Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

js:pdfka and nsis installation on an unsecure computer on the lan - malware today found with avast


  • This topic is locked This topic is locked
2 replies to this topic

#1 drinkytheclown

drinkytheclown

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:01:09 PM

Posted 29 March 2009 - 01:01 AM

i decided to open up 21 to allow my nas to be seen on the internet so i could access files. whod notice, right? after all i did have a five letter password. roughly 1/2 hour after i started getting emails from my firewall and my dlink g600 nas was kind of unresponsive. i ran a sniffer and found my laptop with at least 50 open connections through different ip's running udp on a high port (3600k) i've never seen this before and thats really what concerned me the most. I don't run bittorent, but somehow the mini exe package that comes with the new one was running on it (bits.exe) i think. it uninstalled but i still ran avast after i noticed the sniffer had my nas maxed at 5 users from 5 unique ip addresses, each sniffing from god knows where. they hadn't guessed the admin yet and would have been a long way away from it, but i found the bittorent www.bittorrent.com/bits/whatisbits.htm i think is the site. i found js:pdfka in a wkp3.tmp file, and it infected 3 other system files that looked like they got quarantied. I dug around on my other one and found a blank entry running that referenced to nsis and an add/remove that looks like it got it, but i'm scanning it right now. i could use any help out there, i've been worried every computer might be infected. thanks


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:12:10 AM, on 3/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\o2flash.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AlpsPoint\ApMain.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Fujitsu\Utils\FjDspMon.exe
C:\Program Files\Softex\OmniPass\scureapp.exe
C:\Program Files\Fujitsu\Utils\fjevents.exe
C:\Program Files\Fujitsu\Utils\FjMenu.exe
C:\Program Files\Fujitsu\fjdvrupd\fjdvrupd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Domain Tools\ProjectWhois\ProjectWhois.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [ApMain] C:\Program Files\AlpsPoint\ApMain.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
O4 - HKLM\..\Run: [FjStrtAp] c:\Program Files\Fujitsu\Utils\FjStrtAp.exe
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [PSUtility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\fjdvrupd\fjdvrupd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O15 - Trusted Zone: http://overtontx.dyndns.org
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1234248060187
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk...ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9a05f744a59fb) (gupdate1c9a05f744a59fb) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 7134 bytes



i know this is gonna make a long post, but i have a bit of the packet sniffer from when i was on here and the urls look really funny like they might be spoofed. i was on bleeping computer for a while, then the activity disappeared and i started getting these links to what looks like directories in yahoo somewhere. and my computer's installer isn't working. it comes on trying to run the installer and the installer never really seems to do anything, just keep anything else from installing or uninstalling.

thanks, kent


my local is tablet in this sniff


Header checksum: 0x5cd4 (correct)
Source: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1233 (1233), Seq: 0, Ack: 1, Len: 0
Source port: http (80)
Destination port: 1233 (1233)
Source or Destination Port: 80
Source or Destination Port: 1233
TCP Segment Len: 0
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 28 bytes
Flags: 0x0012 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0xd744 (correct)
Options: (8 bytes)
TCP MSS Option: True
Maximum segment size: 1460 bytes
NOP
NOP
SACK permitted
SEQ/ACK analysis
This is an ACK to the segment in frame: 5
The RTT to ACK the segment was: 0.186994000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 6

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 00 30 00 00 40 00 34 06 5C D4 4C 0D D8 0B C0 A8 .0..@.4.\.L.....
0020: 05 33 00 50 04 D1 A1 65 2D 2F 27 71 AF DF 70 12 .3.P...e-/'q..p.
0030: 16 D0 D7 44 00 00 02 04 05 B4 01 01 04 02 ...D..........

Frame 7 (1514 bytes on wire, 1514 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.172045000
Time delta from previous packet: 0.000241000 seconds
Time since reference or first frame: 4400.796907000 seconds
Frame Number: 7
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: ad.yieldmanager.com (76.13.216.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0x1415 (5141)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xf712 (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Transmission Control Protocol, Src Port: 1232 (1232), Dst Port: http (80), Seq: 1, Ack: 1, Len: 1460
Source port: 1232 (1232)
Destination port: http (80)
Source or Destination Port: 1232
Source or Destination Port: 80
TCP Segment Len: 1460
Sequence number: 1 (relative sequence number)
Next sequence number: 1461 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 17520
Checksum: 0xb300 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 6
The RTT to ACK the segment was: 0.001214000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is a TCP keep-alive segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 7
Hypertext Transfer Protocol
GET /unpixel?id=97008 HTTP/1.1\r\n
Request Method: GET
Accept: */*\r\n
Referer: http://media.adrevolver.com/adrevolver/tra...7\r\n
Accept-Language: en-us\r\n
UA-CPU: x86\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tablet PC 1.7; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\n
Host: ad.yieldmanager.com\r\n
Connection: Keep-Alive\r\n
Cookie: bh="b!!!!H!!*10!!!!%:`j#T!!,_b!!!!#:]Q+[!!,_c!!!!#:]Q+[!!-?2!!!!':`j#T!!-Nk!!!!$:`j#T!!-O3!!!!#:`j#T!!-yu!!!!):`w.p!!.+B!!!!):`w.p!!.gU!!!!#:`j#T!!.iq!!!!$:`j#T!!.tP!!!!':`j#T!!/xg!!!!#:`j#T!!0+@!!!!#:`vFe!!0+B!!!!,:]TO4!!04a!!!!#:
Request: True

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 05 DC 14 15 40 00 80 06 F7 12 C0 A8 05 33 4C 0D ....@........3L.
0020: D8 0B 04 D0 00 50 81 22 2D 24 A1 54 EF 34 50 10 .....P."-$.T.4P.
0030: 44 70 B3 00 00 00 47 45 54 20 2F 75 6E 70 69 78 Dp....GET /unpix
0040: 65 6C 3F 69 64 3D 39 37 30 30 38 20 48 54 54 50 el?id=97008 HTTP
0050: 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 2A 2F /1.1..Accept: */
0060: 2A 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 *..Referer: http
0070: 3A 2F 2F 6D 65 64 69 61 2E 61 64 72 65 76 6F 6C ://media.adrevol
0080: 76 65 72 2E 63 6F 6D 2F 61 64 72 65 76 6F 6C 76 ver.com/adrevolv
0090: 65 72 2F 74 72 61 63 65 3F 73 69 70 3D 31 31 37 er/trace?sip=117
00A0: 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 ..Accept-Languag
00B0: 65 3A 20 65 6E 2D 75 73 0D 0A 55 41 2D 43 50 55 e: en-us..UA-CPU
00C0: 3A 20 78 38 36 0D 0A 41 63 63 65 70 74 2D 45 6E : x86..Accept-En
00D0: 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 coding: gzip, de
00E0: 66 6C 61 74 65 0D 0A 55 73 65 72 2D 41 67 65 6E flate..User-Agen
00F0: 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 t: Mozilla/4.0 (
0100: 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 compatible; MSIE
0110: 20 37 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 7.0; Windows NT
0120: 20 35 2E 31 3B 20 54 61 62 6C 65 74 20 50 43 20 5.1; Tablet PC
0130: 31 2E 37 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 1.7; .NET CLR 1.
0140: 30 2E 33 37 30 35 3B 20 2E 4E 45 54 20 43 4C 52 0.3705; .NET CLR
0150: 20 31 2E 31 2E 34 33 32 32 3B 20 2E 4E 45 54 20 1.1.4322; .NET
0160: 43 4C 52 20 32 2E 30 2E 35 30 37 32 37 3B 20 2E CLR 2.0.50727; .
0170: 4E 45 54 20 43 4C 52 20 33 2E 30 2E 30 34 35 30 NET CLR 3.0.0450
0180: 36 2E 33 30 3B 20 2E 4E 45 54 20 43 4C 52 20 33 6.30; .NET CLR 3
0190: 2E 30 2E 30 34 35 30 36 2E 36 34 38 3B 20 2E 4E .0.04506.648; .N
01A0: 45 54 20 43 4C 52 20 33 2E 30 2E 34 35 30 36 2E ET CLR 3.0.4506.
01B0: 32 31 35 32 3B 20 2E 4E 45 54 20 43 4C 52 20 33 2152; .NET CLR 3
01C0: 2E 35 2E 33 30 37 32 39 29 0D 0A 48 6F 73 74 3A .5.30729)..Host:
01D0: 20 61 64 2E 79 69 65 6C 64 6D 61 6E 61 67 65 72 ad.yieldmanager
01E0: 2E 63 6F 6D 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E .com..Connection
01F0: 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F : Keep-Alive..Co
0200: 6F 6B 69 65 3A 20 62 68 3D 22 62 21 21 21 21 48 okie: bh="b!!!!H
0210: 21 21 2A 31 30 21 21 21 21 25 3A 60 6A 23 54 21 !!*10!!!!%:`j#T!
0220: 21 2C 5F 62 21 21 21 21 23 3A 5D 51 2B 5B 21 21 !,_b!!!!#:]Q+[!!
0230: 2C 5F 63 21 21 21 21 23 3A 5D 51 2B 5B 21 21 2D ,_c!!!!#:]Q+[!!-
0240: 3F 32 21 21 21 21 27 3A 60 6A 23 54 21 21 2D 4E ?2!!!!':`j#T!!-N
0250: 6B 21 21 21 21 24 3A 60 6A 23 54 21 21 2D 4F 33 k!!!!$:`j#T!!-O3
0260: 21 21 21 21 23 3A 60 6A 23 54 21 21 2D 79 75 21 !!!!#:`j#T!!-yu!
0270: 21 21 21 29 3A 60 77 2E 70 21 21 2E 2B 42 21 21 !!!):`w.p!!.+B!!
0280: 21 21 29 3A 60 77 2E 70 21 21 2E 67 55 21 21 21 !!):`w.p!!.gU!!!
0290: 21 23 3A 60 6A 23 54 21 21 2E 69 71 21 21 21 21 !#:`j#T!!.iq!!!!
02A0: 24 3A 60 6A 23 54 21 21 2E 74 50 21 21 21 21 27 $:`j#T!!.tP!!!!'
02B0: 3A 60 6A 23 54 21 21 2F 78 67 21 21 21 21 23 3A :`j#T!!/xg!!!!#:
02C0: 60 6A 23 54 21 21 30 2B 40 21 21 21 21 23 3A 60 `j#T!!0+@!!!!#:`
02D0: 76 46 65 21 21 30 2B 42 21 21 21 21 2C 3A 5D 54 vFe!!0+B!!!!,:]T
02E0: 4F 34 21 21 30 34 61 21 21 21 21 23 3A 60 76 46 O4!!04a!!!!#:`vF
02F0: 65 21 21 30 34 62 21 21 21 21 2C 3A 5D 54 4F 34 e!!04b!!!!,:]TO4
0300: 21 21 30 3D 70 21 21 21 21 2A 3A 5D 54 4F 34 21 !!0=p!!!!*:]TO4!
0310: 21 30 48 3E 7E 7E 21 21 30 75 40 21 21 21 21 23 !0H>~~!!0u@!!!!#
0320: 3A 5D 52 29 6F 21 21 31 25 30 21 21 21 21 23 3A :]R)o!!1%0!!!!#:
0330: 5D 52 28 76 21 21 31 56 2F 21 21 21 21 24 3A 60 ]R(v!!1V/!!!!$:`
0340: 6A 23 54 21 21 33 3A 63 21 21 21 21 23 3A 60 76 j#T!!3:c!!!!#:`v
0350: 44 74 21 21 33 6C 42 21 21 21 21 23 3A 5D 51 2B Dt!!3lB!!!!#:]Q+
0360: 5B 21 21 34 42 25 21 21 21 21 23 3A 5F 25 4E 64 [!!4B%!!!!#:_%Nd
0370: 21 21 34 64 4D 21 21 21 21 23 3A 60 76 44 4C 21 !!4dM!!!!#:`vDL!
0380: 21 39 6C 71 21 21 21 21 27 3A 5F 52 42 4D 21 21 !9lq!!!!':_RBM!!
0390: 3A 2A 40 21 21 21 21 23 3A 61 4F 5B 28 21 21 4A :*@!!!!#:aO[(!!J
03A0: 3E 49 21 21 21 21 25 3A 62 28 27 66 21 21 4C 56 >I!!!!%:b('f!!LV
03B0: 4A 21 21 21 21 24 3A 60 6A 23 54 21 21 4D 68 50 J!!!!$:`j#T!!MhP
03C0: 21 21 21 21 25 3A 62 28 27 66 21 21 4F 4B 50 21 !!!!%:b('f!!OKP!
03D0: 21 21 21 24 3A 5E 44 62 42 21 21 4F 4B 51 21 21 !!!$:^DbB!!OKQ!!
03E0: 21 21 27 3A 62 43 4F 5F 21 21 51 6C 63 21 21 21 !!':bCO_!!Qlc!!!
03F0: 21 25 3A 62 28 27 66 21 21 51 6F 71 21 21 21 21 !%:b('f!!Qoq!!!!
0400: 25 3A 62 28 27 66 21 21 52 5D 4F 21 21 21 21 23 %:b('f!!R]O!!!!#
0410: 3A 62 28 27 66 21 21 52 79 75 21 21 21 21 23 3A :b('f!!Ryu!!!!#:
0420: 5F 6A 2A 64 22 3B 20 75 69 64 3D 75 69 64 3D 37 _j*d"; uid=uid=7
0430: 33 36 63 36 31 30 65 2D 31 38 64 31 2D 31 31 64 36c610e-18d1-11d
0440: 65 2D 62 34 31 61 2D 30 30 31 63 63 34 61 35 62 e-b41a-001cc4a5b
0450: 63 34 32 26 5F 68 6D 61 63 76 3D 31 26 5F 73 61 c42&_hmacv=1&_sa
0460: 6C 74 3D 31 37 34 35 39 32 35 33 35 31 26 5F 6B lt=1745925351&_k
0470: 65 79 69 64 3D 6B 31 26 5F 68 6D 61 63 3D 61 65 eyid=k1&_hmac=ae
0480: 64 38 38 63 37 33 35 31 39 35 39 33 31 63 31 33 d88c735195931c13
0490: 35 64 33 62 31 30 36 65 33 39 38 62 66 39 35 30 5d3b106e398bf950
04A0: 37 37 30 66 61 32 3B 20 69 68 3D 22 62 21 21 21 770fa2; ih="b!!!
04B0: 21 55 21 21 65 2C 44 21 21 21 21 23 3A 5E 53 56 !U!!e,D!!!!#:^SV
04C0: 6F 21 21 66 5A 77 21 21 21 21 23 3A 5E 6E 37 39 o!!fZw!!!!#:^n79
04D0: 21 21 6A 68 71 21 21 21 21 23 3A 60 76 45 62 21 !!jhq!!!!#:`vEb!
04E0: 23 2E 33 68 21 21 21 21 23 3A 5F 25 4E 6E 21 23 #.3h!!!!#:_%Nn!#
04F0: 3D 3D 43 21 21 21 21 23 3A 5F 25 4E 36 21 23 48 ==C!!!!#:_%N6!#H
0500: 46 32 21 21 21 21 24 3A 5E 53 59 32 21 23 4A 6C F2!!!!$:^SY2!#Jl
0510: 24 21 21 21 21 23 3A 5F 25 4E 60 21 23 4D 6D 3E $!!!!#:_%N`!#Mm>
0520: 21 21 21 21 23 3A 60 77 2E 6F 21 23 6B 47 39 21 !!!!#:`w.o!#kG9!
0530: 21 21 21 23 3A 60 76 47 30 21 23 6D 49 29 21 21 !!!#:`vG0!#mI)!!
0540: 21 21 23 3A 5F 25 4E 64 21 23 72 56 38 21 21 21 !!#:_%Nd!#rV8!!!
0550: 21 23 3A 5F 52 6B 35 21 23 72 5D 6A 21 21 21 21 !#:_Rk5!#r]j!!!!
0560: 24 3A 5F 52 66 61 21 23 72 5E 32 21 21 21 21 24 $:_Rfa!#r^2!!!!$
0570: 3A 5F 52 66 63 21 23 72 76 25 21 21 21 21 23 3A :_Rfc!#rv%!!!!#:
0580: 5F 52 6B 37 21 24 28 44 4D 21 21 21 21 23 3A 5F _Rk7!$(DM!!!!#:_
0590: 25 4E 34 21 24 28 5D 50 21 21 21 21 23 3A 5F 52 %N4!$(]P!!!!#:_R
05A0: 65 60 21 24 2B 23 36 21 21 21 21 24 3A 5F 52 6B e`!$+#6!!!!$:_Rk
05B0: 34 21 24 38 4C 47 21 21 21 21 23 3A 5F 52 69 6C 4!$8LG!!!!#:_Ril
05C0: 21 24 49 64 53 21 21 21 21 24 3A 60 76 48 54 21 !$IdS!!!!$:`vHT!
05D0: 24 49 65 24 21 21 21 21 23 3A 60 76 47 4F 21 24 $Ie$!!!!#:`vGO!$
05E0: 4D 30 39 21 21 21 21 23 3A 5F M09!!!!#:_

Frame 8 (1168 bytes on wire, 1168 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.172289000
Time delta from previous packet: 0.000244000 seconds
Time since reference or first frame: 4400.797151000 seconds
Frame Number: 8
Packet Length: 1168 bytes
Capture Length: 1168 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: ad.yieldmanager.com (76.13.216.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1154
Identification: 0x1416 (5142)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xf86b (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Transmission Control Protocol, Src Port: 1232 (1232), Dst Port: http (80), Seq: 1461, Ack: 1, Len: 1114
Source port: 1232 (1232)
Destination port: http (80)
Source or Destination Port: 1232
Source or Destination Port: 80
TCP Segment Len: 1114
Sequence number: 1461 (relative sequence number)
Next sequence number: 2575 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 17520
Checksum: 0x7886 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 7
The RTT to ACK the segment was: 0.000974000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 8
Hypertext Transfer Protocol
Rfe!$M0e!!!!#:_Rfd!$SG'!!!!#:_%No!$VC[!!!!#:b5l7!$]4o!!!!(:^ST<!$]Gl!!!!#:_%Na!$_.M!!!!#:`vE#!$`Fx!!!!#:`cM(!$`GK!!!!#:^STU!$`qx!!!!#:`4av!$a5n!!!!$:`]fK!$dKC!!!!#:_j*b!$huT!!!!#:`vHs!$n1J!!!!':^SUA!$oMv!!!!#:`4bY!$t<K!!!!#:^STj!$w5u!!!!#:
\r\n

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 04 82 14 16 40 00 80 06 F8 6B C0 A8 05 33 4C 0D ....@....k...3L.
0020: D8 0B 04 D0 00 50 81 22 32 D8 A1 54 EF 34 50 18 .....P."2..T.4P.
0030: 44 70 78 86 00 00 52 66 65 21 24 4D 30 65 21 21 Dpx...Rfe!$M0e!!
0040: 21 21 23 3A 5F 52 66 64 21 24 53 47 27 21 21 21 !!#:_Rfd!$SG'!!!
0050: 21 23 3A 5F 25 4E 6F 21 24 56 43 5B 21 21 21 21 !#:_%No!$VC[!!!!
0060: 23 3A 62 35 6C 37 21 24 5D 34 6F 21 21 21 21 28 #:b5l7!$]4o!!!!(
0070: 3A 5E 53 54 3C 21 24 5D 47 6C 21 21 21 21 23 3A :^ST<!$]Gl!!!!#:
0080: 5F 25 4E 61 21 24 5F 2E 4D 21 21 21 21 23 3A 60 _%Na!$_.M!!!!#:`
0090: 76 45 23 21 24 60 46 78 21 21 21 21 23 3A 60 63 vE#!$`Fx!!!!#:`c
00A0: 4D 28 21 24 60 47 4B 21 21 21 21 23 3A 5E 53 54 M(!$`GK!!!!#:^ST
00B0: 55 21 24 60 71 78 21 21 21 21 23 3A 60 34 61 76 U!$`qx!!!!#:`4av
00C0: 21 24 61 35 6E 21 21 21 21 24 3A 60 5D 66 4B 21 !$a5n!!!!$:`]fK!
00D0: 24 64 4B 43 21 21 21 21 23 3A 5F 6A 2A 62 21 24 $dKC!!!!#:_j*b!$
00E0: 68 75 54 21 21 21 21 23 3A 60 76 48 73 21 24 6E huT!!!!#:`vHs!$n
00F0: 31 4A 21 21 21 21 27 3A 5E 53 55 41 21 24 6F 4D 1J!!!!':^SUA!$oM
0100: 76 21 21 21 21 23 3A 60 34 62 59 21 24 74 3C 4B v!!!!#:`4bY!$t<K
0110: 21 21 21 21 23 3A 5E 53 54 6A 21 24 77 35 75 21 !!!!#:^STj!$w5u!
0120: 21 21 21 23 3A 60 63 4D 27 21 24 77 68 48 21 21 !!!#:`cM'!$whH!!
0130: 21 21 23 3A 5E 6E 37 3A 21 25 21 67 2A 21 21 21 !!#:^n7:!%!g*!!!
0140: 21 23 3A 5E 53 54 69 21 25 24 47 57 21 21 21 21 !#:^STi!%$GW!!!!
0150: 23 3A 5E 6E 3C 74 21 25 27 77 47 21 21 21 21 23 #:^n<t!%'wG!!!!#
0160: 3A 5F 52 65 60 21 25 27 79 46 21 21 21 21 24 3A :_Re`!%'yF!!!!$:
0170: 5F 28 3F 2C 21 25 2D 33 37 21 21 21 21 24 3A 60 _(?,!%-37!!!!$:`
0180: 63 58 62 21 25 2D 72 69 21 21 21 21 23 3A 60 76 cXb!%-ri!!!!#:`v
0190: 44 6A 21 25 2D 72 6A 21 21 21 21 2A 3A 60 76 4A Dj!%-rj!!!!*:`vJ
01A0: 41 21 25 2F 77 76 21 21 21 21 24 3A 60 76 4A 5E A!%/wv!!!!$:`vJ^
01B0: 21 25 31 37 49 21 21 21 21 24 3A 60 76 49 78 21 !%17I!!!!$:`vIx!
01C0: 25 37 66 6F 21 21 21 21 23 3A 62 35 6B 69 21 25 %7fo!!!!#:b5ki!%
01D0: 38 65 32 21 21 21 21 23 3A 62 35 6C 2A 22 3B 20 8e2!!!!#:b5l*";
01E0: 70 76 31 3D 22 62 21 21 21 21 2C 21 21 34 3F 21 pv1="b!!!!,!!4?!
01F0: 21 21 23 3D 52 21 21 5B 31 5B 21 24 64 4B 43 21 !!#=R!![1[!$dKC!
0200: 21 72 78 2E 21 21 21 21 24 21 3F 35 25 21 29 48 !rx.!!!!$!?5%!)H
0210: 60 40 3A 21 5A 6D 42 29 21 21 70 5F 6B 21 23 3E `@:!ZmB)!!p_k!#>
0220: 4D 2B 7E 7E 7E 7E 7E 7E 3A 5F 6A 2A 62 3A 64 24 M+~~~~~~:_j*b:d$
0230: 6C 6C 7E 21 21 31 33 74 21 2C 59 2B 40 21 21 5F ll~!!13t!,Y+@!!_
0240: 77 68 21 24 75 24 6B 21 21 74 6F 6B 21 2E 2B 45 wh!$u$k!!tok!.+E
0250: 37 21 23 31 67 2E 29 64 69 3D 3D 21 77 56 64 2E 7!#1g.)di==!wVd.
0260: 21 21 64 5B 32 21 23 28 3E 31 21 23 41 42 43 7E !!d[2!#(>1!#ABC~
0270: 7E 7E 7E 7E 3A 5D 54 4F 56 7E 4D 2E 6A 54 4E 21 ~~~~:]TOV~M.jTN!
0280: 21 2E 39 38 21 2C 59 2B 40 21 21 5F 77 67 21 24 !.98!,Y+@!!_wg!$
0290: 5B 74 4F 21 21 6D 47 46 21 23 3A 6D 31 21 3F 35 [tO!!mGF!#:m1!?5
02A0: 25 21 29 64 69 3D 39 21 77 31 4B 2A 21 21 64 5B %!)di=9!w1K*!!d[
02B0: 32 21 23 2B 56 5B 21 23 36 5A 6A 7E 7E 7E 7E 7E 2!#+V[!#6Zj~~~~~
02C0: 3A 5D 54 3E 49 7E 4D 2E 6A 54 4E 21 21 2F 2D 2D :]T>I~M.jTN!!/--
02D0: 21 2C 59 2B 40 21 21 6D 39 79 21 24 5F 2E 4D 21 !,Y+@!!m9y!$_.M!
02E0: 21 6E 73 62 21 21 6D 54 2D 21 3F 35 25 21 2A 62 !nsb!!mT-!?5%!*b
02F0: 29 6B 40 21 5A 6D 42 29 21 21 4A 30 54 21 23 38 )k@!ZmB)!!J0T!#8
0300: 36 4A 7E 7E 7E 7E 7E 7E 3A 60 76 45 23 3A 61 75 6J~~~~~~:`vE#:au
0310: 2B 3E 4D 2E 6A 54 4E 21 21 30 69 75 21 21 3D 21 +>M.jTN!!0iu!!=!
0320: 58 21 21 3D 79 2B 21 24 28 44 4D 21 21 63 60 6D X!!=y+!$(DM!!c`m
0330: 21 21 21 21 24 21 3F 35 25 21 24 55 2A 34 30 21 !!!!$!?5%!$U*40!
0340: 5B 3A 5A 2D 21 23 3E 4D 6D 21 23 2A 2B 41 7E 7E [:Z-!#>Mm!#*+A~~
0350: 7E 7E 7E 7E 3A 5F 25 4E 34 7E 7E 21 21 52 67 4F ~~~~:_%N4~~!!RgO
0360: 21 2A 3E 47 43 21 21 50 50 52 21 25 27 79 46 21 !*>GC!!PPR!%'yF!
0370: 21 79 25 68 40 3C 56 5F 2B 21 23 31 67 2E 25 52 !y%h@<V_+!#1g.%R
0380: 25 50 34 21 77 56 64 2E 21 21 5F 60 4B 21 21 5F %P4!wVd.!!_`K!!_
0390: 66 5B 21 23 47 49 54 7E 7E 7E 7E 7E 3A 5F 28 3F f[!#GIT~~~~~:_(?
03A0: 2C 3A 63 3C 29 36 21 21 2E 76 4C 21 21 34 5E 21 ,:c<)6!!.vL!!4^!
03B0: 21 2C 59 2B 40 21 21 6D 39 79 21 24 68 75 54 21 !,Y+@!!m9y!$huT!
03C0: 21 70 35 42 21 28 52 5E 5A 21 3F 35 25 21 2A 62 !p5B!(R^Z!?5%!*b
03D0: 29 6B 40 21 5A 6D 42 29 21 21 4A 30 54 21 23 39 )k@!ZmB)!!J0T!#9
03E0: 54 5B 7E 7E 7E 7E 7E 7E 3A 60 76 48 73 3A 61 2B T[~~~~~~:`vHs:a+
03F0: 45 45 4D 2E 6A 54 4E 21 21 52 74 43 21 2C 59 2B EEM.jTN!!RtC!,Y+
0400: 40 21 21 5F 77 67 21 25 2D 33 37 21 23 21 40 76 @!!_wg!%-37!#!@v
0410: 21 21 6D 57 2E 21 3F 35 25 21 25 35 4F 3A 30 21 !!mW.!?5%!%5O:0!
0420: 5A 6D 42 29 21 21 64 5B 32 21 23 49 39 77 7E 7E ZmB)!!d[2!#I9w~~
0430: 7E 7E 7E 7E 3A 60 63 58 62 3A 61 62 40 23 7E 21 ~~~~:`cXb:ab@#~!
0440: 21 30 6E 69 21 2C 59 2B 40 21 21 6D 39 79 21 24 !0ni!,Y+@!!m9y!$
0450: 49 64 53 21 21 6D 46 59 21 28 2D 45 54 21 21 2C IdS!!mFY!(-ET!!,
0460: 29 23 2A 62 29 6B 41 21 5A 6D 42 29 21 21 4A 30 )#*b)kA!ZmB)!!J0
0470: 54 21 23 36 59 28 7E 7E 7E 7E 7E 7E 3A 60 76 48 T!#6Y(~~~~~~:`vH
0480: 54 3A 61 75 2E 6E 4D 2E 6A 54 4E 22 0D 0A 0D 0A T:au.nM.jTN"....

Frame 9 (60 bytes on wire, 60 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.172535000
Time delta from previous packet: 0.000246000 seconds
Time since reference or first frame: 4400.797397000 seconds
Frame Number: 9
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: ad.yieldmanager.com (76.13.216.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x1417 (5143)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xfcc4 (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Transmission Control Protocol, Src Port: 1233 (1233), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
Source port: 1233 (1233)
Destination port: http (80)
Source or Destination Port: 1233
Source or Destination Port: 80
TCP Segment Len: 0
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 17520
Checksum: 0xd668 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 6
The RTT to ACK the segment was: 0.000731000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is an ACK to a TCP keep-alive segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 9

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 00 28 14 17 40 00 80 06 FC C4 C0 A8 05 33 4C 0D .(..@........3L.
0020: D8 0B 04 D1 00 50 27 71 AF DF A1 65 2D 30 50 10 .....P'q...e-0P.
0030: 44 70 D6 68 00 00 00 00 00 00 00 00 Dp.h........

Frame 10 (1514 bytes on wire, 1514 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.173261000
Time delta from previous packet: 0.000726000 seconds
Time since reference or first frame: 4400.798123000 seconds
Frame Number: 10
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: ad.yieldmanager.com (76.13.216.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0x1418 (5144)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xf70f (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Transmission Control Protocol, Src Port: 1233 (1233), Dst Port: http (80), Seq: 1, Ack: 1, Len: 1460
Source port: 1233 (1233)
Destination port: http (80)
Source or Destination Port: 1233
Source or Destination Port: 80
TCP Segment Len: 1460
Sequence number: 1 (relative sequence number)
Next sequence number: 1461 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 17520
Checksum: 0x53e9 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 9
The RTT to ACK the segment was: 0.003651000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 10
Hypertext Transfer Protocol
GET /unpixel?id=97010 HTTP/1.1\r\n
Request Method: GET
Accept: */*\r\n
Referer: http://media.adrevolver.com/adrevolver/tra...6\r\n
Accept-Language: en-us\r\n
UA-CPU: x86\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tablet PC 1.7; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\n
Host: ad.yieldmanager.com\r\n
Connection: Keep-Alive\r\n
Cookie: bh="b!!!!H!!*10!!!!%:`j#T!!,_b!!!!#:]Q+[!!,_c!!!!#:]Q+[!!-?2!!!!':`j#T!!-Nk!!!!$:`j#T!!-O3!!!!#:`j#T!!-yu!!!!):`w.p!!.+B!!!!):`w.p!!.gU!!!!#:`j#T!!.iq!!!!$:`j#T!!.tP!!!!':`j#T!!/xg!!!!#:`j#T!!0+@!!!!#:`vFe!!0+B!!!!,:]TO4!!04a!!!!#:
Request: True

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 05 DC 14 18 40 00 80 06 F7 0F C0 A8 05 33 4C 0D ....@........3L.
0020: D8 0B 04 D1 00 50 27 71 AF DF A1 65 2D 30 50 10 .....P'q...e-0P.
0030: 44 70 53 E9 00 00 47 45 54 20 2F 75 6E 70 69 78 DpS...GET /unpix
0040: 65 6C 3F 69 64 3D 39 37 30 31 30 20 48 54 54 50 el?id=97010 HTTP
0050: 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 2A 2F /1.1..Accept: */
0060: 2A 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 *..Referer: http
0070: 3A 2F 2F 6D 65 64 69 61 2E 61 64 72 65 76 6F 6C ://media.adrevol
0080: 76 65 72 2E 63 6F 6D 2F 61 64 72 65 76 6F 6C 76 ver.com/adrevolv
0090: 65 72 2F 74 72 61 63 65 3F 73 69 70 3D 31 31 36 er/trace?sip=116
00A0: 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 ..Accept-Languag
00B0: 65 3A 20 65 6E 2D 75 73 0D 0A 55 41 2D 43 50 55 e: en-us..UA-CPU
00C0: 3A 20 78 38 36 0D 0A 41 63 63 65 70 74 2D 45 6E : x86..Accept-En
00D0: 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 20 64 65 coding: gzip, de
00E0: 66 6C 61 74 65 0D 0A 55 73 65 72 2D 41 67 65 6E flate..User-Agen
00F0: 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 t: Mozilla/4.0 (
0100: 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 compatible; MSIE
0110: 20 37 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 7.0; Windows NT
0120: 20 35 2E 31 3B 20 54 61 62 6C 65 74 20 50 43 20 5.1; Tablet PC
0130: 31 2E 37 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 1.7; .NET CLR 1.
0140: 30 2E 33 37 30 35 3B 20 2E 4E 45 54 20 43 4C 52 0.3705; .NET CLR
0150: 20 31 2E 31 2E 34 33 32 32 3B 20 2E 4E 45 54 20 1.1.4322; .NET
0160: 43 4C 52 20 32 2E 30 2E 35 30 37 32 37 3B 20 2E CLR 2.0.50727; .
0170: 4E 45 54 20 43 4C 52 20 33 2E 30 2E 30 34 35 30 NET CLR 3.0.0450
0180: 36 2E 33 30 3B 20 2E 4E 45 54 20 43 4C 52 20 33 6.30; .NET CLR 3
0190: 2E 30 2E 30 34 35 30 36 2E 36 34 38 3B 20 2E 4E .0.04506.648; .N
01A0: 45 54 20 43 4C 52 20 33 2E 30 2E 34 35 30 36 2E ET CLR 3.0.4506.
01B0: 32 31 35 32 3B 20 2E 4E 45 54 20 43 4C 52 20 33 2152; .NET CLR 3
01C0: 2E 35 2E 33 30 37 32 39 29 0D 0A 48 6F 73 74 3A .5.30729)..Host:
01D0: 20 61 64 2E 79 69 65 6C 64 6D 61 6E 61 67 65 72 ad.yieldmanager
01E0: 2E 63 6F 6D 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E .com..Connection
01F0: 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F : Keep-Alive..Co
0200: 6F 6B 69 65 3A 20 62 68 3D 22 62 21 21 21 21 48 okie: bh="b!!!!H
0210: 21 21 2A 31 30 21 21 21 21 25 3A 60 6A 23 54 21 !!*10!!!!%:`j#T!
0220: 21 2C 5F 62 21 21 21 21 23 3A 5D 51 2B 5B 21 21 !,_b!!!!#:]Q+[!!
0230: 2C 5F 63 21 21 21 21 23 3A 5D 51 2B 5B 21 21 2D ,_c!!!!#:]Q+[!!-
0240: 3F 32 21 21 21 21 27 3A 60 6A 23 54 21 21 2D 4E ?2!!!!':`j#T!!-N
0250: 6B 21 21 21 21 24 3A 60 6A 23 54 21 21 2D 4F 33 k!!!!$:`j#T!!-O3
0260: 21 21 21 21 23 3A 60 6A 23 54 21 21 2D 79 75 21 !!!!#:`j#T!!-yu!
0270: 21 21 21 29 3A 60 77 2E 70 21 21 2E 2B 42 21 21 !!!):`w.p!!.+B!!
0280: 21 21 29 3A 60 77 2E 70 21 21 2E 67 55 21 21 21 !!):`w.p!!.gU!!!
0290: 21 23 3A 60 6A 23 54 21 21 2E 69 71 21 21 21 21 !#:`j#T!!.iq!!!!
02A0: 24 3A 60 6A 23 54 21 21 2E 74 50 21 21 21 21 27 $:`j#T!!.tP!!!!'
02B0: 3A 60 6A 23 54 21 21 2F 78 67 21 21 21 21 23 3A :`j#T!!/xg!!!!#:
02C0: 60 6A 23 54 21 21 30 2B 40 21 21 21 21 23 3A 60 `j#T!!0+@!!!!#:`
02D0: 76 46 65 21 21 30 2B 42 21 21 21 21 2C 3A 5D 54 vFe!!0+B!!!!,:]T
02E0: 4F 34 21 21 30 34 61 21 21 21 21 23 3A 60 76 46 O4!!04a!!!!#:`vF
02F0: 65 21 21 30 34 62 21 21 21 21 2C 3A 5D 54 4F 34 e!!04b!!!!,:]TO4
0300: 21 21 30 3D 70 21 21 21 21 2A 3A 5D 54 4F 34 21 !!0=p!!!!*:]TO4!
0310: 21 30 48 3E 7E 7E 21 21 30 75 40 21 21 21 21 23 !0H>~~!!0u@!!!!#
0320: 3A 5D 52 29 6F 21 21 31 25 30 21 21 21 21 23 3A :]R)o!!1%0!!!!#:
0330: 5D 52 28 76 21 21 31 56 2F 21 21 21 21 24 3A 60 ]R(v!!1V/!!!!$:`
0340: 6A 23 54 21 21 33 3A 63 21 21 21 21 23 3A 60 76 j#T!!3:c!!!!#:`v
0350: 44 74 21 21 33 6C 42 21 21 21 21 23 3A 5D 51 2B Dt!!3lB!!!!#:]Q+
0360: 5B 21 21 34 42 25 21 21 21 21 23 3A 5F 25 4E 64 [!!4B%!!!!#:_%Nd
0370: 21 21 34 64 4D 21 21 21 21 23 3A 60 76 44 4C 21 !!4dM!!!!#:`vDL!
0380: 21 39 6C 71 21 21 21 21 27 3A 5F 52 42 4D 21 21 !9lq!!!!':_RBM!!
0390: 3A 2A 40 21 21 21 21 23 3A 61 4F 5B 28 21 21 4A :*@!!!!#:aO[(!!J
03A0: 3E 49 21 21 21 21 25 3A 62 28 27 66 21 21 4C 56 >I!!!!%:b('f!!LV
03B0: 4A 21 21 21 21 24 3A 60 6A 23 54 21 21 4D 68 50 J!!!!$:`j#T!!MhP
03C0: 21 21 21 21 25 3A 62 28 27 66 21 21 4F 4B 50 21 !!!!%:b('f!!OKP!
03D0: 21 21 21 24 3A 5E 44 62 42 21 21 4F 4B 51 21 21 !!!$:^DbB!!OKQ!!
03E0: 21 21 27 3A 62 43 4F 5F 21 21 51 6C 63 21 21 21 !!':bCO_!!Qlc!!!
03F0: 21 25 3A 62 28 27 66 21 21 51 6F 71 21 21 21 21 !%:b('f!!Qoq!!!!
0400: 25 3A 62 28 27 66 21 21 52 5D 4F 21 21 21 21 23 %:b('f!!R]O!!!!#
0410: 3A 62 28 27 66 21 21 52 79 75 21 21 21 21 23 3A :b('f!!Ryu!!!!#:
0420: 5F 6A 2A 64 22 3B 20 75 69 64 3D 75 69 64 3D 37 _j*d"; uid=uid=7
0430: 33 36 63 36 31 30 65 2D 31 38 64 31 2D 31 31 64 36c610e-18d1-11d
0440: 65 2D 62 34 31 61 2D 30 30 31 63 63 34 61 35 62 e-b41a-001cc4a5b
0450: 63 34 32 26 5F 68 6D 61 63 76 3D 31 26 5F 73 61 c42&_hmacv=1&_sa
0460: 6C 74 3D 31 37 34 35 39 32 35 33 35 31 26 5F 6B lt=1745925351&_k
0470: 65 79 69 64 3D 6B 31 26 5F 68 6D 61 63 3D 61 65 eyid=k1&_hmac=ae
0480: 64 38 38 63 37 33 35 31 39 35 39 33 31 63 31 33 d88c735195931c13
0490: 35 64 33 62 31 30 36 65 33 39 38 62 66 39 35 30 5d3b106e398bf950
04A0: 37 37 30 66 61 32 3B 20 69 68 3D 22 62 21 21 21 770fa2; ih="b!!!
04B0: 21 55 21 21 65 2C 44 21 21 21 21 23 3A 5E 53 56 !U!!e,D!!!!#:^SV
04C0: 6F 21 21 66 5A 77 21 21 21 21 23 3A 5E 6E 37 39 o!!fZw!!!!#:^n79
04D0: 21 21 6A 68 71 21 21 21 21 23 3A 60 76 45 62 21 !!jhq!!!!#:`vEb!
04E0: 23 2E 33 68 21 21 21 21 23 3A 5F 25 4E 6E 21 23 #.3h!!!!#:_%Nn!#
04F0: 3D 3D 43 21 21 21 21 23 3A 5F 25 4E 36 21 23 48 ==C!!!!#:_%N6!#H
0500: 46 32 21 21 21 21 24 3A 5E 53 59 32 21 23 4A 6C F2!!!!$:^SY2!#Jl
0510: 24 21 21 21 21 23 3A 5F 25 4E 60 21 23 4D 6D 3E $!!!!#:_%N`!#Mm>
0520: 21 21 21 21 23 3A 60 77 2E 6F 21 23 6B 47 39 21 !!!!#:`w.o!#kG9!
0530: 21 21 21 23 3A 60 76 47 30 21 23 6D 49 29 21 21 !!!#:`vG0!#mI)!!
0540: 21 21 23 3A 5F 25 4E 64 21 23 72 56 38 21 21 21 !!#:_%Nd!#rV8!!!
0550: 21 23 3A 5F 52 6B 35 21 23 72 5D 6A 21 21 21 21 !#:_Rk5!#r]j!!!!
0560: 24 3A 5F 52 66 61 21 23 72 5E 32 21 21 21 21 24 $:_Rfa!#r^2!!!!$
0570: 3A 5F 52 66 63 21 23 72 76 25 21 21 21 21 23 3A :_Rfc!#rv%!!!!#:
0580: 5F 52 6B 37 21 24 28 44 4D 21 21 21 21 23 3A 5F _Rk7!$(DM!!!!#:_
0590: 25 4E 34 21 24 28 5D 50 21 21 21 21 23 3A 5F 52 %N4!$(]P!!!!#:_R
05A0: 65 60 21 24 2B 23 36 21 21 21 21 24 3A 5F 52 6B e`!$+#6!!!!$:_Rk
05B0: 34 21 24 38 4C 47 21 21 21 21 23 3A 5F 52 69 6C 4!$8LG!!!!#:_Ril
05C0: 21 24 49 64 53 21 21 21 21 24 3A 60 76 48 54 21 !$IdS!!!!$:`vHT!
05D0: 24 49 65 24 21 21 21 21 23 3A 60 76 47 4F 21 24 $Ie$!!!!#:`vGO!$
05E0: 4D 30 39 21 21 21 21 23 3A 5F M09!!!!#:_

Frame 11 (1168 bytes on wire, 1168 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.173507000
Time delta from previous packet: 0.000246000 seconds
Time since reference or first frame: 4400.798369000 seconds
Frame Number: 11
Packet Length: 1168 bytes
Capture Length: 1168 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: ad.yieldmanager.com (76.13.216.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1154
Identification: 0x1419 (5145)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xf868 (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Transmission Control Protocol, Src Port: 1233 (1233), Dst Port: http (80), Seq: 1461, Ack: 1, Len: 1114
Source port: 1233 (1233)
Destination port: http (80)
Source or Destination Port: 1233
Source or Destination Port: 80
TCP Segment Len: 1114
Sequence number: 1461 (relative sequence number)
Next sequence number: 2575 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 17520
Checksum: 0x116f (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 10
The RTT to ACK the segment was: 0.065410000 seconds
TCP Analysis Flags
This frame is a (suspected) retransmission
This frame is a (suspected) out-of-order segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 11
Hypertext Transfer Protocol
Rfe!$M0e!!!!#:_Rfd!$SG'!!!!#:_%No!$VC[!!!!#:b5l7!$]4o!!!!(:^ST<!$]Gl!!!!#:_%Na!$_.M!!!!#:`vE#!$`Fx!!!!#:`cM(!$`GK!!!!#:^STU!$`qx!!!!#:`4av!$a5n!!!!$:`]fK!$dKC!!!!#:_j*b!$huT!!!!#:`vHs!$n1J!!!!':^SUA!$oMv!!!!#:`4bY!$t<K!!!!#:^STj!$w5u!!!!#:
\r\n

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 04 82 14 19 40 00 80 06 F8 68 C0 A8 05 33 4C 0D ....@....h...3L.
0020: D8 0B 04 D1 00 50 27 71 B5 93 A1 65 2D 30 50 18 .....P'q...e-0P.
0030: 44 70 11 6F 00 00 52 66 65 21 24 4D 30 65 21 21 Dp.o..Rfe!$M0e!!
0040: 21 21 23 3A 5F 52 66 64 21 24 53 47 27 21 21 21 !!#:_Rfd!$SG'!!!
0050: 21 23 3A 5F 25 4E 6F 21 24 56 43 5B 21 21 21 21 !#:_%No!$VC[!!!!
0060: 23 3A 62 35 6C 37 21 24 5D 34 6F 21 21 21 21 28 #:b5l7!$]4o!!!!(
0070: 3A 5E 53 54 3C 21 24 5D 47 6C 21 21 21 21 23 3A :^ST<!$]Gl!!!!#:
0080: 5F 25 4E 61 21 24 5F 2E 4D 21 21 21 21 23 3A 60 _%Na!$_.M!!!!#:`
0090: 76 45 23 21 24 60 46 78 21 21 21 21 23 3A 60 63 vE#!$`Fx!!!!#:`c
00A0: 4D 28 21 24 60 47 4B 21 21 21 21 23 3A 5E 53 54 M(!$`GK!!!!#:^ST
00B0: 55 21 24 60 71 78 21 21 21 21 23 3A 60 34 61 76 U!$`qx!!!!#:`4av
00C0: 21 24 61 35 6E 21 21 21 21 24 3A 60 5D 66 4B 21 !$a5n!!!!$:`]fK!
00D0: 24 64 4B 43 21 21 21 21 23 3A 5F 6A 2A 62 21 24 $dKC!!!!#:_j*b!$
00E0: 68 75 54 21 21 21 21 23 3A 60 76 48 73 21 24 6E huT!!!!#:`vHs!$n
00F0: 31 4A 21 21 21 21 27 3A 5E 53 55 41 21 24 6F 4D 1J!!!!':^SUA!$oM
0100: 76 21 21 21 21 23 3A 60 34 62 59 21 24 74 3C 4B v!!!!#:`4bY!$t<K
0110: 21 21 21 21 23 3A 5E 53 54 6A 21 24 77 35 75 21 !!!!#:^STj!$w5u!
0120: 21 21 21 23 3A 60 63 4D 27 21 24 77 68 48 21 21 !!!#:`cM'!$whH!!
0130: 21 21 23 3A 5E 6E 37 3A 21 25 21 67 2A 21 21 21 !!#:^n7:!%!g*!!!
0140: 21 23 3A 5E 53 54 69 21 25 24 47 57 21 21 21 21 !#:^STi!%$GW!!!!
0150: 23 3A 5E 6E 3C 74 21 25 27 77 47 21 21 21 21 23 #:^n<t!%'wG!!!!#
0160: 3A 5F 52 65 60 21 25 27 79 46 21 21 21 21 24 3A :_Re`!%'yF!!!!$:
0170: 5F 28 3F 2C 21 25 2D 33 37 21 21 21 21 24 3A 60 _(?,!%-37!!!!$:`
0180: 63 58 62 21 25 2D 72 69 21 21 21 21 23 3A 60 76 cXb!%-ri!!!!#:`v
0190: 44 6A 21 25 2D 72 6A 21 21 21 21 2A 3A 60 76 4A Dj!%-rj!!!!*:`vJ
01A0: 41 21 25 2F 77 76 21 21 21 21 24 3A 60 76 4A 5E A!%/wv!!!!$:`vJ^
01B0: 21 25 31 37 49 21 21 21 21 24 3A 60 76 49 78 21 !%17I!!!!$:`vIx!
01C0: 25 37 66 6F 21 21 21 21 23 3A 62 35 6B 69 21 25 %7fo!!!!#:b5ki!%
01D0: 38 65 32 21 21 21 21 23 3A 62 35 6C 2A 22 3B 20 8e2!!!!#:b5l*";
01E0: 70 76 31 3D 22 62 21 21 21 21 2C 21 21 34 3F 21 pv1="b!!!!,!!4?!
01F0: 21 21 23 3D 52 21 21 5B 31 5B 21 24 64 4B 43 21 !!#=R!![1[!$dKC!
0200: 21 72 78 2E 21 21 21 21 24 21 3F 35 25 21 29 48 !rx.!!!!$!?5%!)H
0210: 60 40 3A 21 5A 6D 42 29 21 21 70 5F 6B 21 23 3E `@:!ZmB)!!p_k!#>
0220: 4D 2B 7E 7E 7E 7E 7E 7E 3A 5F 6A 2A 62 3A 64 24 M+~~~~~~:_j*b:d$
0230: 6C 6C 7E 21 21 31 33 74 21 2C 59 2B 40 21 21 5F ll~!!13t!,Y+@!!_
0240: 77 68 21 24 75 24 6B 21 21 74 6F 6B 21 2E 2B 45 wh!$u$k!!tok!.+E
0250: 37 21 23 31 67 2E 29 64 69 3D 3D 21 77 56 64 2E 7!#1g.)di==!wVd.
0260: 21 21 64 5B 32 21 23 28 3E 31 21 23 41 42 43 7E !!d[2!#(>1!#ABC~
0270: 7E 7E 7E 7E 3A 5D 54 4F 56 7E 4D 2E 6A 54 4E 21 ~~~~:]TOV~M.jTN!
0280: 21 2E 39 38 21 2C 59 2B 40 21 21 5F 77 67 21 24 !.98!,Y+@!!_wg!$
0290: 5B 74 4F 21 21 6D 47 46 21 23 3A 6D 31 21 3F 35 [tO!!mGF!#:m1!?5
02A0: 25 21 29 64 69 3D 39 21 77 31 4B 2A 21 21 64 5B %!)di=9!w1K*!!d[
02B0: 32 21 23 2B 56 5B 21 23 36 5A 6A 7E 7E 7E 7E 7E 2!#+V[!#6Zj~~~~~
02C0: 3A 5D 54 3E 49 7E 4D 2E 6A 54 4E 21 21 2F 2D 2D :]T>I~M.jTN!!/--
02D0: 21 2C 59 2B 40 21 21 6D 39 79 21 24 5F 2E 4D 21 !,Y+@!!m9y!$_.M!
02E0: 21 6E 73 62 21 21 6D 54 2D 21 3F 35 25 21 2A 62 !nsb!!mT-!?5%!*b
02F0: 29 6B 40 21 5A 6D 42 29 21 21 4A 30 54 21 23 38 )k@!ZmB)!!J0T!#8
0300: 36 4A 7E 7E 7E 7E 7E 7E 3A 60 76 45 23 3A 61 75 6J~~~~~~:`vE#:au
0310: 2B 3E 4D 2E 6A 54 4E 21 21 30 69 75 21 21 3D 21 +>M.jTN!!0iu!!=!
0320: 58 21 21 3D 79 2B 21 24 28 44 4D 21 21 63 60 6D X!!=y+!$(DM!!c`m
0330: 21 21 21 21 24 21 3F 35 25 21 24 55 2A 34 30 21 !!!!$!?5%!$U*40!
0340: 5B 3A 5A 2D 21 23 3E 4D 6D 21 23 2A 2B 41 7E 7E [:Z-!#>Mm!#*+A~~
0350: 7E 7E 7E 7E 3A 5F 25 4E 34 7E 7E 21 21 52 67 4F ~~~~:_%N4~~!!RgO
0360: 21 2A 3E 47 43 21 21 50 50 52 21 25 27 79 46 21 !*>GC!!PPR!%'yF!
0370: 21 79 25 68 40 3C 56 5F 2B 21 23 31 67 2E 25 52 !y%h@<V_+!#1g.%R
0380: 25 50 34 21 77 56 64 2E 21 21 5F 60 4B 21 21 5F %P4!wVd.!!_`K!!_
0390: 66 5B 21 23 47 49 54 7E 7E 7E 7E 7E 3A 5F 28 3F f[!#GIT~~~~~:_(?
03A0: 2C 3A 63 3C 29 36 21 21 2E 76 4C 21 21 34 5E 21 ,:c<)6!!.vL!!4^!
03B0: 21 2C 59 2B 40 21 21 6D 39 79 21 24 68 75 54 21 !,Y+@!!m9y!$huT!
03C0: 21 70 35 42 21 28 52 5E 5A 21 3F 35 25 21 2A 62 !p5B!(R^Z!?5%!*b
03D0: 29 6B 40 21 5A 6D 42 29 21 21 4A 30 54 21 23 39 )k@!ZmB)!!J0T!#9
03E0: 54 5B 7E 7E 7E 7E 7E 7E 3A 60 76 48 73 3A 61 2B T[~~~~~~:`vHs:a+
03F0: 45 45 4D 2E 6A 54 4E 21 21 52 74 43 21 2C 59 2B EEM.jTN!!RtC!,Y+
0400: 40 21 21 5F 77 67 21 25 2D 33 37 21 23 21 40 76 @!!_wg!%-37!#!@v
0410: 21 21 6D 57 2E 21 3F 35 25 21 25 35 4F 3A 30 21 !!mW.!?5%!%5O:0!
0420: 5A 6D 42 29 21 21 64 5B 32 21 23 49 39 77 7E 7E ZmB)!!d[2!#I9w~~
0430: 7E 7E 7E 7E 3A 60 63 58 62 3A 61 62 40 23 7E 21 ~~~~:`cXb:ab@#~!
0440: 21 30 6E 69 21 2C 59 2B 40 21 21 6D 39 79 21 24 !0ni!,Y+@!!m9y!$
0450: 49 64 53 21 21 6D 46 59 21 28 2D 45 54 21 21 2C IdS!!mFY!(-ET!!,
0460: 29 23 2A 62 29 6B 41 21 5A 6D 42 29 21 21 4A 30 )#*b)kA!ZmB)!!J0
0470: 54 21 23 36 59 28 7E 7E 7E 7E 7E 7E 3A 60 76 48 T!#6Y(~~~~~~:`vH
0480: 54 3A 61 75 2E 6E 4D 2E 6A 54 4E 22 0D 0A 0D 0A T:au.nM.jTN"....

Frame 12 (75 bytes on wire, 75 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.203187000
Time delta from previous packet: 0.029680000 seconds
Time since reference or first frame: 4400.828049000 seconds
Frame Number: 12
Packet Length: 75 bytes
Capture Length: 75 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: dsldns-tx.embarqhsd.net (65.40.202.102)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 61
Identification: 0x141a (5146)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x552c (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: dsldns-tx.embarqhsd.net (65.40.202.102)
Source or Destination Address: dsldns-tx.embarqhsd.net (65.40.202.102)
User Datagram Protocol, Src Port: 51283 (51283), Dst Port: domain (53)
Source port: 51283 (51283)
Destination port: domain (53)
Source or Destination Port: 51283
Source or Destination Port: 53
Length: 41
Checksum: 0xd13e (correct)
Domain Name System (query)
Transaction ID: 0x706d
Flags: 0x0100 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
us.bc.yahoo.com: type A, class inet
Name: us.bc.yahoo.com
Type: Host address
Class: inet

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 00 3D 14 1A 00 00 80 11 55 2C C0 A8 05 33 41 28 .=......U,...3A(
0020: CA 66 C8 53 00 35 00 29 D1 3E 70 6D 01 00 00 01 .f.S.5.).>pm....
0030: 00 00 00 00 00 00 02 75 73 02 62 63 05 79 61 68 .......us.bc.yah
0040: 6F 6F 03 63 6F 6D 00 00 01 00 01 oo.com.....

Frame 13 (974 bytes on wire, 974 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.247444000
Time delta from previous packet: 0.044257000 seconds
Time since reference or first frame: 4400.872306000 seconds
Frame Number: 13
Packet Length: 974 bytes
Capture Length: 974 bytes
Ethernet II, Src: 00:13:49:c8:f2:83, Dst: 00:1b:9e:c9:a8:84
Destination: 00:1b:9e:c9:a8:84 (TABLET.local)
Source: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Type: IP (0x0800)
Internet Protocol, Src Addr: a811.g.akamai.net (76.1.127.169), Dst Addr: TABLET.local (192.168.5.51)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 960
Identification: 0x0c60 (3168)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 56
Protocol: TCP (0x06)
Header checksum: 0xa152 (correct)
Source: a811.g.akamai.net (76.1.127.169)
Source or Destination Address: a811.g.akamai.net (76.1.127.169)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1227 (1227), Seq: 478, Ack: 1457, Len: 920
Source port: http (80)
Destination port: 1227 (1227)
Source or Destination Port: 80
Source or Destination Port: 1227
TCP Segment Len: 920
Sequence number: 478 (relative sequence number)
Next sequence number: 1398 (relative sequence number)
Acknowledgement number: 1457 (relative ack number)
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 8020
Checksum: 0xc755 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 12
The RTT to ACK the segment was: 0.000970000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
Response Code: 200
Server: Apache/2.2.3 (Debian)\r\n
Last-Modified: Wed, 12 Sep 2007 19:38:35 GMT\r\n
ETag: "1e38b-2a-5e1444c0"\r\n
Accept-Ranges: bytes\r\n
Content-Length: 42\r\n
Content-Type: image/gif\r\n
Date: Sun, 29 Mar 2009 05:17:41 GMT\r\n
Connection: keep-alive\r\n
Set-Cookie: B1L2=2-2-6631755EFA755167D2709F116C5F680BBDF5BF7284487E5A1AC70922AE85093C-B3FA62863636393CB697F8A2D99F0A40C62887AD2DE308EC9A9AC086EDBB5BD0; expires=Sun, 26-Apr-2009 05:17:41 GMT; path=/; domain=dynamic.media.adrevolver.com\r\n
Set-Cookie: B1L2S=1; expires=Sun, 03-May-2009 05:17:41 GMT; path=/; domain=dynamic.media.adrevolver.com\r\n
Set-Cookie: BLAK=,D54D0378F63CADDC8B8288F901D6422D; expires=Sun, 12-Apr-2009 05:17:41 GMT; path=/; domain=adrevolver.com\r\n
Set-Cookie: BLAKR=1; expires=Sun, 29-Mar-2009 11:17:41 GMT; path=/; domain=dynamic.media.adrevolver.com\r\n
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"\r\n
\r\n
Response: True
Compuserve GIF, Version: GIF89a
Version: GIF89a
Screen width: 1
Screen height: 1
Global settings: (Global color table present) (1 bit per color) (1 bit per pixel)
1... .... = Global color map is present: True (1)
.000 .... = Bits per color minus 1: 0
.... 0... = Global color map is ordered: False (0)
.... .000 = Image bits per pixel minus 1: 0
Background color index: 0
Global color map: 000000FFFFFF
Extension: Graphics Control
Extension label: Graphics Control (0xf9)
Data block (length = 4)
Data block (length = 0)
Image
Image left position: 0
Image top position: 0
Image width: 1
Image height: 1
Local settings: (5 bits per color) (1 bit per pixel)
0... .... = Local color map is present: False (0)
.100 .... = Bits per color minus 1: 4
.... 0... = Local color map is ordered: False (0)
.... .000 = Image bits per pixel minus 1: 0
LZW minimum code size: 2
Data block (length = 1)
Data block (length = 0)
Trailer (End of the GIF stream)

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 03 C0 0C 60 40 00 38 06 A1 52 4C 01 7F A9 C0 A8 ...`@.8..RL.....
0020: 05 33 00 50 04 CB D4 42 94 9F 6C 5F CE 03 50 18 .3.P...B..l_..P.
0030: 1F 54 C7 55 00 00 48 54 54 50 2F 31 2E 31 20 32 .T.U..HTTP/1.1 2
0040: 30 30 20 4F 4B 0D 0A 53 65 72 76 65 72 3A 20 41 00 OK..Server: A
0050: 70 61 63 68 65 2F 32 2E 32 2E 33 20 28 44 65 62 pache/2.2.3 (Deb
0060: 69 61 6E 29 0D 0A 4C 61 73 74 2D 4D 6F 64 69 66 ian)..Last-Modif
0070: 69 65 64 3A 20 57 65 64 2C 20 31 32 20 53 65 70 ied: Wed, 12 Sep
0080: 20 32 30 30 37 20 31 39 3A 33 38 3A 33 35 20 47 2007 19:38:35 G
0090: 4D 54 0D 0A 45 54 61 67 3A 20 22 31 65 33 38 62 MT..ETag: "1e38b
00A0: 2D 32 61 2D 35 65 31 34 34 34 63 30 22 0D 0A 41 -2a-5e1444c0"..A
00B0: 63 63 65 70 74 2D 52 61 6E 67 65 73 3A 20 62 79 ccept-Ranges: by
00C0: 74 65 73 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E tes..Content-Len
00D0: 67 74 68 3A 20 34 32 0D 0A 43 6F 6E 74 65 6E 74 gth: 42..Content
00E0: 2D 54 79 70 65 3A 20 69 6D 61 67 65 2F 67 69 66 -Type: image/gif
00F0: 0D 0A 44 61 74 65 3A 20 53 75 6E 2C 20 32 39 20 ..Date: Sun, 29
0100: 4D 61 72 20 32 30 30 39 20 30 35 3A 31 37 3A 34 Mar 2009 05:17:4
0110: 31 20 47 4D 54 0D 0A 43 6F 6E 6E 65 63 74 69 6F 1 GMT..Connectio
0120: 6E 3A 20 6B 65 65 70 2D 61 6C 69 76 65 0D 0A 53 n: keep-alive..S
0130: 65 74 2D 43 6F 6F 6B 69 65 3A 20 42 31 4C 32 3D et-Cookie: B1L2=
0140: 32 2D 32 2D 36 36 33 31 37 35 35 45 46 41 37 35 2-2-6631755EFA75
0150: 35 31 36 37 44 32 37 30 39 46 31 31 36 43 35 46 5167D2709F116C5F
0160: 36 38 30 42 42 44 46 35 42 46 37 32 38 34 34 38 680BBDF5BF728448
0170: 37 45 35 41 31 41 43 37 30 39 32 32 41 45 38 35 7E5A1AC70922AE85
0180: 30 39 33 43 2D 42 33 46 41 36 32 38 36 33 36 33 093C-B3FA6286363
0190: 36 33 39 33 43 42 36 39 37 46 38 41 32 44 39 39 6393CB697F8A2D99
01A0: 46 30 41 34 30 43 36 32 38 38 37 41 44 32 44 45 F0A40C62887AD2DE
01B0: 33 30 38 45 43 39 41 39 41 43 30 38 36 45 44 42 308EC9A9AC086EDB
01C0: 42 35 42 44 30 3B 20 65 78 70 69 72 65 73 3D 53 B5BD0; expires=S
01D0: 75 6E 2C 20 32 36 2D 41 70 72 2D 32 30 30 39 20 un, 26-Apr-2009
01E0: 30 35 3A 31 37 3A 34 31 20 47 4D 54 3B 20 70 61 05:17:41 GMT; pa
01F0: 74 68 3D 2F 3B 20 64 6F 6D 61 69 6E 3D 64 79 6E th=/; domain=dyn
0200: 61 6D 69 63 2E 6D 65 64 69 61 2E 61 64 72 65 76 amic.media.adrev
0210: 6F 6C 76 65 72 2E 63 6F 6D 0D 0A 53 65 74 2D 43 olver.com..Set-C
0220: 6F 6F 6B 69 65 3A 20 42 31 4C 32 53 3D 31 3B 20 ookie: B1L2S=1;
0230: 65 78 70 69 72 65 73 3D 53 75 6E 2C 20 30 33 2D expires=Sun, 03-
0240: 4D 61 79 2D 32 30 30 39 20 30 35 3A 31 37 3A 34 May-2009 05:17:4
0250: 31 20 47 4D 54 3B 20 70 61 74 68 3D 2F 3B 20 64 1 GMT; path=/; d
0260: 6F 6D 61 69 6E 3D 64 79 6E 61 6D 69 63 2E 6D 65 omain=dynamic.me
0270: 64 69 61 2E 61 64 72 65 76 6F 6C 76 65 72 2E 63 dia.adrevolver.c
0280: 6F 6D 0D 0A 53 65 74 2D 43 6F 6F 6B 69 65 3A 20 om..Set-Cookie:
0290: 42 4C 41 4B 3D 2C 44 35 34 44 30 33 37 38 46 36 BLAK=,D54D0378F6
02A0: 33 43 41 44 44 43 38 42 38 32 38 38 46 39 30 31 3CADDC8B8288F901
02B0: 44 36 34 32 32 44 3B 20 65 78 70 69 72 65 73 3D D6422D; expires=
02C0: 53 75 6E 2C 20 31 32 2D 41 70 72 2D 32 30 30 39 Sun, 12-Apr-2009
02D0: 20 30 35 3A 31 37 3A 34 31 20 47 4D 54 3B 20 70 05:17:41 GMT; p
02E0: 61 74 68 3D 2F 3B 20 64 6F 6D 61 69 6E 3D 61 64 ath=/; domain=ad
02F0: 72 65 76 6F 6C 76 65 72 2E 63 6F 6D 0D 0A 53 65 revolver.com..Se
0300: 74 2D 43 6F 6F 6B 69 65 3A 20 42 4C 41 4B 52 3D t-Cookie: BLAKR=
0310: 31 3B 20 65 78 70 69 72 65 73 3D 53 75 6E 2C 20 1; expires=Sun,
0320: 32 39 2D 4D 61 72 2D 32 30 30 39 20 31 31 3A 31 29-Mar-2009 11:1
0330: 37 3A 34 31 20 47 4D 54 3B 20 70 61 74 68 3D 2F 7:41 GMT; path=/
0340: 3B 20 64 6F 6D 61 69 6E 3D 64 79 6E 61 6D 69 63 ; domain=dynamic
0350: 2E 6D 65 64 69 61 2E 61 64 72 65 76 6F 6C 76 65 .media.adrevolve
0360: 72 2E 63 6F 6D 0D 0A 50 33 50 3A 20 43 50 3D 22 r.com..P3P: CP="
0370: 4E 4F 4E 20 44 53 50 20 41 44 4D 20 44 45 56 20 NON DSP ADM DEV
0380: 50 53 44 20 4F 55 52 20 49 4E 44 20 53 54 50 20 PSD OUR IND STP
0390: 50 48 59 20 50 52 45 20 4E 41 56 20 55 4E 49 22 PHY PRE NAV UNI"
03A0: 0D 0A 0D 0A 47 49 46 38 39 61 01 00 01 00 80 00 ....GIF89a......
03B0: 00 00 00 00 FF FF FF 21 F9 04 01 00 00 00 00 2C .......!.......,
03C0: 00 00 00 00 01 00 01 00 40 02 01 44 00 3B ........@..D.;

Frame 14 (60 bytes on wire, 60 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.277841000
Time delta from previous packet: 0.030397000 seconds
Time since reference or first frame: 4400.902703000 seconds
Frame Number: 14
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:13:49:c8:f2:83, Dst: 00:1b:9e:c9:a8:84
Destination: 00:1b:9e:c9:a8:84 (TABLET.local)
Source: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: ad.yieldmanager.com (76.13.216.11), Dst Addr: TABLET.local (192.168.5.51)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xe20e (57870)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 51
Protocol: TCP (0x06)
Header checksum: 0x7bcd (correct)
Source: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1232 (1232), Seq: 1, Ack: 1461, Len: 0
Source port: http (80)
Destination port: 1232 (1232)
Source or Destination Port: 80
Source or Destination Port: 1232
TCP Segment Len: 0
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1461 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 8760
Checksum: 0x5a04 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 13
The RTT to ACK the segment was: 0.117723000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 00 28 E2 0E 40 00 33 06 7B CD 4C 0D D8 0B C0 A8 .(..@.3.{.L.....
0020: 05 33 00 50 04 D0 A1 54 EF 34 81 22 32 D8 50 10 .3.P...T.4."2.P.
0030: 22 38 5A 04 00 00 00 00 00 00 00 00 "8Z.........

Frame 15 (60 bytes on wire, 60 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.284649000
Time delta from previous packet: 0.006808000 seconds
Time since reference or first frame: 4400.909511000 seconds
Frame Number: 15
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:1b:9e:c9:a8:84, Dst: 00:13:49:c8:f2:83
Destination: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: TABLET.local (192.168.5.51), Dst Addr: a134.g.akamai.net (76.1.127.170)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x141f (5151)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0x552a (correct)
Source: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Destination: a134.g.akamai.net (76.1.127.170)
Source or Destination Address: a134.g.akamai.net (76.1.127.170)
Transmission Control Protocol, Src Port: 1229 (1229), Dst Port: http (80), Seq: 773, Ack: 752, Len: 0
Source port: 1229 (1229)
Destination port: http (80)
Source or Destination Port: 1229
Source or Destination Port: 80
TCP Segment Len: 0
Sequence number: 773 (relative sequence number)
Acknowledgement number: 752 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 16769
Checksum: 0x07df (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 14
The RTT to ACK the segment was: 0.070537000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 4805

0000: 00 13 49 C8 F2 83 00 1B 9E C9 A8 84 08 00 45 00 ..I...........E.
0010: 00 28 14 1F 40 00 80 06 55 2A C0 A8 05 33 4C 01 .(..@...U*...3L.
0020: 7F AA 04 CD 00 50 49 F6 7B 19 D3 EC 36 D4 50 10 .....PI.{...6.P.
0030: 41 81 07 DF 00 00 00 00 00 00 00 00 A...........

Frame 16 (60 bytes on wire, 60 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.296320000
Time delta from previous packet: 0.011671000 seconds
Time since reference or first frame: 4400.921182000 seconds
Frame Number: 16
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:13:49:c8:f2:83, Dst: 00:1b:9e:c9:a8:84
Destination: 00:1b:9e:c9:a8:84 (TABLET.local)
Source: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: ad.yieldmanager.com (76.13.216.11), Dst Addr: TABLET.local (192.168.5.51)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xe210 (57872)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 51
Protocol: TCP (0x06)
Header checksum: 0x7bcb (correct)
Source: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1232 (1232), Seq: 1, Ack: 2575, Len: 0
Source port: http (80)
Destination port: 1232 (1232)
Source or Destination Port: 80
Source or Destination Port: 1232
TCP Segment Len: 0
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2575 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 11680
Checksum: 0x4a42 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 15
The RTT to ACK the segment was: 0.000004000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 00 28 E2 10 40 00 33 06 7B CB 4C 0D D8 0B C0 A8 .(..@.3.{.L.....
0020: 05 33 00 50 04 D0 A1 54 EF 34 81 22 37 32 50 10 .3.P...T.4."72P.
0030: 2D A0 4A 42 00 00 00 00 00 00 00 00 -.JB........

Frame 17 (1054 bytes on wire, 1054 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.305064000
Time delta from previous packet: 0.008744000 seconds
Time since reference or first frame: 4400.929926000 seconds
Frame Number: 17
Packet Length: 1054 bytes
Capture Length: 1054 bytes
Ethernet II, Src: 00:13:49:c8:f2:83, Dst: 00:1b:9e:c9:a8:84
Destination: 00:1b:9e:c9:a8:84 (TABLET.local)
Source: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Type: IP (0x0800)
Internet Protocol, Src Addr: ad.yieldmanager.com (76.13.216.11), Dst Addr: TABLET.local (192.168.5.51)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1040
Identification: 0xe212 (57874)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 51
Protocol: TCP (0x06)
Header checksum: 0x77e1 (correct)
Source: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1232 (1232), Seq: 1, Ack: 2575, Len: 1000
Source port: http (80)
Destination port: 1232 (1232)
Source or Destination Port: 80
Source or Destination Port: 1232
TCP Segment Len: 1000
Sequence number: 1 (relative sequence number)
Next sequence number: 1001 (relative sequence number)
Acknowledgement number: 2575 (relative ack number)
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 11680
Checksum: 0xf715 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 16
The RTT to ACK the segment was: 0.001216000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
Response Code: 200
Date: Sun, 29 Mar 2009 05:17:41 GMT\r\n
Server: rmas-server-core-lz3/0.9.9.1\r\n
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"\r\n
Set-Cookie: bh="b!!!!H!!*10!!!!%:`j#T!!,_b!!!!#:]Q+[!!,_c!!!!#:]Q+[!!-?2!!!!':`j#T!!-Nk!!!!$:`j#T!!-O3!!!!#:`j#T!!-yu!!!!):`w.p!!.+B!!!!):`w.p!!.gU!!!!#:`j#T!!.iq!!!!$:`j#T!!.tP!!!!':`j#T!!/xg!!!!#:`j#T!!0+@!!!!#:`vFe!!0+B!!!!,:]TO4!!04a!!
Cache-Control: no-store\r\n
Last-Modified: Sun, 29 Mar 2009 05:17:41 GMT\r\n
Pragma: no-cache\r\n
Content-Length: 43\r\n
Content-Type: image/gif\r\n
Connection: close\r\n
\r\n
Response: True
Compuserve GIF, Version: GIF89a
Version: GIF89a
Screen width: 1
Screen height: 1
Global settings: (Global color table present) (1 bit per color) (1 bit per pixel)
1... .... = Global color map is present: True (1)
.000 .... = Bits per color minus 1: 0
.... 0... = Global color map is ordered: False (0)
.... .000 = Image bits per pixel minus 1: 0
Background color index: 255
Global color map: C0C0C0000000
Extension: Graphics Control
Extension label: Graphics Control (0xf9)
Data block (length = 4)
Data block (length = 0)
Image
Image left position: 0
Image top position: 0
Image width: 1
Image height: 1
Local settings: (1 bit per color) (1 bit per pixel)
0... .... = Local color map is present: False (0)
.000 .... = Bits per color minus 1: 0
.... 0... = Local color map is ordered: False (0)
.... .000 = Image bits per pixel minus 1: 0
LZW minimum code size: 2
Data block (length = 2)
Data block (length = 0)
Trailer (End of the GIF stream)

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 04 10 E2 12 40 00 33 06 77 E1 4C 0D D8 0B C0 A8 ....@.3.w.L.....
0020: 05 33 00 50 04 D0 A1 54 EF 34 81 22 37 32 50 18 .3.P...T.4."72P.
0030: 2D A0 F7 15 00 00 48 54 54 50 2F 31 2E 31 20 32 -.....HTTP/1.1 2
0040: 30 30 20 4F 4B 0D 0A 44 61 74 65 3A 20 53 75 6E 00 OK..Date: Sun
0050: 2C 20 32 39 20 4D 61 72 20 32 30 30 39 20 30 35 , 29 Mar 2009 05
0060: 3A 31 37 3A 34 31 20 47 4D 54 0D 0A 53 65 72 76 :17:41 GMT..Serv
0070: 65 72 3A 20 72 6D 61 73 2D 73 65 72 76 65 72 2D er: rmas-server-
0080: 63 6F 72 65 2D 6C 7A 33 2F 30 2E 39 2E 39 2E 31 core-lz3/0.9.9.1
0090: 0D 0A 50 33 50 3A 20 70 6F 6C 69 63 79 72 65 66 ..P3P: policyref
00A0: 3D 22 2F 77 33 63 2F 70 33 70 2E 78 6D 6C 22 2C ="/w3c/p3p.xml",
00B0: 20 43 50 3D 22 4E 4F 49 20 44 53 50 20 43 4F 52 CP="NOI DSP COR
00C0: 20 4E 49 44 20 43 55 52 61 20 41 44 4D 61 20 44 NID CURa ADMa D
00D0: 45 56 61 20 50 53 41 61 20 50 53 44 61 20 4F 55 EVa PSAa PSDa OU
00E0: 52 20 42 55 53 20 43 4F 4D 20 49 4E 54 20 4F 54 R BUS COM INT OT
00F0: 43 20 50 55 52 20 53 54 41 22 0D 0A 53 65 74 2D C PUR STA"..Set-
0100: 43 6F 6F 6B 69 65 3A 20 62 68 3D 22 62 21 21 21 Cookie: bh="b!!!
0110: 21 48 21 21 2A 31 30 21 21 21 21 25 3A 60 6A 23 !H!!*10!!!!%:`j#
0120: 54 21 21 2C 5F 62 21 21 21 21 23 3A 5D 51 2B 5B T!!,_b!!!!#:]Q+[
0130: 21 21 2C 5F 63 21 21 21 21 23 3A 5D 51 2B 5B 21 !!,_c!!!!#:]Q+[!
0140: 21 2D 3F 32 21 21 21 21 27 3A 60 6A 23 54 21 21 !-?2!!!!':`j#T!!
0150: 2D 4E 6B 21 21 21 21 24 3A 60 6A 23 54 21 21 2D -Nk!!!!$:`j#T!!-
0160: 4F 33 21 21 21 21 23 3A 60 6A 23 54 21 21 2D 79 O3!!!!#:`j#T!!-y
0170: 75 21 21 21 21 29 3A 60 77 2E 70 21 21 2E 2B 42 u!!!!):`w.p!!.+B
0180: 21 21 21 21 29 3A 60 77 2E 70 21 21 2E 67 55 21 !!!!):`w.p!!.gU!
0190: 21 21 21 23 3A 60 6A 23 54 21 21 2E 69 71 21 21 !!!#:`j#T!!.iq!!
01A0: 21 21 24 3A 60 6A 23 54 21 21 2E 74 50 21 21 21 !!$:`j#T!!.tP!!!
01B0: 21 27 3A 60 6A 23 54 21 21 2F 78 67 21 21 21 21 !':`j#T!!/xg!!!!
01C0: 23 3A 60 6A 23 54 21 21 30 2B 40 21 21 21 21 23 #:`j#T!!0+@!!!!#
01D0: 3A 60 76 46 65 21 21 30 2B 42 21 21 21 21 2C 3A :`vFe!!0+B!!!!,:
01E0: 5D 54 4F 34 21 21 30 34 61 21 21 21 21 23 3A 60 ]TO4!!04a!!!!#:`
01F0: 76 46 65 21 21 30 34 62 21 21 21 21 2C 3A 5D 54 vFe!!04b!!!!,:]T
0200: 4F 34 21 21 30 3D 70 21 21 21 21 2A 3A 5D 54 4F O4!!0=p!!!!*:]TO
0210: 34 21 21 30 48 3A 7E 7E 21 21 30 75 40 21 21 21 4!!0H:~~!!0u@!!!
0220: 21 23 3A 5D 52 29 6F 21 21 31 25 30 21 21 21 21 !#:]R)o!!1%0!!!!
0230: 23 3A 5D 52 28 76 21 21 31 56 2F 21 21 21 21 24 #:]R(v!!1V/!!!!$
0240: 3A 60 6A 23 54 21 21 33 3A 63 21 21 21 21 23 3A :`j#T!!3:c!!!!#:
0250: 60 76 44 74 21 21 33 6C 42 21 21 21 21 23 3A 5D `vDt!!3lB!!!!#:]
0260: 51 2B 5B 21 21 34 42 25 21 21 21 21 23 3A 5F 25 Q+[!!4B%!!!!#:_%
0270: 4E 64 21 21 34 64 4D 21 21 21 21 23 3A 60 76 44 Nd!!4dM!!!!#:`vD
0280: 4C 21 21 39 6C 71 21 21 21 21 27 3A 5F 52 42 4D L!!9lq!!!!':_RBM
0290: 21 21 3A 2A 40 21 21 21 21 23 3A 61 4F 5B 28 21 !!:*@!!!!#:aO[(!
02A0: 21 4A 3E 49 21 21 21 21 25 3A 62 28 27 66 21 21 !J>I!!!!%:b('f!!
02B0: 4C 56 4A 21 21 21 21 24 3A 60 6A 23 54 21 21 4D LVJ!!!!$:`j#T!!M
02C0: 68 50 21 21 21 21 25 3A 62 28 27 66 21 21 4F 4B hP!!!!%:b('f!!OK
02D0: 50 21 21 21 21 24 3A 5E 44 62 42 21 21 4F 4B 51 P!!!!$:^DbB!!OKQ
02E0: 21 21 21 21 27 3A 62 43 4F 5F 21 21 51 6C 63 21 !!!!':bCO_!!Qlc!
02F0: 21 21 21 25 3A 62 28 27 66 21 21 51 6F 71 21 21 !!!%:b('f!!Qoq!!
0300: 21 21 25 3A 62 28 27 66 21 21 52 5D 4F 21 21 21 !!%:b('f!!R]O!!!
0310: 21 23 3A 62 28 27 66 21 21 52 79 75 21 21 21 21 !#:b('f!!Ryu!!!!
0320: 23 3A 5F 6A 2A 64 22 3B 20 70 61 74 68 3D 2F 3B #:_j*d"; path=/;
0330: 20 65 78 70 69 72 65 73 3D 54 75 65 2C 20 32 39 expires=Tue, 29
0340: 2D 4D 61 72 2D 32 30 31 31 20 30 35 3A 31 37 3A -Mar-2011 05:17:
0350: 34 31 20 47 4D 54 0D 0A 43 61 63 68 65 2D 43 6F 41 GMT..Cache-Co
0360: 6E 74 72 6F 6C 3A 20 6E 6F 2D 73 74 6F 72 65 0D ntrol: no-store.
0370: 0A 4C 61 73 74 2D 4D 6F 64 69 66 69 65 64 3A 20 .Last-Modified:
0380: 53 75 6E 2C 20 32 39 20 4D 61 72 20 32 30 30 39 Sun, 29 Mar 2009
0390: 20 30 35 3A 31 37 3A 34 31 20 47 4D 54 0D 0A 50 05:17:41 GMT..P
03A0: 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 63 68 65 0D ragma: no-cache.
03B0: 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A .Content-Length:
03C0: 20 34 33 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 43..Content-Typ
03D0: 65 3A 20 69 6D 61 67 65 2F 67 69 66 0D 0A 43 6F e: image/gif..Co
03E0: 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D nnection: close.
03F0: 0A 0D 0A 47 49 46 38 39 61 01 00 01 00 80 FF 00 ...GIF89a.......
0400: C0 C0 C0 00 00 00 21 F9 04 01 00 00 00 00 2C 00 ......!.......,.
0410: 00 00 00 01 00 01 00 00 02 02 44 01 00 3B ..........D..;

Frame 18 (60 bytes on wire, 60 bytes captured)
Frame is marked: False
Arrival Time: Mar 29, 2009 00:17:48.305548000
Time delta from previous packet: 0.000484000 seconds
Time since reference or first frame: 4400.930410000 seconds
Frame Number: 18
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:13:49:c8:f2:83, Dst: 00:1b:9e:c9:a8:84
Destination: 00:1b:9e:c9:a8:84 (TABLET.local)
Source: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Source or Destination Address: 00:1b:9e:c9:a8:84 (TABLET.local)
Source or Destination Address: 00:13:49:c8:f2:83 (00:13:49:c8:f2:83)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: ad.yieldmanager.com (76.13.216.11), Dst Addr: TABLET.local (192.168.5.51)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xe214 (57876)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 51
Protocol: TCP (0x06)
Header checksum: 0x7bc7 (correct)
Source: ad.yieldmanager.com (76.13.216.11)
Source or Destination Address: ad.yieldmanager.com (76.13.216.11)
Destination: TABLET.local (192.168.5.51)
Source or Destination Address: TABLET.local (192.168.5.51)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1232 (1232), Seq: 1001, Ack: 2575, Len: 0
Source port: http (80)
Destination port: 1232 (1232)
Source or Destination Port: 80
Source or Destination Port: 1232
TCP Segment Len: 0
Sequence number: 1001 (relative sequence number)
Acknowledgement number: 2575 (relative ack number)
Header length: 20 bytes
Flags: 0x0011 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 11680
Checksum: 0x4659 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 10
The RTT to ACK the segment was: 0.102799000 seconds
TCP Analysis Flags
This frame is a (suspected) out-of-order segment

0000: 00 1B 9E C9 A8 84 00 13 49 C8 F2 83 08 00 45 00 ........I.....E.
0010: 00 28 E2 14 40 00 33 06 7B C7 4C 0D D8 0B C0 A8 .(..@.3.{.L.....
0020: 05 33 00 50 04 D0 A1 54 F3 1C 81 22 37 32 50 11 .3.P...T..."72P.
0030: 2D A0 46 59 00 00 00 00 00 00 00 00 -.FY........

BC AdBot (Login to Remove)

 


#2 Jat90

Jat90

  • Members
  • 1,515 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:United Kingdom
  • Local time:07:09 PM

Posted 06 April 2009 - 05:53 PM

Hello,

I apologize for the delay in response, we get overwhelmed at times but we are trying our best to keep up.
If you have since resolved the original problem you were having would appreciate you letting us know. As its been a while since you posted your log, I will need an updated one.

Please take a look at the Preparation Guide for a download link to DDS and instructions on how you should ask for help.

Thanks and again sorry for the delay.
- Jat90 -

If I have not responded to you within 24 hours, then please feel free to send me a message.

Posted Image

#3 Jat90

Jat90

  • Members
  • 1,515 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:United Kingdom
  • Local time:07:09 PM

Posted 11 April 2009 - 05:48 AM

Due to Lack of feedback, this topic is now Closed.

If you need this topic reopened, please send me a message. In your message please include the address of this thread in your request.

This applies only to the original topic starter.

Everyone else please start a new topic.
- Jat90 -

If I have not responded to you within 24 hours, then please feel free to send me a message.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users