20

10.20.32.166

TCP

80 → 52702 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

8.759232

10.20.32.166

10.20.1.20

TCP

52702 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

8.759747

10.20.32.166

10.20.1.20

HTTP

350

GET /directory HTTP/1.1

8.763381

10.20.1.20

10.20.32.166

HTTP

397

HTTP/1.1 200 OK (text/html)

8.763594

10.20.32.166

10.20.1.20

TCP

52702 → 80 [ACK] Seq=297 Ack=344 Win=1026 Len=0

8.766392

10.20.32.166

10.20.1.20

TCP

52702 → 80 [ACK, FIN] Seq=297 Ack=344 Win=1026 Len=0

8.767794

10.20.1.20

10.20.32.166

TCP

80 → 52702 [ACK, FIN] Seq=344 Ack=298 Win=501 Len=0

8.767967

10.20.32.166

10.20.1.20

TCP

52702 → 80 [ACK] Seq=298 Ack=345 Win=1026 Len=0

21.215011

10.20.32.166

10.20.1.10

DNS

Standard query 0xb95d A cdn.brightlane-static.example

21.238710

10.20.1.10

10.20.32.166

DNS

105

Standard query response 0xb95d A cdn.brightlane-static.example A 203.0.113.82

21.240028

10.20.32.166

203.0.113.82

TCP

52697 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

21.261124

203.0.113.82

10.20.32.166

TCP

443 → 52697 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

21.261350

10.20.32.166

203.0.113.82

TCP

52697 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

21.263187

10.20.32.166

203.0.113.82

TLS

313

Client Hello (SNI=cdn.brightlane-static.example)

21.298519

203.0.113.82

10.20.32.166

TLS

1514

Server Hello, Change Cipher Spec, Application Data

21.298638

203.0.113.82

10.20.32.166

TCP

1514

443 → 52697 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

21.298725

203.0.113.82

10.20.32.166

TLS

1474

Application Data

21.303642

10.20.32.166

203.0.113.82

TLS

979

Application Data

21.383607

203.0.113.82

10.20.32.166

TLS

959

Application Data

21.384100

10.20.32.166

203.0.113.82

TCP

52697 → 443 [ACK] Seq=1185 Ack=5246 Win=1026 Len=0

21.393300

10.20.32.166

203.0.113.82

TCP

52697 → 443 [ACK, FIN] Seq=1185 Ack=5246 Win=1026 Len=0

21.414396

203.0.113.82

10.20.32.166

TCP

443 → 52697 [ACK, FIN] Seq=5246 Ack=1186 Win=501 Len=0

21.414642

10.20.32.166

203.0.113.82

TCP

52697 → 443 [ACK] Seq=1186 Ack=5247 Win=1026 Len=0

35.952183

10.20.28.71

10.20.1.10

DNS

Standard query 0x5ec7 A update.formwiseapp.example

35.963269

10.20.1.10

10.20.28.71

DNS

102

Standard query response 0x5ec7 A update.formwiseapp.example A 203.0.113.132

35.964965

10.20.28.71

203.0.113.132

TCP

51844 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

36.025566

203.0.113.132

10.20.28.71

TCP

80 → 51844 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

36.025946

10.20.28.71

203.0.113.132

TCP

51844 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

36.026211

10.20.28.71

203.0.113.132

HTTP

256

GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1

36.135399

203.0.113.132

10.20.28.71

HTTP

254

HTTP/1.1 200 OK (application/json)

36.136228

10.20.28.71

203.0.113.132

TCP

51844 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0

36.144512

10.20.28.71

203.0.113.132

TCP

51844 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0

36.205113

203.0.113.132

10.20.28.71

TCP

80 → 51844 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0

36.205280

10.20.28.71

203.0.113.132

TCP

51844 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0

57.088830

10.20.37.135

10.20.1.10

DNS

Standard query 0xdca0 A www.lakeshorefamilyhealth.example

57.110324

10.20.1.10

10.20.37.135

DNS

165

Standard query response 0xdca0 A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183

57.111514

10.20.37.135

192.0.2.183

TCP

58676 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

57.131057

192.0.2.183

10.20.37.135

TCP

443 → 58676 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

57.131161

10.20.37.135

192.0.2.183

TCP

58676 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

57.131857

10.20.37.135

192.0.2.183

TLS

317

Client Hello (SNI=www.lakeshorefamilyhealth.example)

57.160698

192.0.2.183

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

57.160847

192.0.2.183

10.20.37.135

TCP

1514

443 → 58676 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]

57.160997

192.0.2.183

10.20.37.135

TLS

371

Application Data

57.163720

10.20.37.135

192.0.2.183

TLS

975

Application Data

57.229601

192.0.2.183

10.20.37.135

TLS

1514

Application Data

57.229765

192.0.2.183

10.20.37.135

TLS

1514

Application Data

57.229801

192.0.2.183

10.20.37.135

TLS

1514

Application Data

57.229935

192.0.2.183

10.20.37.135

TCP

1514

443 → 58676 [ACK] Seq=7618 Ack=1185 Win=501 Len=1460 [part of a TLS record]

57.230053

192.0.2.183

10.20.37.135

TCP

249

443 → 58676 [ACK, PSH] Seq=9078 Ack=1185 Win=501 Len=195 [part of a TLS record]

57.230355

10.20.37.135

192.0.2.183

TCP

58676 → 443 [ACK] Seq=1185 Ack=9273 Win=1026 Len=0

57.267499

10.20.37.135

192.0.2.183

TCP

58676 → 443 [ACK, FIN] Seq=1185 Ack=9273 Win=1026 Len=0

57.287042

192.0.2.183

10.20.37.135

TCP

443 → 58676 [ACK, FIN] Seq=9273 Ack=1186 Win=501 Len=0

57.287124

10.20.37.135

192.0.2.183

TCP

58676 → 443 [ACK] Seq=1186 Ack=9274 Win=1026 Len=0

67.467440

10.20.32.166

10.20.1.10

DNS

Standard query 0x309a A api.skyledger-weather.example

67.471591

10.20.1.10

10.20.32.166

DNS

105

Standard query response 0x309a A api.skyledger-weather.example A 192.0.2.182

67.472287

10.20.32.166

192.0.2.182

TCP

52695 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

67.504316

192.0.2.182

10.20.32.166

TCP

443 → 52695 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

67.504536

10.20.32.166

192.0.2.182

TCP

52695 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

67.505916

10.20.32.166

192.0.2.182

TLS

313

Client Hello (SNI=api.skyledger-weather.example)

67.546221

192.0.2.182

10.20.32.166

TLS

1514

Server Hello, Change Cipher Spec, Application Data

67.546295

192.0.2.182

10.20.32.166

TCP

1514

443 → 52695 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

67.546531

192.0.2.182

10.20.32.166

TLS

1296

Application Data

67.551427

10.20.32.166

192.0.2.182

TLS

477

Application Data

67.645851

192.0.2.182

10.20.32.166

TLS

1514

Application Data

67.646078

192.0.2.182

10.20.32.166

TLS

1514

Application Data

67.646314

192.0.2.182

10.20.32.166

TLS

1514

Application Data

67.646388

192.0.2.182

10.20.32.166

TCP

229

443 → 52695 [ACK, PSH] Seq=8543 Ack=683 Win=501 Len=175 [part of a TLS record]

100

67.646808

10.20.32.166

192.0.2.182

TCP

52695 → 443 [ACK] Seq=683 Ack=8718 Win=1026 Len=0

101

67.649172

10.20.32.166

192.0.2.182

TCP

52695 → 443 [ACK, FIN] Seq=683 Ack=8718 Win=1026 Len=0

102

67.681201

192.0.2.182

10.20.32.166

TCP

443 → 52695 [ACK, FIN] Seq=8718 Ack=684 Win=501 Len=0

103

67.681390

10.20.32.166

192.0.2.182

TCP

52695 → 443 [ACK] Seq=684 Ack=8719 Win=1026 Len=0

104

99.676356

10.20.32.166

10.20.1.10

DNS

Standard query 0xa79e A car-epointlinens.example

105

99.679265

10.20.1.10

10.20.32.166

DNS

100

Standard query response 0xa79e A car-epointlinens.example A 203.0.113.142

106

99.679533

10.20.32.166

203.0.113.142

TCP

52704 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

107

99.729124

203.0.113.142

10.20.32.166

TCP

80 → 52704 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

108

99.729343

10.20.32.166

203.0.113.142

TCP

52704 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

109

99.729688

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

110

99.789984

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

111

99.790468

10.20.32.166

203.0.113.142

TCP

52704 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

112

99.821713

10.20.32.166

203.0.113.142

TCP

52704 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

113

99.871304

203.0.113.142

10.20.32.166

TCP

80 → 52704 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

114

99.871444

10.20.32.166

203.0.113.142

TCP

52704 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

115

100.629508

10.20.30.75

10.20.1.10

DNS

Standard query 0xec31 A cdn.brightlane-static.example

116

100.640275

10.20.1.10

10.20.30.75

DNS

105

Standard query response 0xec31 A cdn.brightlane-static.example A 203.0.113.82

117

100.640503

10.20.30.75

203.0.113.82

TCP

57435 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

118

100.699842

203.0.113.82

10.20.30.75

TCP

443 → 57435 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

119

100.700047

10.20.30.75

203.0.113.82

TCP

57435 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

120

100.700914

10.20.30.75

203.0.113.82

TLS

313

Client Hello (SNI=cdn.brightlane-static.example)

121

100.775205

203.0.113.82

10.20.30.75

TLS

1514

Server Hello, Change Cipher Spec, Application Data

122

100.775282

203.0.113.82

10.20.30.75

TLS

1514

Application Data

123

100.775388

203.0.113.82

10.20.30.75

TCP

150

443 → 57435 [ACK, PSH] Seq=2921 Ack=260 Win=501 Len=96 [part of a TLS record]

124

100.778924

10.20.30.75

203.0.113.82

TLS

930

Application Data

125

100.850323

203.0.113.82

10.20.30.75

TLS

1514

Application Data

126

100.850416

203.0.113.82

10.20.30.75

TLS

1514

Application Data

127

100.850602

203.0.113.82

10.20.30.75

TLS

1514

Application Data

128

100.850774

203.0.113.82

10.20.30.75

TCP

689

443 → 57435 [ACK, PSH] Seq=7397 Ack=1136 Win=501 Len=635 [part of a TLS record]

129

100.850984

10.20.30.75

203.0.113.82

TCP

57435 → 443 [ACK] Seq=1136 Ack=8032 Win=1026 Len=0

130

100.866913

10.20.30.75

203.0.113.82

TCP

57435 → 443 [ACK, FIN] Seq=1136 Ack=8032 Win=1026 Len=0

131

100.926252

203.0.113.82

10.20.30.75

TCP

443 → 57435 [ACK, FIN] Seq=8032 Ack=1137 Win=501 Len=0

132

100.926362

10.20.30.75

203.0.113.82

TCP

57435 → 443 [ACK] Seq=1137 Ack=8033 Win=1026 Len=0

133

116.415580

10.20.37.135

10.20.1.10

DNS

Standard query 0x3c2f A intranet.lakeshorefamilyhealth.example

134

116.431495

10.20.1.10

10.20.37.135

DNS

114

Standard query response 0x3c2f A intranet.lakeshorefamilyhealth.example A 10.20.1.20

135

116.432127

10.20.37.135

10.20.1.20

TCP

58680 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

136

116.432611

10.20.1.20

10.20.37.135

TCP

80 → 58680 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

137

116.432709

10.20.37.135

10.20.1.20

TCP

58680 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

138

116.433533

10.20.37.135

10.20.1.20

HTTP

363

GET /schedule HTTP/1.1

139

116.452397

10.20.1.20

10.20.37.135

HTTP

407

HTTP/1.1 200 OK (text/html)

140

116.453151

10.20.37.135

10.20.1.20

TCP

58680 → 80 [ACK] Seq=310 Ack=354 Win=1026 Len=0

141

116.474199

10.20.37.135

10.20.1.20

TCP

58680 → 80 [ACK, FIN] Seq=310 Ack=354 Win=1026 Len=0

142

116.474683

10.20.1.20

10.20.37.135

TCP

80 → 58680 [ACK, FIN] Seq=354 Ack=311 Win=501 Len=0

143

116.475029

10.20.37.135

10.20.1.20

TCP

58680 → 80 [ACK] Seq=311 Ack=355 Win=1026 Len=0

144

144.169815

10.20.32.166

203.0.113.142

TCP

52705 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

145

144.206193

203.0.113.142

10.20.32.166

TCP

80 → 52705 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

146

144.206542

10.20.32.166

203.0.113.142

TCP

52705 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

147

144.207105

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

148

144.252256

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

149

144.252526

10.20.32.166

203.0.113.142

TCP

52705 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

150

144.272562

10.20.32.166

203.0.113.142

TCP

52705 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

151

144.308940

203.0.113.142

10.20.32.166

TCP

80 → 52705 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

152

144.309080

10.20.32.166

203.0.113.142

TCP

52705 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

153

159.878883

10.20.37.189

203.0.113.108

TCP

55476 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

154

159.924222

203.0.113.108

10.20.37.189

TCP

443 → 55476 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

155

159.924339

10.20.37.189

203.0.113.108

TCP

55476 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

156

159.926058

10.20.37.189

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

157

159.987695

203.0.113.108

10.20.37.189

TLS

1514

Server Hello, Change Cipher Spec, Application Data

158

159.987891

203.0.113.108

10.20.37.189

TCP

1514

443 → 55476 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]

159

159.988065

203.0.113.108

10.20.37.189

TLS

481

Application Data

160

159.989700

10.20.37.189

203.0.113.108

TLS

921

Application Data

161

160.128309

203.0.113.108

10.20.37.189

TLS

894

Application Data

162

160.128550

10.20.37.189

203.0.113.108

TCP

55476 → 443 [ACK] Seq=1128 Ack=4188 Win=1026 Len=0

163

160.158334

10.20.37.189

203.0.113.108

TCP

55476 → 443 [ACK, FIN] Seq=1128 Ack=4188 Win=1026 Len=0

164

160.203673

203.0.113.108

10.20.37.189

TCP

443 → 55476 [ACK, FIN] Seq=4188 Ack=1129 Win=501 Len=0

165

160.204024

10.20.37.189

203.0.113.108

TCP

55476 → 443 [ACK] Seq=1129 Ack=4189 Win=1026 Len=0

166

175.960711

10.20.28.71

10.20.1.10

DNS

Standard query 0xc998 A portal.carepointlinens.example

167

175.963856

10.20.1.10

10.20.28.71

DNS

106

Standard query response 0xc998 A portal.carepointlinens.example A 203.0.113.108

168

175.964361

10.20.28.71

203.0.113.108

TCP

51840 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

169

176.014168

203.0.113.108

10.20.28.71

TCP

443 → 51840 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

170

176.014296

10.20.28.71

203.0.113.108

TCP

51840 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

171

176.015368

10.20.28.71

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

172

176.082823

203.0.113.108

10.20.28.71

TLS

1514

Server Hello, Change Cipher Spec, Application Data

173

176.082983

203.0.113.108

10.20.28.71

TLS

1514

Application Data

174

176.083090

203.0.113.108

10.20.28.71

TCP

127

443 → 51840 [ACK, PSH] Seq=2921 Ack=261 Win=501 Len=73 [part of a TLS record]

175

176.086832

10.20.28.71

203.0.113.108

TLS

781

Application Data

176

176.259234

203.0.113.108

10.20.28.71

TLS

1514

Application Data

177

176.259427

203.0.113.108

10.20.28.71

TCP

624

443 → 51840 [ACK, PSH] Seq=4454 Ack=988 Win=501 Len=570 [part of a TLS record]

178

176.259954

10.20.28.71

203.0.113.108

TCP

51840 → 443 [ACK] Seq=988 Ack=5024 Win=1026 Len=0

179

176.276827

10.20.28.71

203.0.113.108

TCP

51840 → 443 [ACK, FIN] Seq=988 Ack=5024 Win=1026 Len=0

180

176.326634

203.0.113.108

10.20.28.71

TCP

443 → 51840 [ACK, FIN] Seq=5024 Ack=989 Win=501 Len=0

181

176.326776

10.20.28.71

203.0.113.108

TCP

51840 → 443 [ACK] Seq=989 Ack=5025 Win=1026 Len=0

182

186.628564

10.20.32.166

203.0.113.142

TCP

52706 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

183

186.707625

203.0.113.142

10.20.32.166

TCP

80 → 52706 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

184

186.707806

10.20.32.166

203.0.113.142

TCP

52706 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

185

186.708358

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

186

186.801119

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

187

186.801309

10.20.32.166

203.0.113.142

TCP

52706 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

188

186.816206

10.20.32.166

203.0.113.142

TCP

52706 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

189

186.895267

203.0.113.142

10.20.32.166

TCP

80 → 52706 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

190

186.895536

10.20.32.166

203.0.113.142

TCP

52706 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

191

201.762934

10.20.37.135

203.0.113.249

TCP

58678 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

192

201.817476

203.0.113.249

10.20.37.135

TCP

443 → 58678 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

193

201.817803

10.20.37.135

203.0.113.249

TCP

58678 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

194

201.818317

10.20.37.135

203.0.113.249

TLS

310

Client Hello (SNI=login.meridian-sso.example)

195

201.877828

203.0.113.249

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

196

201.878009

203.0.113.249

10.20.37.135

TCP

1514

443 → 58678 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]

197

201.878246

203.0.113.249

10.20.37.135

TLS

695

Application Data

198

201.882600

10.20.37.135

203.0.113.249

TLS

510

Application Data

199

202.003375

203.0.113.249

10.20.37.135

TLS

1514

Application Data

200

202.003533

203.0.113.249

10.20.37.135

TCP

1266

443 → 58678 [ACK, PSH] Seq=5022 Ack=713 Win=501 Len=1212 [part of a TLS record]

201

202.004084

10.20.37.135

203.0.113.249

TCP

58678 → 443 [ACK] Seq=713 Ack=6234 Win=1026 Len=0

202

202.033191

10.20.37.135

203.0.113.249

TCP

58678 → 443 [ACK, FIN] Seq=713 Ack=6234 Win=1026 Len=0

203

202.087733

203.0.113.249

10.20.37.135

TCP

443 → 58678 [ACK, FIN] Seq=6234 Ack=714 Win=501 Len=0

204

202.087876

10.20.37.135

203.0.113.249

TCP

58678 → 443 [ACK] Seq=714 Ack=6235 Win=1026 Len=0

205

213.895168

10.20.37.189

10.20.1.10

DNS

Standard query 0xe6f6 A login.meridian-sso.example

206

213.900350

10.20.1.10

10.20.37.189

DNS

102

Standard query response 0xe6f6 A login.meridian-sso.example A 203.0.113.249

207

213.902064

10.20.37.189

203.0.113.249

TCP

55478 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

208

213.979106

203.0.113.249

10.20.37.189

TCP

443 → 55478 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

209

213.979419

10.20.37.189

203.0.113.249

TCP

55478 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

210

213.980192

10.20.37.189

203.0.113.249

TLS

310

Client Hello (SNI=login.meridian-sso.example)

211

214.074875

203.0.113.249

10.20.37.189

TLS

1514

Server Hello, Change Cipher Spec, Application Data

212

214.075046

203.0.113.249

10.20.37.189

TCP

1514

443 → 55478 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]

213

214.075296

203.0.113.249

10.20.37.189

TLS

1026

Application Data

214

214.077881

10.20.37.189

203.0.113.249

TLS

558

Application Data

215

214.222829

203.0.113.249

10.20.37.189

TLS

1514

Application Data

216

214.222889

203.0.113.249

10.20.37.189

TCP

428

443 → 55478 [ACK, PSH] Seq=5353 Ack=761 Win=501 Len=374 [part of a TLS record]

217

214.223569

10.20.37.189

203.0.113.249

TCP

55478 → 443 [ACK] Seq=761 Ack=5727 Win=1026 Len=0

218

214.247710

10.20.37.189

203.0.113.249

TCP

55478 → 443 [ACK, FIN] Seq=761 Ack=5727 Win=1026 Len=0

219

214.324752

203.0.113.249

10.20.37.189

TCP

443 → 55478 [ACK, FIN] Seq=5727 Ack=762 Win=501 Len=0

220

214.324932

10.20.37.189

203.0.113.249

TCP

55478 → 443 [ACK] Seq=762 Ack=5728 Win=1026 Len=0

221

219.150606

10.20.37.135

10.20.1.10

DNS

Standard query 0x9ebb A login.meridian-sso.example

222

219.154650

10.20.1.10

10.20.37.135

DNS

102

Standard query response 0x9ebb A login.meridian-sso.example A 203.0.113.249

223

219.156558

10.20.37.135

203.0.113.249

TCP

58674 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

224

219.235377

203.0.113.249

10.20.37.135

TCP

443 → 58674 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

225

219.235589

10.20.37.135

203.0.113.249

TCP

58674 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

226

219.237133

10.20.37.135

203.0.113.249

TLS

310

Client Hello (SNI=login.meridian-sso.example)

227

219.326274

203.0.113.249

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

228

219.326486

203.0.113.249

10.20.37.135

TCP

1514

443 → 58674 [ACK] Seq=1461 Ack=257 Win=501 Len=1460 [part of a TLS record]

229

219.326561

203.0.113.249

10.20.37.135

TLS

1192

Application Data

230

219.329021

10.20.37.135

203.0.113.249

TLS

574

Application Data

231

219.437116

203.0.113.249

10.20.37.135

TLS

1514

Application Data

232

219.437222

203.0.113.249

10.20.37.135

TLS

1514

Application Data

233

219.437289

203.0.113.249

10.20.37.135

TCP

1514

443 → 58674 [ACK] Seq=6979 Ack=777 Win=501 Len=1460 [part of a TLS record]

234

219.437534

203.0.113.249

10.20.37.135

TCP

191

443 → 58674 [ACK, PSH] Seq=8439 Ack=777 Win=501 Len=137 [part of a TLS record]

235

219.438101

10.20.37.135

203.0.113.249

TCP

58674 → 443 [ACK] Seq=777 Ack=8576 Win=1026 Len=0

236

219.473990

10.20.37.135

203.0.113.249

TCP

58674 → 443 [ACK, FIN] Seq=777 Ack=8576 Win=1026 Len=0

237

219.552809

203.0.113.249

10.20.37.135

TCP

443 → 58674 [ACK, FIN] Seq=8576 Ack=778 Win=501 Len=0

238

219.552998

10.20.37.135

203.0.113.249

TCP

58674 → 443 [ACK] Seq=778 Ack=8577 Win=1026 Len=0

239

230.418536

10.20.32.166

203.0.113.142

TCP

52707 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

240

230.501678

203.0.113.142

10.20.32.166

TCP

80 → 52707 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

241

230.501896

10.20.32.166

203.0.113.142

TCP

52707 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

242

230.502258

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

243

230.601250

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

244

230.601375

10.20.32.166

203.0.113.142

TCP

52707 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

245

230.618637

10.20.32.166

203.0.113.142

TCP

52707 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

246

230.701779

203.0.113.142

10.20.32.166

TCP

80 → 52707 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

247

230.701869

10.20.32.166

203.0.113.142

TCP

52707 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

248

240.177908

10.20.30.75

10.20.1.10

DNS

Standard query 0x426c A www.lakeshorefamilyhealth.example

249

240.201890

10.20.1.10

10.20.30.75

DNS

165

Standard query response 0x426c A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183

250

240.203251

10.20.30.75

192.0.2.183

TCP

57433 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

251

240.235574

192.0.2.183

10.20.30.75

TCP

443 → 57433 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

252

240.235864

10.20.30.75

192.0.2.183

TCP

57433 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

253

240.237704

10.20.30.75

192.0.2.183

TLS

317

Client Hello (SNI=www.lakeshorefamilyhealth.example)

254

240.280350

192.0.2.183

10.20.30.75

TLS

1514

Server Hello, Change Cipher Spec, Application Data

255

240.280589

192.0.2.183

10.20.30.75

TCP

1514

443 → 57433 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]

256

240.280661

192.0.2.183

10.20.30.75

TLS

395

Application Data

257

240.283040

10.20.30.75

192.0.2.183

TLS

559

Application Data

258

240.429344

192.0.2.183

10.20.30.75

TLS

1514

Application Data

259

240.429401

192.0.2.183

10.20.30.75

TLS

1514

Application Data

260

240.429486

192.0.2.183

10.20.30.75

TCP

408

443 → 57433 [ACK, PSH] Seq=6182 Ack=769 Win=501 Len=354 [part of a TLS record]

261

240.430127

10.20.30.75

192.0.2.183

TCP

57433 → 443 [ACK] Seq=769 Ack=6536 Win=1026 Len=0

262

240.452615

10.20.30.75

192.0.2.183

TCP

57433 → 443 [ACK, FIN] Seq=769 Ack=6536 Win=1026 Len=0

263

240.484938

192.0.2.183

10.20.30.75

TCP

443 → 57433 [ACK, FIN] Seq=6536 Ack=770 Win=501 Len=0

264

240.485059

10.20.30.75

192.0.2.183

TCP

57433 → 443 [ACK] Seq=770 Ack=6537 Win=1026 Len=0

265

243.418156

10.20.37.189

10.20.1.10

DNS

Standard query 0xe2bb A portal.carepointlinens.example

266

243.419486

10.20.1.10

10.20.37.189

DNS

106

Standard query response 0xe2bb A portal.carepointlinens.example A 203.0.113.108

267

243.420923

10.20.37.189

203.0.113.108

TCP

55473 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

268

243.481023

203.0.113.108

10.20.37.189

TCP

443 → 55473 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

269

243.481129

10.20.37.189

203.0.113.108

TCP

55473 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

270

243.482518

10.20.37.189

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

271

243.557951

203.0.113.108

10.20.37.189

TLS

1514

Server Hello, Change Cipher Spec, Application Data

272

243.558098

203.0.113.108

10.20.37.189

TCP

1514

443 → 55473 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]

273

243.558208

203.0.113.108

10.20.37.189

TLS

572

Application Data

274

243.562317

10.20.37.189

203.0.113.108

TLS

835

Application Data

275

243.769677

203.0.113.108

10.20.37.189

TLS

1514

Application Data

276

243.769713

203.0.113.108

10.20.37.189

TLS

1514

Application Data

277

243.769761

203.0.113.108

10.20.37.189

TLS

1514

Application Data

278

243.769915

203.0.113.108

10.20.37.189

TCP

1514

443 → 55473 [ACK] Seq=7819 Ack=1042 Win=501 Len=1460 [part of a TLS record]

279

243.770127

203.0.113.108

10.20.37.189

TCP

205

443 → 55473 [ACK, PSH] Seq=9279 Ack=1042 Win=501 Len=151 [part of a TLS record]

280

243.770479

10.20.37.189

203.0.113.108

TCP

55473 → 443 [ACK] Seq=1042 Ack=9430 Win=1026 Len=0

281

243.799273

10.20.37.189

203.0.113.108

TCP

55473 → 443 [ACK, FIN] Seq=1042 Ack=9430 Win=1026 Len=0

282

243.859373

203.0.113.108

10.20.37.189

TCP

443 → 55473 [ACK, FIN] Seq=9430 Ack=1043 Win=501 Len=0

283

243.859487

10.20.37.189

203.0.113.108

TCP

55473 → 443 [ACK] Seq=1043 Ack=9431 Win=1026 Len=0

284

250.920257

10.20.32.166

10.20.1.10

DNS

Standard query 0x38ef A portal.carepointlinens.example

285

250.931107

10.20.1.10

10.20.32.166

DNS

106

Standard query response 0x38ef A portal.carepointlinens.example A 203.0.113.108

286

250.931751

10.20.32.166

203.0.113.108

TCP

52693 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

287

250.968989

203.0.113.108

10.20.32.166

TCP

443 → 52693 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

288

250.969324

10.20.32.166

203.0.113.108

TCP

52693 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

289

250.970151

10.20.32.166

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

290

251.008977

203.0.113.108

10.20.32.166

TLS

1514

Server Hello, Change Cipher Spec, Application Data

291

251.009098

203.0.113.108

10.20.32.166

TCP

1514

443 → 52693 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]

292

251.009273

203.0.113.108

10.20.32.166

TLS

838

Application Data

293

251.010699

10.20.32.166

203.0.113.108

TLS

709

Application Data

294

251.085625

203.0.113.108

10.20.32.166

TLS

1514

Application Data

295

251.085743

203.0.113.108

10.20.32.166

TLS

1514

Application Data

296

251.085840

203.0.113.108

10.20.32.166

TCP

1514

443 → 52693 [ACK] Seq=6625 Ack=916 Win=501 Len=1460 [part of a TLS record]

297

251.086041

203.0.113.108

10.20.32.166

TLS

1514

Application Data

298

251.086204

203.0.113.108

10.20.32.166

TCP

1053

443 → 52693 [ACK, PSH] Seq=9545 Ack=916 Win=501 Len=999 [part of a TLS record]

299

251.086955

10.20.32.166

203.0.113.108

TCP

52693 → 443 [ACK] Seq=916 Ack=10544 Win=1026 Len=0

300

251.099838

10.20.32.166

203.0.113.108

TCP

52693 → 443 [ACK, FIN] Seq=916 Ack=10544 Win=1026 Len=0

301

251.137076

203.0.113.108

10.20.32.166

TCP

443 → 52693 [ACK, FIN] Seq=10544 Ack=917 Win=501 Len=0

302

251.137232

10.20.32.166

203.0.113.108

TCP

52693 → 443 [ACK] Seq=917 Ack=10545 Win=1026 Len=0

303

253.419667

10.20.32.166

10.20.1.10

DNS

Standard query 0xe5c0 A mail.lakeshorefamilyhealth.example

304

253.439033

10.20.1.10

10.20.32.166

DNS

110

Standard query response 0xe5c0 A mail.lakeshorefamilyhealth.example A 203.0.113.75

305

253.439234

10.20.32.166

203.0.113.75

TCP

52699 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

306

253.491193

203.0.113.75

10.20.32.166

TCP

443 → 52699 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

307

253.491289

10.20.32.166

203.0.113.75

TCP

52699 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

308

253.492027

10.20.32.166

203.0.113.75

TLS

318

Client Hello (SNI=mail.lakeshorefamilyhealth.example)

309

253.559418

203.0.113.75

10.20.32.166

TLS

1514

Server Hello, Change Cipher Spec, Application Data

310

253.559582

203.0.113.75

10.20.32.166

TCP

1514

443 → 52699 [ACK] Seq=1461 Ack=265 Win=501 Len=1460 [part of a TLS record]

311

253.559633

203.0.113.75

10.20.32.166

TLS

1234

Application Data

312

253.562848

10.20.32.166

203.0.113.75

TLS

594

Application Data

313

253.749888

203.0.113.75

10.20.32.166

TLS

845

Application Data

314

253.750648

10.20.32.166

203.0.113.75

TCP

52699 → 443 [ACK] Seq=805 Ack=4892 Win=1026 Len=0

315

253.789214

10.20.32.166

203.0.113.75

TCP

52699 → 443 [ACK, FIN] Seq=805 Ack=4892 Win=1026 Len=0

316

253.841173

203.0.113.75

10.20.32.166

TCP

443 → 52699 [ACK, FIN] Seq=4892 Ack=806 Win=501 Len=0

317

253.841466

10.20.32.166

203.0.113.75

TCP

52699 → 443 [ACK] Seq=806 Ack=4893 Win=1026 Len=0

318

265.196074

10.20.37.189

10.20.1.10

DNS

Standard query 0x8e5b A api.skyledger-weather.example

319

265.203285

10.20.1.10

10.20.37.189

DNS

105

Standard query response 0x8e5b A api.skyledger-weather.example A 192.0.2.182

320

265.205226

10.20.37.189

192.0.2.182

TCP

55475 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

321

265.241881

192.0.2.182

10.20.37.189

TCP

443 → 55475 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

322

265.242063

10.20.37.189

192.0.2.182

TCP

55475 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

323

265.242516

10.20.37.189

192.0.2.182

TLS

313

Client Hello (SNI=api.skyledger-weather.example)

324

265.293370

192.0.2.182

10.20.37.189

TLS

1514

Server Hello, Change Cipher Spec, Application Data

325

265.293478

192.0.2.182

10.20.37.189

TCP

1514

443 → 55475 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

326

265.293711

192.0.2.182

10.20.37.189

TCP

1514

443 → 55475 [ACK] Seq=2921 Ack=260 Win=501 Len=1460 [part of a TLS record]

327

265.293831

192.0.2.182

10.20.37.189

TLS

419

Application Data

328

265.298251

10.20.37.189

192.0.2.182

TLS

648

Application Data

329

265.455585

192.0.2.182

10.20.37.189

TLS

1514

Application Data

330

265.455678

192.0.2.182

10.20.37.189

TCP

491

443 → 55475 [ACK, PSH] Seq=6206 Ack=854 Win=501 Len=437 [part of a TLS record]

331

265.456195

10.20.37.189

192.0.2.182

TCP

55475 → 443 [ACK] Seq=854 Ack=6643 Win=1026 Len=0

332

265.478667

10.20.37.189

192.0.2.182

TCP

55475 → 443 [ACK, FIN] Seq=854 Ack=6643 Win=1026 Len=0

333

265.515322

192.0.2.182

10.20.37.189

TCP

443 → 55475 [ACK, FIN] Seq=6643 Ack=855 Win=501 Len=0

334

265.515693

10.20.37.189

192.0.2.182

TCP

55475 → 443 [ACK] Seq=855 Ack=6644 Win=1026 Len=0

335

276.339406

10.20.32.166

203.0.113.142

TCP

52708 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

336

276.422949

203.0.113.142

10.20.32.166

TCP

80 → 52708 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

337

276.423225

10.20.32.166

203.0.113.142

TCP

52708 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

338

276.423816

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

339

276.530921

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

340

276.531571

10.20.32.166

203.0.113.142

TCP

52708 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

341

276.539546

10.20.32.166

203.0.113.142

TCP

52708 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

342

276.623089

203.0.113.142

10.20.32.166

TCP

80 → 52708 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

343

276.623224

10.20.32.166

203.0.113.142

TCP

52708 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

344

276.725724

10.20.28.71

192.0.2.183

TCP

51838 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

345

276.775821

192.0.2.183

10.20.28.71

TCP

443 → 51838 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

346

276.776018

10.20.28.71

192.0.2.183

TCP

51838 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

347

276.777490

10.20.28.71

192.0.2.183

TLS

317

Client Hello (SNI=www.lakeshorefamilyhealth.example)

348

276.843236

192.0.2.183

10.20.28.71

TLS

1514

Server Hello, Change Cipher Spec, Application Data

349

276.843384

192.0.2.183

10.20.28.71

TLS

1514

Application Data

350

276.843630

192.0.2.183

10.20.28.71

TCP

123

443 → 51838 [ACK, PSH] Seq=2921 Ack=264 Win=501 Len=69 [part of a TLS record]

351

276.847647

10.20.28.71

192.0.2.183

TLS

546

Application Data

352

276.948941

192.0.2.183

10.20.28.71

TLS

1165

Application Data

353

276.949785

10.20.28.71

192.0.2.183

TCP

51838 → 443 [ACK] Seq=756 Ack=4101 Win=1026 Len=0

354

276.962262

10.20.28.71

192.0.2.183

TCP

51838 → 443 [ACK, FIN] Seq=756 Ack=4101 Win=1026 Len=0

355

277.012359

192.0.2.183

10.20.28.71

TCP

443 → 51838 [ACK, FIN] Seq=4101 Ack=757 Win=501 Len=0

356

277.012696

10.20.28.71

192.0.2.183

TCP

51838 → 443 [ACK] Seq=757 Ack=4102 Win=1026 Len=0

357

319.887118

10.20.32.166

203.0.113.142

TCP

52709 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

358

319.951451

203.0.113.142

10.20.32.166

TCP

80 → 52709 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

359

319.951639

10.20.32.166

203.0.113.142

TCP

52709 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

360

319.952100

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

361

320.042647

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

362

320.042987

10.20.32.166

203.0.113.142

TCP

52709 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

363

320.078381

10.20.32.166

203.0.113.142

TCP

52709 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

364

320.142714

203.0.113.142

10.20.32.166

TCP

80 → 52709 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

365

320.142861

10.20.32.166

203.0.113.142

TCP

52709 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

366

363.334847

10.20.32.166

203.0.113.142

TCP

52710 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

367

363.354418

203.0.113.142

10.20.32.166

TCP

80 → 52710 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

368

363.354669

10.20.32.166

203.0.113.142

TCP

52710 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

369

363.355205

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

370

363.395028

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

371

363.395309

10.20.32.166

203.0.113.142

TCP

52710 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

372

363.411580

10.20.32.166

203.0.113.142

TCP

52710 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

373

363.431151

203.0.113.142

10.20.32.166

TCP

80 → 52710 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

374

363.431244

10.20.32.166

203.0.113.142

TCP

52710 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

375

405.701101

10.20.32.166

203.0.113.108

TCP

52700 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

376

405.729775

203.0.113.108

10.20.32.166

TCP

443 → 52700 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

377

405.730142

10.20.32.166

203.0.113.108

TCP

52700 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

378

405.730450

10.20.32.166

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

379

405.779017

203.0.113.108

10.20.32.166

TLS

1514

Server Hello, Change Cipher Spec, Application Data

380

405.779136

203.0.113.108

10.20.32.166

TCP

1514

443 → 52700 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]

381

405.779231

203.0.113.108

10.20.32.166

TLS

1268

Application Data

382

405.782705

10.20.32.166

203.0.113.108

TLS

925

Application Data

383

405.878235

203.0.113.108

10.20.32.166

TLS

1514

Application Data

384

405.878295

203.0.113.108

10.20.32.166

TLS

1514

Application Data

385

405.878469

203.0.113.108

10.20.32.166

TLS

1514

Application Data

386

405.878594

203.0.113.108

10.20.32.166

TCP

715

443 → 52700 [ACK, PSH] Seq=8515 Ack=1132 Win=501 Len=661 [part of a TLS record]

387

405.879213

10.20.32.166

203.0.113.108

TCP

52700 → 443 [ACK] Seq=1132 Ack=9176 Win=1026 Len=0

388

405.909033

10.20.32.166

203.0.113.108

TCP

52700 → 443 [ACK, FIN] Seq=1132 Ack=9176 Win=1026 Len=0

389

405.937707

203.0.113.108

10.20.32.166

TCP

443 → 52700 [ACK, FIN] Seq=9176 Ack=1133 Win=501 Len=0

390

405.938007

10.20.32.166

203.0.113.108

TCP

52700 → 443 [ACK] Seq=1133 Ack=9177 Win=1026 Len=0

391

406.832355

10.20.32.166

10.20.1.10

DNS

Standard query 0x2599 A car-epointlinens.example

392

406.848726

10.20.1.10

10.20.32.166

DNS

100

Standard query response 0x2599 A car-epointlinens.example A 203.0.113.142

393

406.850308

10.20.32.166

203.0.113.142

TCP

52712 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

394

406.918332

203.0.113.142

10.20.32.166

TCP

80 → 52712 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

395

406.918453

10.20.32.166

203.0.113.142

TCP

52712 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

396

406.918994

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

397

406.996878

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

398

406.997718

10.20.32.166

203.0.113.142

TCP

52712 → 80 [ACK] Seq=252 Ack=138 Win=1026 Len=0

399

407.031427

10.20.32.166

203.0.113.142

TCP

52712 → 80 [ACK, FIN] Seq=252 Ack=138 Win=1026 Len=0

400

407.099451

203.0.113.142

10.20.32.166

TCP

80 → 52712 [ACK, FIN] Seq=138 Ack=253 Win=501 Len=0

401

407.099751

10.20.32.166

203.0.113.142

TCP

52712 → 80 [ACK] Seq=253 Ack=139 Win=1026 Len=0

402

450.241728

10.20.30.75

10.20.1.10

DNS

Standard query 0xe57c A mail.lakeshorefamilyhealth.example

403

450.244533

10.20.1.10

10.20.30.75

DNS

110

Standard query response 0xe57c A mail.lakeshorefamilyhealth.example A 203.0.113.75

404

450.244793

10.20.30.75

203.0.113.75

TCP

57437 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

405

450.319265

203.0.113.75

10.20.30.75

TCP

443 → 57437 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

406

450.319562

10.20.30.75

203.0.113.75

TCP

57437 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

407

450.320193

10.20.30.75

203.0.113.75

TLS

318

Client Hello (SNI=mail.lakeshorefamilyhealth.example)

408

450.397310

203.0.113.75

10.20.30.75

TLS

1514

Server Hello, Change Cipher Spec, Application Data

409

450.397446

203.0.113.75

10.20.30.75

TCP

1514

443 → 57437 [ACK] Seq=1461 Ack=265 Win=501 Len=1460 [part of a TLS record]

410

450.397536

203.0.113.75

10.20.30.75

TLS

847

Application Data

411

450.400779

10.20.30.75

203.0.113.75

TLS

500

Application Data

412

450.516664

203.0.113.75

10.20.30.75

TLS

1514

Application Data

413

450.516822

203.0.113.75

10.20.30.75

TLS

1514

Application Data

414

450.517003

203.0.113.75

10.20.30.75

TCP

1514

443 → 57437 [ACK] Seq=6634 Ack=711 Win=501 Len=1460 [part of a TLS record]

415

450.517243

203.0.113.75

10.20.30.75

TLS

1514

Application Data

416

450.517331

203.0.113.75

10.20.30.75

TCP

1007

443 → 57437 [ACK, PSH] Seq=9554 Ack=711 Win=501 Len=953 [part of a TLS record]

417

450.518007

10.20.30.75

203.0.113.75

TCP

57437 → 443 [ACK] Seq=711 Ack=10507 Win=1026 Len=0

418

450.528175

10.20.30.75

203.0.113.75

TCP

57437 → 443 [ACK, FIN] Seq=711 Ack=10507 Win=1026 Len=0

419

450.602647

203.0.113.75

10.20.30.75

TCP

443 → 57437 [ACK, FIN] Seq=10507 Ack=712 Win=501 Len=0

420

450.602976

10.20.30.75

203.0.113.75

TCP

57437 → 443 [ACK] Seq=712 Ack=10508 Win=1026 Len=0

421

450.960622

10.20.32.166

203.0.113.142

TCP

52713 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

422

451.010072

203.0.113.142

10.20.32.166

TCP

80 → 52713 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

423

451.010390

10.20.32.166

203.0.113.142

TCP

52713 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

424

451.010890

10.20.32.166

203.0.113.142

HTTP

305

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

425

451.064378

203.0.113.142

10.20.32.166

HTTP

193

HTTP/1.1 200 OK (text/plain)

426

451.064481

10.20.32.166

203.0.113.142

TCP

52713 → 80 [ACK] Seq=252 Ack=140 Win=1026 Len=0

427

451.081552

10.20.32.166

203.0.113.142

TCP

52713 → 80 [ACK, FIN] Seq=252 Ack=140 Win=1026 Len=0

428

451.131002

203.0.113.142

10.20.32.166

TCP

80 → 52713 [ACK, FIN] Seq=140 Ack=253 Win=501 Len=0

429

451.131357

10.20.32.166

203.0.113.142

TCP

52713 → 80 [ACK] Seq=253 Ack=141 Win=1026 Len=0

430

454.699966

10.20.30.75

10.20.1.10

DNS

Standard query 0x932f A update.formwiseapp.example

431

454.705645

10.20.1.10

10.20.30.75

DNS

102

Standard query response 0x932f A update.formwiseapp.example A 203.0.113.132

432

454.706955

10.20.30.75

203.0.113.132

TCP

57441 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

433

454.735887

203.0.113.132

10.20.30.75

TCP

80 → 57441 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

434

454.736144

10.20.30.75

203.0.113.132

TCP

57441 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

435

454.736889

10.20.30.75

203.0.113.132

HTTP

256

GET /v2/check?product=formwise-pdf&version=6.8.6&os=win10 HTTP/1.1

436

454.802582

203.0.113.132

10.20.30.75

HTTP

254

HTTP/1.1 200 OK (application/json)

437

454.803141

10.20.30.75

203.0.113.132

TCP

57441 → 80 [ACK] Seq=203 Ack=201 Win=1026 Len=0

438

454.832517

10.20.30.75

203.0.113.132

TCP

57441 → 80 [ACK, FIN] Seq=203 Ack=201 Win=1026 Len=0

439

454.861449

203.0.113.132

10.20.30.75

TCP

80 → 57441 [ACK, FIN] Seq=201 Ack=204 Win=501 Len=0

440

454.861828

10.20.30.75

203.0.113.132

TCP

57441 → 80 [ACK] Seq=204 Ack=202 Win=1026 Len=0

441

462.541737

10.20.30.75

10.20.1.10

DNS

Standard query 0x25ff A intranet.lakeshorefamilyhealth.example

442

462.547712

10.20.1.10

10.20.30.75

DNS

114

Standard query response 0x25ff A intranet.lakeshorefamilyhealth.example A 10.20.1.20

443

462.549703

10.20.30.75

10.20.1.20

TCP

57439 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

444

462.550808

10.20.1.20

10.20.30.75

TCP

80 → 57439 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

445

462.551061

10.20.30.75

10.20.1.20

TCP

57439 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

446

462.551693

10.20.30.75

10.20.1.20

HTTP

364

GET /forms/pto HTTP/1.1

447

462.565621

10.20.1.20

10.20.30.75

HTTP

399

HTTP/1.1 200 OK (text/html)

448

462.566387

10.20.30.75

10.20.1.20

TCP

57439 → 80 [ACK] Seq=311 Ack=346 Win=1026 Len=0

449

462.593404

10.20.30.75

10.20.1.20

TCP

57439 → 80 [ACK, FIN] Seq=311 Ack=346 Win=1026 Len=0

450

462.594509

10.20.1.20

10.20.30.75

TCP

80 → 57439 [ACK, FIN] Seq=346 Ack=312 Win=501 Len=0

451

462.594638

10.20.30.75

10.20.1.20

TCP

57439 → 80 [ACK] Seq=312 Ack=347 Win=1026 Len=0

452

483.960210

10.20.37.189

10.20.1.10

DNS

Standard query 0x1c4f A files.harborbox-share.example

453

483.973758

10.20.1.10

10.20.37.189

DNS

105

Standard query response 0x1c4f A files.harborbox-share.example A 198.51.100.107

454

483.975716

10.20.37.189

198.51.100.107

TCP

55480 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

455

483.998131

198.51.100.107

10.20.37.189

TCP

443 → 55480 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

456

483.998297

10.20.37.189

198.51.100.107

TCP

55480 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

457

483.998655

10.20.37.189

198.51.100.107

TLS

313

Client Hello (SNI=files.harborbox-share.example)

458

484.026578

198.51.100.107

10.20.37.189

TLS

1514

Server Hello, Change Cipher Spec, Application Data

459

484.026616

198.51.100.107

10.20.37.189

TCP

1514

443 → 55480 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

460

484.026724

198.51.100.107

10.20.37.189

TLS

969

Application Data

461

484.028194

10.20.37.189

198.51.100.107

TLS

510

Application Data

462

484.181639

198.51.100.107

10.20.37.189

TLS

1514

Application Data

463

484.181694

198.51.100.107

10.20.37.189

TCP

1514

443 → 55480 [ACK] Seq=5296 Ack=716 Win=501 Len=1460 [part of a TLS record]

464

484.181879

198.51.100.107

10.20.37.189

TLS

1514

Application Data

465

484.182076

198.51.100.107

10.20.37.189

TLS

932

Application Data

466

484.182328

10.20.37.189

198.51.100.107

TCP

55480 → 443 [ACK] Seq=716 Ack=9094 Win=1026 Len=0

467

484.206160

10.20.37.189

198.51.100.107

TCP

55480 → 443 [ACK, FIN] Seq=716 Ack=9094 Win=1026 Len=0

468

484.228575

198.51.100.107

10.20.37.189

TCP

443 → 55480 [ACK, FIN] Seq=9094 Ack=717 Win=501 Len=0

469

484.228850

10.20.37.189

198.51.100.107

TCP

55480 → 443 [ACK] Seq=717 Ack=9095 Win=1026 Len=0

470

492.928707

10.20.37.135

10.20.1.10

DNS

Standard query 0x66db A cdn.brightlane-static.example

471

492.930213

10.20.1.10

10.20.37.135

DNS

105

Standard query response 0x66db A cdn.brightlane-static.example A 203.0.113.82

472

492.932192

10.20.37.135

203.0.113.82

TCP

58670 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

473

492.990875

203.0.113.82

10.20.37.135

TCP

443 → 58670 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

474

492.991113

10.20.37.135

203.0.113.82

TCP

58670 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

475

492.992767

10.20.37.135

203.0.113.82

TLS

313

Client Hello (SNI=cdn.brightlane-static.example)

476

493.055254

203.0.113.82

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

477

493.055380

203.0.113.82

10.20.37.135

TCP

1514

443 → 58670 [ACK] Seq=1461 Ack=260 Win=501 Len=1460 [part of a TLS record]

478

493.055442

203.0.113.82

10.20.37.135

TCP

1514

443 → 58670 [ACK] Seq=2921 Ack=260 Win=501 Len=1460 [part of a TLS record]

479

493.055632

203.0.113.82

10.20.37.135

TLS

276

Application Data

480

493.057192

10.20.37.135

203.0.113.82

TLS

888

Application Data

481

493.195056

203.0.113.82

10.20.37.135

TLS

1272

Application Data

482

493.195656

10.20.37.135

203.0.113.82

TCP

58670 → 443 [ACK] Seq=1094 Ack=5821 Win=1026 Len=0

483

493.203496

10.20.37.135

203.0.113.82

TCP

58670 → 443 [ACK, FIN] Seq=1094 Ack=5821 Win=1026 Len=0

484

493.262179

203.0.113.82

10.20.37.135

TCP

443 → 58670 [ACK, FIN] Seq=5821 Ack=1095 Win=501 Len=0

485

493.262304

10.20.37.135

203.0.113.82

TCP

58670 → 443 [ACK] Seq=1095 Ack=5822 Win=1026 Len=0

486

496.102914

10.20.32.166

203.0.113.142

TCP

52714 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

487

496.185253

203.0.113.142

10.20.32.166

TCP

80 → 52714 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

488

496.185382

10.20.32.166

203.0.113.142

TCP

52714 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

489

496.185752

10.20.32.166

203.0.113.142

HTTP

306

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

490

496.294272

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

491

496.294678

10.20.32.166

203.0.113.142

TCP

52714 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0

492

496.306136

10.20.32.166

203.0.113.142

TCP

52714 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0

493

496.388475

203.0.113.142

10.20.32.166

TCP

80 → 52714 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0

494

496.388774

10.20.32.166

203.0.113.142

TCP

52714 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0

495

500.747541

10.20.28.71

10.20.1.10

NTP

NTP Version 4, client

496

500.748292

10.20.1.10

10.20.28.71

NTP

NTP Version 4, server

497

539.111846

10.20.32.166

203.0.113.142

TCP

52715 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

498

539.188846

203.0.113.142

10.20.32.166

TCP

80 → 52715 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

499

539.189062

10.20.32.166

203.0.113.142

TCP

52715 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

500

539.189598

10.20.32.166

203.0.113.142

HTTP

306

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

501

539.291644

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

502

539.291942

10.20.32.166

203.0.113.142

TCP

52715 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0

503

539.313002

10.20.32.166

203.0.113.142

TCP

52715 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0

504

539.390002

203.0.113.142

10.20.32.166

TCP

80 → 52715 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0

505

539.390291

10.20.32.166

203.0.113.142

TCP

52715 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0

506

560.159658

10.20.37.135

10.20.1.10

DNS

Standard query 0x51eb A portal.carepointlinens.example

507

560.171427

10.20.1.10

10.20.37.135

DNS

106

Standard query response 0x51eb A portal.carepointlinens.example A 203.0.113.108

508

560.171924

10.20.37.135

203.0.113.108

TCP

58672 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

509

560.224738

203.0.113.108

10.20.37.135

TCP

443 → 58672 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

510

560.225021

10.20.37.135

203.0.113.108

TCP

58672 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

511

560.225528

10.20.37.135

203.0.113.108

TLS

314

Client Hello (SNI=portal.carepointlinens.example)

512

560.292502

203.0.113.108

10.20.37.135

TLS

1514

Server Hello, Change Cipher Spec, Application Data

513

560.292673

203.0.113.108

10.20.37.135

TCP

1514

443 → 58672 [ACK] Seq=1461 Ack=261 Win=501 Len=1460 [part of a TLS record]

514

560.292842

203.0.113.108

10.20.37.135

TLS

649

Application Data

515

560.296634

10.20.37.135

203.0.113.108

TLS

688

Application Data

516

560.419410

203.0.113.108

10.20.37.135

TLS

1514

Application Data

517

560.419631

203.0.113.108

10.20.37.135

TLS

1514

Application Data

518

560.419760

203.0.113.108

10.20.37.135

TCP

1295

443 → 58672 [ACK, PSH] Seq=6436 Ack=895 Win=501 Len=1241 [part of a TLS record]

519

560.420092

10.20.37.135

203.0.113.108

TCP

58672 → 443 [ACK] Seq=895 Ack=7677 Win=1026 Len=0

520

560.455746

10.20.37.135

203.0.113.108

TCP

58672 → 443 [ACK, FIN] Seq=895 Ack=7677 Win=1026 Len=0

521

560.508560

203.0.113.108

10.20.37.135

TCP

443 → 58672 [ACK, FIN] Seq=7677 Ack=896 Win=501 Len=0

522

560.508740

10.20.37.135

203.0.113.108

TCP

58672 → 443 [ACK] Seq=896 Ack=7678 Win=1026 Len=0

523

561.196860

10.20.28.71

10.20.1.10

DNS

Standard query 0x1e4b A www.lakeshorefamilyhealth.example

524

561.207221

10.20.1.10

10.20.28.71

DNS

165

Standard query response 0x1e4b A www.lakeshorefamilyhealth.example CNAME lakeshorefamilyhealth.sitehost-cdn.example A 192.0.2.183

525

561.207454

10.20.28.71

192.0.2.183

TCP

51837 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

526

561.281471

192.0.2.183

10.20.28.71

TCP

443 → 51837 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

527

561.281871

10.20.28.71

192.0.2.183

TCP

51837 → 443 [ACK] Seq=1 Ack=1 Win=1026 Len=0

528

561.282793

10.20.28.71

192.0.2.183

TLS

317

Client Hello (SNI=www.lakeshorefamilyhealth.example)

529

561.373290

192.0.2.183

10.20.28.71

TLS

1514

Server Hello, Change Cipher Spec, Application Data

530

561.373395

192.0.2.183

10.20.28.71

TCP

1514

443 → 51837 [ACK] Seq=1461 Ack=264 Win=501 Len=1460 [part of a TLS record]

531

561.373430

192.0.2.183

10.20.28.71

TLS

1207

Application Data

532

561.376442

10.20.28.71

192.0.2.183

TLS

659

Application Data

533

561.543655

192.0.2.183

10.20.28.71

TLS

1514

Application Data

534

561.543706

192.0.2.183

10.20.28.71

TCP

1514

443 → 51837 [ACK] Seq=5534 Ack=869 Win=501 Len=1460 [part of a TLS record]

535

561.543839

192.0.2.183

10.20.28.71

TLS

1514

Application Data

536

561.544052

192.0.2.183

10.20.28.71

TCP

1329

443 → 51837 [ACK, PSH] Seq=8454 Ack=869 Win=501 Len=1275 [part of a TLS record]

537

561.544942

10.20.28.71

192.0.2.183

TCP

51837 → 443 [ACK] Seq=869 Ack=9729 Win=1026 Len=0

538

561.577288

10.20.28.71

192.0.2.183

TCP

51837 → 443 [ACK, FIN] Seq=869 Ack=9729 Win=1026 Len=0

539

561.651305

192.0.2.183

10.20.28.71

TCP

443 → 51837 [ACK, FIN] Seq=9729 Ack=870 Win=501 Len=0

540

561.651587

10.20.28.71

192.0.2.183

TCP

51837 → 443 [ACK] Seq=870 Ack=9730 Win=1026 Len=0

541

566.458570

10.20.28.71

10.20.1.10

DNS

Standard query 0xa9d3 A intranet.lakeshorefamilyhealth.example

542

566.477964

10.20.1.10

10.20.28.71

DNS

114

Standard query response 0xa9d3 A intranet.lakeshorefamilyhealth.example A 10.20.1.20

543

566.479809

10.20.28.71

10.20.1.20

TCP

51842 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

544

566.480914

10.20.1.20

10.20.28.71

TCP

80 → 51842 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

545

566.481249

10.20.28.71

10.20.1.20

TCP

51842 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

546

566.481671

10.20.28.71

10.20.1.20

HTTP

398

POST /timesheet/submit HTTP/1.1 (application/x-www-form-urlencoded)

547

566.505131

10.20.1.20

10.20.28.71

HTTP

186

HTTP/1.1 303 See Other

548

566.505967

10.20.28.71

10.20.1.20

TCP

51842 → 80 [ACK] Seq=345 Ack=133 Win=1026 Len=0

549

566.533505

10.20.28.71

10.20.1.20

TCP

51842 → 80 [ACK, FIN] Seq=345 Ack=133 Win=1026 Len=0

550

566.534610

10.20.1.20

10.20.28.71

TCP

80 → 51842 [ACK, FIN] Seq=133 Ack=346 Win=501 Len=0

551

566.534798

10.20.28.71

10.20.1.20

TCP

51842 → 80 [ACK] Seq=346 Ack=134 Win=1026 Len=0

552

584.991316

10.20.32.166

203.0.113.142

TCP

52716 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

553

585.039708

203.0.113.142

10.20.32.166

TCP

80 → 52716 [ACK, SYN] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 SACK_PERM WS=128

554

585.040031

10.20.32.166

203.0.113.142

TCP

52716 → 80 [ACK] Seq=1 Ack=1 Win=1026 Len=0

555

585.040429

10.20.32.166

203.0.113.142

HTTP

306

POST /wp-content/sess.php HTTP/1.1 (application/x-www-form-urlencoded)

556

585.102865

203.0.113.142

10.20.32.166

HTTP

191

HTTP/1.1 200 OK (text/plain)

557

585.103575

10.20.32.166

203.0.113.142

TCP

52716 → 80 [ACK] Seq=253 Ack=138 Win=1026 Len=0

558

585.136141

10.20.32.166

203.0.113.142

TCP

52716 → 80 [ACK, FIN] Seq=253 Ack=138 Win=1026 Len=0

559

585.184533

203.0.113.142

10.20.32.166

TCP

80 → 52716 [ACK, FIN] Seq=138 Ack=254 Win=501 Len=0

560

585.184638

10.20.32.166

203.0.113.142

TCP

52716 → 80 [ACK] Seq=254 Ack=139 Win=1026 Len=0