Mailing List Archive

Question regarding tcp dump
Trying to trace a packet which seems to be getting lost. Customer is
receiving an Internal Server 500 error.

When looking at the TCP Stream for that transaction we see a number of
repeated characters such as iiiiiiiiiiiiiiiiiiiiiiiii and
rrrrrrrrrrrrrrrrrrrrrrr. Is there a document shows what this may mean or
do you have any ideas what would cause this to show up in the stream.

Here is the last portion of the stream:


--------------------------------------------------------------------------
--------------

25lbnQgOCANL0NvbG9y
U3BhY2UgL0RldmljZVJHQiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgPj4gDXN0
cmVhbQ0K/9j/7gAOQWRvYmUAZAAAAAAA/9sAQwAoHB4jHhkoIyEjLSsoMDxkQTw3Nzx7WF1J
ZJGAmZaPgIyKoLTmw6Cq2q2KjMj/y9ru9f///5vB////+v/m/f/4/8AAEQgDLgQ9A1IRAEcR
AEIRAP/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQE
AAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkq
NDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeY
mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX2
9/j5+v/aAAwDUgBHAEIAAD8A1cVs1s0tFFAopKWilpaKKKKKKKKWiiiiiiiiiiiiiiiiiiii
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
iiiiiiiiiiiiiiiiiiiiiiiikoooopKKKKKKKKKWkNBpDSU2m0ZozS5pSRQSKCRSZoBpO1BN
BNGaTOKQGkzSE5NBOTRnmlBoXApQR3pwOad1p2c0EbeaMbRmkPAzRwaODS8GmsBnimsMHimk
DPFM56U3OeKb7U4YHNP4HPen8DmmYzzTNveozzzT1
YbuBTgeeBTlbngUN1yTSNwcnrSSccnr
TM1Hmos5pKTNJSHrRRSqcHNOXg5oU7TmpA3PA4qQNjp0qRZj6cUjNk+lNZsn0oL5PpTd3Q0h
bHNIWPWl30b6N/FJuajcaaSaQsefWkLkZ9aQt+dMAJODTcbiKQ5pxUdzSkeppOD1NJjAyOaT
7q8c0h6UuO5NLg9SetIQT3pDgdKawA6UcDpTCccVGaZSE8c0HnrRk4pCvGaGXA9qXadue1IF
OKVcqOBSqxUcCroq7WhSiikpaKKUUUtLRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRR
HTTP/1.1 500 Internal Server Error Date: Mon, 19 Jun 2006 20:30:54 GMT
Server: WebLogic Server 8.1 SP3 Tue Jun 29 23:11:19 PDT 2004 404973
Content-Length: 883 Content-Type: text/html Connection: Close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Draft//EN">
<HTML>
<HEAD>
<TITLE>Error 500--Internal Server Error</TITLE>
<META NAME="GENERATOR" CONTENT="WebLogic Server">
</HEAD>
<BODY bgcolor="white">
<FONT FACE=Helvetica><BR CLEAR=all>
<TABLE border=0 cellspacing=5><TR><TD><BR CLEAR=all>
<FONT FACE="Helvetica" COLOR="black" SIZE="3"><H2>Error 500--Internal
Server Error</H2>
</FONT></TD></TR>
</TABLE>
<TABLE border=0 width=100% cellpadding=10><TR><TD VALIGN=top WIDTH=100%
BGCOLOR=white><FONT FACE="Courier New"><FONT FACE="Helvetica"
SIZE="3"><H3>From RFC 2068 <i>Hypertext Transfer Protocol --
HTTP/1.1</i>:</H3>
</FONT><FONT FACE="Helvetica" SIZE="3"><H4>10.5.1 500 Internal Server
Error</H4>
</FONT><P><FONT FACE="Courier New">The server encountered an unexpected
condition which prevented it from fulfilling the request.</FONT></P>
</FONT></TD></TR>
</TABLE>



Brian Foran
Network Engineer
o: 714.541.9960 x 12258
c: 714.474.6946
bforan@ameriquest.com

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you are not the named addressee you should not disseminate, distribute
or copy this e-mail. Please notify the sender immediately by e-mail if you
have received this e-mail by mistake and delete this e-mail from your
system. If you are not the intended recipient you are notified that
disclosing, copying, distributing or taking any action in reliance on the
contents of this information is strictly prohibited.


-----------------------------------------
The information in this email, and any attachments, may contain
confidential information and is intended solely for the attention
and use of the named addressee(s). It must not be disclosed to any
person(s) without authorization. If you are not the intended
recipient, or a person responsible for delivering it to the
intended recipient, you are not authorized to, and must not,
disclose, copy, distribute, or retain this message or any part of
it. If you have received this communication in error, please notify
the sender immediately.

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev
Re: Question regarding tcp dump [ In reply to ]
On Jun 19, 2006, at 4:44 PM, BForan@ameriquest.com wrote:

> Here is the last portion of the stream:
>
>
> ----------------------------------------------------------------------
> ----
> --------------
>
> 25lbnQgOCANL0NvbG9y
> U3BhY2UgL0RldmljZVJHQiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgPj4gDX
> N0
> cmVhbQ0K/9j/7gAOQWRvYmUAZAAAAAAA/
> 9sAQwAoHB4jHhkoIyEjLSsoMDxkQTw3Nzx7WF1J
> ZJGAmZaPgIyKoLTmw6Cq2q2KjMj/y9ru9f///5vB////+v/m/f/
> 4/8AAEQgDLgQ9A1IRAEcR
> AEIRAP/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//
> EALUQAAIBAwMCBAMFBQQE
> AAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKC
> kq
> NDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlp
> eY
> mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9P
> X2
> 9/j5+v/
> aAAwDUgBHAEIAAD8A1cVs1s0tFFAopKWilpaKKKKKKKKWiiiiiiiiiiiiiiiiiiii
> iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
> ii
> iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
> ii
> iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
> ii
> iiiiiiiiiiiiiiiiiiiiiiiikoooopKKKKKKKKKWkNBpDSU2m0ZozS5pSRQSKCRSZoBpO1
> BN
> BNGaTOKQGkzSE5NBOTRnmlBoXApQR3pwOad1p2c0EbeaMbRmkPAzRwaODS8GmsBnimsMHi
> mk
> DPFM56U3OeKb7U4YHNP4HPen8DmmYzzTNveozzzT1
> YbuBTgeeBTlbngUN1yTSNwcnrSSccnr
> TM1Hmos5pKTNJSHrRRSqcHNOXg5oU7TmpA3PA4qQNjp0qRZj6cUjNk
> +lNZsn0oL5PpTd3Q0h
> bHNIWPWl30b6N/FJuajcaaSaQsefWkLkZ9aQt
> +dMAJODTcbiKQ5pxUdzSkeppOD1NJjAyOaT
> 7q8c0h6UuO5NLg9SetIQT3pDgdKawA6UcDpTCccVGaZSE8c0HnrRk4pCvGaGXA9qXadue1
> IF
> OKVcqOBSqxUcCroq7WhSiikpaKKUUUtLRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
> RR
> RRRRRRRRRRRRRRRRRRRRRRRRRRR

That looks like a base-64 encoding of some sort of binary data such
as a GIF or JPEG image. If so, the repeated letters might correspond
to a block in the image with a solid color.

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev