I guess guys interested in content inside requests. It must be like this:
15:40:54.296035 IP 195.69.X.X.4213 > 194.67.45.129.80: P 1:526(525) ack 1 win
1460 <nop,nop,timestamp 400658 2340925809>
0x0000: 4500 0241 b6a0 4000 4006 fe0e c345 d0fd E..A..@.@....E..
0x0010: c243 2d81 1075 0050 aa22 ab98 f995 e562 .C-..u.P.".....b
0x0020: 8018 05b4 f2d6 0000 0101 080a 0006 1d12 ................
0x0030: 8b87 b171 4745 5420 2f63 6f75 6e74 6572 ...qGET./counter
0x0040: 3f69 643d 3637 3632 3432 2048 5454 502f ?id=676242.HTTP/
0x0050: 312e 310d 0a55 7365 722d 4167 656e 743a 1.1..User-Agent:
0x0060: 204f 7065 7261 2f39 2e31 3020 2858 3131 .Opera/9.10.(X11
0x0070: 3b20 4c69 6e75 7820 6936 3836 3b20 553b ;.Linux.i686;.U;
0x0080: 2065 6e29 0d0a 486f 7374 3a20 746f 7033 .en)..Host:.top3
0x0090: 2e6c 6973 742e 7275 0d0a 4163 6365 7074 .list.ru..Accept
0x00a0: 3a20 7465 7874 2f68 746d 6c2c 2061 7070 :.text/html,.app
0x00b0: 6c69 6361 7469 6f6e 2f78 6d6c 3b71 3d30 lication/xml;q=0
0x00c0: 2e39 2c20 6170 706c 6963 6174 696f 6e2f .9,.application/
0x00d0: 7868 746d 6c2b 786d 6c2c 2069 6d61 6765 xhtml+xml,.image
0x00e0: 2f70 6e67 2c20 696d 6167 652f 6a70 6567 /png,.image/jpeg
0x00f0: 2c20 696d 6167 652f 6769 662c 2069 6d61 ,.image/gif,.ima
0x0100: 6765 2f78 2d78 6269 746d 6170 2c20 2a2f ge/x-xbitmap,.*/
0x0110: 2a3b 713d 302e 310d 0a41 6363 6570 742d *;q=0.1..Accept-
0x0120: 4c61 6e67 7561 6765 3a20 656e 0d0a 4163 Language:.en..Ac
0x0130: 6365 7074 2d43 6861 7273 6574 3a20 6973 cept-Charset:.is
0x0140: 6f2d 3838 3539 2d31 2c20 7574 662d 382c o-8859-1,.utf-8,
0x0150: 2075 7466 2d31 362c 202a 3b71 3d30 2e31 .utf-16,.*;q=0.1
0x0160: 0d0a 4163 6365 7074 2d45 6e63 6f64 696e ..Accept-Encodin
0x0170: 673a 2064 6566 6c61 7465 2c20 677a 6970 g:.deflate,.gzip
0x0180: 2c20 782d 677a 6970 2c20 6964 656e 7469 ,.x-gzip,.identi
0x0190: 7479 2c20 2a3b 713d 300d 0a52 6566 6572 ty,.*;q=0..Refer
0x01a0: 6572 3a20 6874 7470 3a2f 2f74 6f70 2e72 er:.http://top.r
0x01b0: 6263 2e72 752f 696e 6465 7833 2e73 6874 bc.ru/index3.sht
0x01c0: 6d6c 0d0a 436f 6f6b 6965 3a20 5649 443d ml..Cookie:.VID=
0x01d0: 3139 4766 536f 316a 4433 574d 0d0a 436f 19GfSo1jD3WM..Co
0x01e0: 6f6b 6965 323a 2024 5665 7273 696f 6e3d okie2:.$Version=
0x01f0: 310d 0a43 6f6e 6e65 6374 696f 6e3a 204b 1..Connection:.K
0x0200: 6565 702d 416c 6976 652c 2054 450d 0a54 eep-Alive,.TE..T
0x0210: 453a 2064 6566 6c61 7465 2c20 677a 6970 E:.deflate,.gzip
0x0220: 2c20 6368 756e 6b65 642c 2069 6465 6e74 ,.chunked,.ident
0x0230: 6974 792c 2074 7261 696c 6572 730d 0a0d ity,.trailers...
0x0240: 0a .
On Thu, 01 Mar 2007 07:15:35 -0500, dhottinger wrote
> Did anyone get a chance to look at the iptraf files that I sent
> displaying connections to Apples software update website?
>
> thanks,
>
> ddh
>
> --
> Dwayne Hottinger
> Network Administrator
> Harrisonburg City Public Schools
--
Virtual ISP S.A.L.
