I'm getting a crash within a few seconds of launching using SVN 6812 (both
ntopng and nDPI) on Mountain Lion, 10.8.5.
(gdb) run --interface en3 --local-networks
"191.1.1.0/24,10.0.0.0/8,172.16.1.0/24" --dont-change-user --dns-mode 1
--http-port 3000 --data-dir data --callbacks-dir scripts/callbacks
--httpdocs-dir httpdocs --scripts-dir scripts --verbose --dump-flows
tching to process 17104 thread 0x2203]
check_content_type_and_change_protocol (ndpi_struct=0xb06219c0, flow=0x29) at
http.c:608
608 end[0] = '\0';
(gdb) bt
#0 check_content_type_and_change_protocol (ndpi_struct=0xb06219c0, flow=0x29)
at http.c:608
#1 0x00000001000690be in ndpi_search_http_tcp (ndpi_struct=0x852a00,
flow=0x2aafa00) at http.c:891
#2 0x000000010005b5f2 in ndpi_detection_process_packet (ndpi_struct=0x852a00,
flow=0x2aafa00, packet=0x0, current_tick=2959218832, src=0x1bb, dst=0x31767d0,
packetlen=41) at ndpi_main.c:3956
#3 0x000000010003f961 in NetworkInterface::packet_processing (this=0x810c00,
when=1380127167, time=1380127167349, eth=0x73a422, vlan_id=0, iph=0x73a430,
ip6=0x0, ipsize=1180, rawsize=1194) at NetworkInterface.cpp:357
#4 0x00000001000400df in NetworkInterface::packet_dissector (this=0x810c00,
h=0xb0621dc0, packet=0x73a422 "") at NetworkInterface.cpp:491
#5 0x0000000100046bd7 in packetPollLoop (ptr=0x810c00) at PcapInterface.cpp:86
#6 0x00007fff8d5ec772 in _pthread_start ()
#7 0x00007fff8d5d91a1 in thread_start ()
Current language: auto; currently c
(gdb) f 0
#0 check_content_type_and_change_protocol (ndpi_struct=0xb06219c0, flow=0x29)
at http.c:608
608 end[0] = '\0';
(gdb) f 1
#1 0x00000001000690be in ndpi_search_http_tcp (ndpi_struct=0x852a00,
flow=0x2aafa00) at http.c:891
891 check_content_type_and_change_protocol(ndpi_struct, flow);
(gdb) f 0
#0 check_content_type_and_change_protocol (ndpi_struct=0xb06219c0, flow=0x29)
at http.c:608
608 end[0] = '\0';
(gdb) p flow
$3 = (struct ndpi_flow_struct *) 0x29
(gdb) p *flow
Cannot access memory at address 0x29
(gdb) f 1
#1 0x00000001000690be in ndpi_search_http_tcp (ndpi_struct=0x852a00,
flow=0x2aafa00) at http.c:891
891 check_content_type_and_change_protocol(ndpi_struct, flow);
(gdb) p *flow
$4 = {
detected_protocol_stack = {7, 0, 0},
protocol_stack_info = {
entry_is_real_protocol = 1 '\001',
current_stack_size_minus_one = 1 '\001'
},
init_finished = 1 '\001',
setup_packet_direction = 0 '\0',
next_tcp_seq_nr = {2032705124, 1107734057},
l4 = {
tcp = {
flash_bytes = 0,
smtp_command_bitmask = 0,
pop_command_bitmask = 0,
qq_nxt_len = 0,
tds_login_version = 0 '\0',
pplive_next_packet_size = "\000",
irc_stage = 0 '\0',
irc_port = 0 '\0',
gnutella_msg_id = "\000\000",
edk_ext = 0,
irc_3a_counter = 0,
irc_stage2 = 0,
irc_direction = 0,
irc_0x1000_full = 0,
winmx_stage = 0,
soulseek_stage = 0,
filetopia_stage = 0,
tds_stage = 0,
usenet_stage = 0,
imesh_stage = 0,
ftp_codes_seen = 0,
ftp_client_direction = 0,
http_setup_dir = 1,
http_stage = 0,
http_empty_line_seen = 0,
http_wait_for_retransmission = 0,
flash_stage = 0,
gnutella_stage = 0,
mms_stage = 0,
yahoo_sip_comm = 0,
yahoo_http_proxy_stage = 0,
msn_stage = 0,
msn_ssl_ft = 0,
ssh_stage = 0,
vnc_stage = 0,
steam_stage = 0,
telnet_stage = 0,
ssl_stage = 0 '\0',
ssl_seen_client_cert = 0 '\0',
ssl_seen_server_cert = 0 '\0',
postgres_stage = 0,
ddlink_server_direction = 0,
seen_syn = 1,
seen_syn_ack = 1,
seen_ack = 1,
icecast_stage = 0,
dofus_stage = 0,
fiesta_stage = 0,
wow_stage = 0,
veoh_tv_stage = 0,
shoutcast_stage = 0,
rtp_special_packets_seen = 0,
mail_pop_stage = 0,
mail_imap_stage = 0,
skype_packet_id = 0 '\0',
citrix_packet_id = 0 '\0',
lotus_notes_packet_id = 0 '\0',
teamviewer_stage = 0 '\0'
},
udp = {
battlefield_msg_id = 0,
snmp_msg_id = 0,
battlefield_stage = 0,
snmp_stage = 0,
ppstream_stage = 0,
halflife2_stage = 0,
tftp_stage = 0,
aimini_stage = 0,
xbox_stage = 0,
wsus_stage = 0,
skype_packet_id = 0 '\0',
teamviewer_stage = 0 '\0'
}
},
host_server_name = '\0' <repeats 255 times>,
detected_os = '\0' <repeats 31 times>,
excluded_protocol_bitmask = {
bitmask = {0, 0, 0}
},
packet_counter = 1,
packet_direction_counter = {1, 0},
byte_counter = {1128, 0},
bittorrent_stage = 0 '\0',
edk_stage = 0,
directconnect_stage = 0,
sip_yahoo_voice = 0,
http_detected = 1,
rtsprdt_stage = 0,
rtsp_control_flow = 0,
yahoo_detection_finished = 0,
pplive_stage = 0,
zattoo_stage = 0,
qq_stage = 0,
thunder_stage = 0,
oscar_ssl_voice_stage = 0,
oscar_video_voice = 0,
florensia_stage = 0,
packet = {
iph = 0x73a430,
iphv6 = 0x0,
tcp = 0x73a444,
udp = 0x0,
generic_l4_ptr = 0x0,
payload = 0x73a464 "GET
/static/arkonline/images/emailupdates/new/middayNews_hdr.jpg
HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM
8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\
r\nVia: 1.1 wbfil2.org.carkw.com (http_scan_byf/3.3.1)\r\nCUDA_CLIIP:
192.168.10.162\r\nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
tick_timestamp = 1442665333,
detected_protocol_stack = {7, 0, 0},
detected_subprotocol_stack = "\000\000",
real_protocol_read_only = 0,
protocol_stack_info = {
entry_is_real_protocol = 1 '\001',
current_stack_size_minus_one = 1 '\001'
},
line = {{
ptr = 0x73a464 "GET
/static/arkonline/images/emailupdates/new/middayNews_hdr.jpg
HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM
8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\
r\nVia: 1.1 wbfil2.org.carkw.com (http_scan_byf/3.3.1)\r\nCUDA_CLIIP:
192.168.10.162\r\nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 73
}, {
ptr = 0x73a4af "Accept: */*\r\nUser-Agent: Mozilla/4.0 (compatible;
MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727;
MS-RTC LM 8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
OfficeLiveConnector.1.4; OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3;
Microsoft Outlook 14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip,
deflate\r\nHost: media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168
.10.162\r\nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 11
}, {
ptr = 0x73a4bc "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows
NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM 8; .NET
CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Fo
rwarded-For: 192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 302
}, {
ptr = 0x73a5ec "Accept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 30
}, {
ptr = 0x73a60c "Host: media.arkansasonline.com\r\nCookie:
OAX=RllA0VHwFicACzCV; __qca=P0-1349696484-1374688810440;
s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 30
}, {
ptr = 0x73a62c "Cookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 499
}, {
ptr = 0x73a821 "Via: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 51
}, {
ptr = 0x73a856 "CUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 26
}, {
ptr = 0x73a872 "X-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 31
}, {
ptr = 0x73a893 "Cache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 29
}, {
ptr = 0x73a8b2 "Connection: keep-alive\r\n\r\n?\021CR?U\005",
len = 22
}, {
ptr = 0x73a8ca "\r\n?\021CR?U\005",
len = 2
}, {
ptr = 0x0,
len = 0
} <repeats 188 times>},
unix_line = {{
ptr = 0x0,
len = 0
} <repeats 200 times>},
host_line = {
ptr = 0x73a612 "media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 24
},
referer_line = {
ptr = 0x0,
len = 0
},
content_line = {
ptr = 0x0,
len = 0
},
accept_line = {
ptr = 0x73a4b7 "*/*\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM
8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\
nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 3
},
user_agent_line = {
ptr = 0x73a4c8 "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM 8; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For: 1
92.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 290
},
http_url_name = {
ptr = 0x73a468
"/static/arkonline/images/emailupdates/new/middayNews_hdr.jpg
HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM
8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia
: 1.1 wbfil2.org.carkw.com (http_scan_byf/3.3.1)\r\nCUDA_CLIIP:
192.168.10.162\r\nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 60
},
http_encoding = {
ptr = 0x0,
len = 0
},
http_transfer_encoding = {
ptr = 0x0,
len = 0
},
http_contentlen = {
ptr = 0x0,
len = 0
},
http_cookie = {
ptr = 0x73a634 "OAX=RllA0VHwFicACzCV; __qca=P0-1349696484-1374688810440;
s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\nVia: 1.1 wbfil2.org.carkw.com
(http_scan_byf/3.3.1)\r\nCUDA_CLIIP: 192.168.10.162\r\nX-Forwarded-For:
192.168.10.162\r\nCache-Control: max-age=259200\r\nConnection:
keep-alive\r\n\r\n?\021CR?U\005",
len = 491
},
http_x_session_type = {
ptr = 0x0,
len = 0
},
server_line = {
ptr = 0x0,
len = 0
},
http_method = {
ptr = 0x73a464 "GET
/static/arkonline/images/emailupdates/new/middayNews_hdr.jpg
HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; MS-RTC LM
8; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4;
OfficeLivePatch.1.3; .NET4.0C; .NET4.0E; InfoPath.3; Microsoft Outlook
14.0.7105; ms-office; MSOffice 14)\r\nAccept-Encoding: gzip, deflate\r\nHost:
media.arkansasonline.com\r\nCookie: OAX=RllA0VHwFicACzCV;
__qca=P0-1349696484-1374688810440; s_lastvisit=1380041387039;
__utma=116532950.637762389.1374688811.1380024156.1380041386.36;
__utmz=116532950.1374688811.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
elAuth=gary.pittman%40carkw.com;
elAuthX=N%25A4%255ET%2587%25E1z%25F7P%25F2%2507_J%25CD%2501%25EBg%25F0%25D3%2502%25FB%2516J%252C%251A%2512%25C7%25D3%25EA%25EF%25AB%251F;
sessionid=e0034baa977b2c6e1df9a299b4cba912; s_vnum=1382616156136%26vn%3D2;
s_nr=1380024156136\r\
nVia: 1.1 wbfil2.org.carkw.com (http_scan_byf/3.3.1)\r\nCUDA_CLIIP:
192.168.10.162\r\nX-Forwarded-For: 192.168.10.162\r\nCache-Control:
max-age=259200\r\nConnection: keep-alive\r\n\r\n?\021CR?U\005",
len = 3
},
http_response = {
ptr = 0x0,
len = 0
},
l3_packet_len = 1180,
l4_packet_len = 1160,
payload_packet_len = 1128,
actual_payload_len = 1128,
num_retried_bytes = 0,
parsed_lines = 12,
parsed_unix_lines = 0,
empty_line_position = 0,
tcp_retransmission = 0 '\0',
l4_protocol = 6 '\006',
packet_lines_parsed_complete = 1 '\001',
packet_unix_lines_parsed_complete = 0 '\0',
empty_line_position_set = 0 '\0',
packet_direction = 0 '\0',
ssl_certificate_detected = 0 '\0',
ssl_certificate_num_checks = 0 '\0'
},
flow = 0x0,
src = 0x31766c0,
dst = 0x31767d0
}
_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
