1	09:45:02.732909 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 19, len 84, bad cksum 950c!)
     2	09:45:02.896713 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62373, len 84, bad cksum a979!)
     3	09:45:03.776579 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 21, len 84, bad cksum 950a!)
     4	09:45:03.849188 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62474, len 84, bad cksum a914!)
     5	09:45:04.755226 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 23, len 84, bad cksum 9508!)
     6	09:45:04.768159 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62666, len 84, bad cksum a854!)
     7	11:09:13.557615 94.0.146.98 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 58832, len 422)
     8	11:10:34.876658 192.146.201.172 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 40092, len 422)
     9	11:10:34.991246 172.16.183.2 > 175.44.57.180:  ip-proto-11 512 (ttl 250, id 49658, len 532)
    10	11:10:34.992379 172.16.183.2 > 57.35.28.126:  ip-proto-11 512 (ttl 250, id 15445, len 532)
    11	11:10:34.995320 172.16.183.2 > 22.23.166.235:  ip-proto-11 512 (ttl 250, id 61203, len 532)
    12	11:10:35.005093 172.16.183.2 > p50-tnt7.syd.ihug.com.au:  ip-proto-11 512 (ttl 250, id 40978, len 532)
    13	11:10:35.015220 172.16.183.2 > 31.223.48.171:  ip-proto-11 512 (ttl 250, id 8444, len 532)
    14	11:10:35.035260 172.16.183.2 > 55.247.104.208:  ip-proto-11 512 (ttl 250, id 22833, len 532)
    15	11:10:35.045154 172.16.183.2 > 73.195.64.167:  ip-proto-11 512 (ttl 250, id 22491, len 532)
    16	11:10:35.055188 172.16.183.2 > 122.114.160.41:  ip-proto-11 512 (ttl 250, id 46639, len 532)
    17	11:10:35.065122 172.16.183.2 > 158.217.222.215:  ip-proto-11 512 (ttl 250, id 5340, len 532)
    18	11:10:35.475587 172.16.183.2 > 175.44.57.180:  ip-proto-11 463 (ttl 250, id 37092, len 483)
    19	11:10:35.475758 158.217.209.2 > 172.16.183.2: icmp: host 158.217.222.215 unreachable (ttl 231, id 59554, len 56)
    20	11:10:35.480562 172.16.183.2 > 57.35.28.126:  ip-proto-11 463 (ttl 250, id 26714, len 483)
    21	11:10:35.485063 172.16.183.2 > 22.23.166.235:  ip-proto-11 463 (ttl 250, id 48914, len 483)
    22	11:10:35.495194 172.16.183.2 > p50-tnt7.syd.ihug.com.au:  ip-proto-11 463 (ttl 250, id 57627, len 483)
    23	11:10:35.500389 core-1-fe1-0-0.oldcity.dca.net > 172.16.183.2: icmp: host 175.44.57.180 unreachable (ttl 253, id 44638, len 56)
    24	11:10:35.505081 172.16.183.2 > 31.223.48.171:  ip-proto-11 463 (ttl 250, id 38993, len 483)
    25	11:10:35.525031 172.16.183.2 > 55.247.104.208:  ip-proto-11 463 (ttl 250, id 18411, len 483)
    26	11:10:35.535120 172.16.183.2 > 73.195.64.167:  ip-proto-11 463 (ttl 250, id 59291, len 483)
    27	11:10:35.545099 172.16.183.2 > 122.114.160.41:  ip-proto-11 463 (ttl 250, id 62525, len 483)
    28	11:10:35.555174 172.16.183.2 > 158.217.222.215:  ip-proto-11 463 (ttl 250, id 12843, len 483)
    29	12:31:23.472051 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: S [tcp sum ok] 548969690:548969690(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17871, len 48)
    30	12:31:23.485414 AOrleans-102-1-2-201.abo.wanadoo.fr.1856 > 172.16.183.8.ftp: S [tcp sum ok] 549063379:549063379(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17873, len 48)
    31	12:31:23.491425 172.16.183.8.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1856: R [tcp sum ok] 0:0(0) ack 549063380 win 0 (DF) (ttl 255, id 0, len 40)
    32	12:31:23.493411 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: S [tcp sum ok] 62479013:62479013(0) ack 548969691 win 32120 <mss 1460> (DF) (ttl 64, id 25, len 44)
    33	12:31:23.769686 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: . [tcp sum ok] ack 1 win 17520 (DF) (ttl 105, id 17927, len 40)
    34	12:31:24.092218 AOrleans-102-1-2-201.abo.wanadoo.fr.1856 > 172.16.183.8.ftp: S [tcp sum ok] 549063379:549063379(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17930, len 48)
    35	12:31:24.104404 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52402+ PTR? 201.184.14.80.in-addr.arpa. [|domain] (ttl 64, id 26, len 72)
    36	12:31:24.109156 172.16.183.8.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1856: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
    37	12:31:24.119612 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52402 1/2/2 201.184.14.80.in-addr.arpa. PTR AOrleans-102-1-2-201.abo.wanadoo.fr. (160) (ttl 61, id 56298, len 188)
    38	12:31:24.124458 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52403+ A? AOrleans-102-1-2-201.abo.wanadoo.fr. [|domain] (ttl 64, id 27, len 81)
    39	12:31:24.138320 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52403 1/2/2 AOrleans-102-1-2-201.abo.wanadoo.fr. A AOrleans-102-1-2-201.abo.wanadoo.fr (136) (ttl 61, id 56299, len 164)
    40	12:31:24.144245 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52404+ PTR? 201.184.14.80.in-addr.arpa. [|domain] (ttl 64, id 28, len 72)
    41	12:31:24.158130 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52404 1/2/2 201.184.14.80.in-addr.arpa. PTR AOrleans-102-1-2-201.abo.wanadoo.fr. (160) (ttl 61, id 56300, len 188)
    42	12:31:24.180954 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52405+ PTR? 2.183.16.172.in-addr.arpa. [|domain] (ttl 64, id 29, len 71)
    43	12:31:24.204579 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52405 NXDomain* 0/1/0 (120) (ttl 61, id 56303, len 148)
    44	12:31:24.207667 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 30, len 120)
    45	12:31:24.406049 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: P [tcp sum ok] 1:17(16) ack 81 win 17440 (DF) (ttl 105, id 17938, len 56)
    46	12:31:24.410490 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: . [tcp sum ok] ack 17 win 32120 (DF) [tos 0x10]  (ttl 64, id 31, len 40)
    47	12:31:24.462990 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 81:149(68) ack 17 win 32120 (DF) [tos 0x10]  (ttl 64, id 32, len 108)
    48	12:31:24.619679 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: P [tcp sum ok] 17:40(23) ack 149 win 17372 (DF) (ttl 105, id 17940, len 63)
    49	12:31:24.620892 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 149:171(22) ack 40 win 32120 (DF) [tos 0x10]  (ttl 64, id 33, len 62)
    50	12:31:24.781762 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: F [tcp sum ok] 40:40(0) ack 171 win 17350 (DF) (ttl 105, id 17942, len 40)
    51	12:31:24.782443 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: . [tcp sum ok] ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 34, len 40)
    52	12:31:24.783353 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 171:208(37) ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 35, len 77)
    53	12:31:24.785876 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: F [tcp sum ok] 208:208(0) ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 36, len 40)
    54	12:31:24.946578 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: R [tcp sum ok] 548969731:548969731(0) win 0 (DF) (ttl 105, id 17943, len 40)
    55	12:31:24.953968 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: R [tcp sum ok] 548969731:548969731(0) win 0 (ttl 105, id 17944, len 40)
    56	14:57:22.260915 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    57	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    58	TrnID=0xA5B5
    59	OpCode=0
    60	NmFlags=0x0
    61	Rcode=0
    62	QueryCount=1
    63	AnswerCount=0
    64	AuthorityCount=0
    65	AddressRecCount=0
    66	QuestionRecords:
    67	Name=*               NameType=0x00 (Workstation)
    68	QuestionType=0x21
    69	QuestionClass=0x1
       

    70	 (ttl 111, id 31959, len 78)
    71	14:57:22.264983 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 180, len 106)
    72	14:57:23.761037 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    73	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    74	TrnID=0xA5BF
    75	OpCode=0
    76	NmFlags=0x0
    77	Rcode=0
    78	QueryCount=1
    79	AnswerCount=0
    80	AuthorityCount=0
    81	AddressRecCount=0
    82	QuestionRecords:
    83	Name=*               NameType=0x00 (Workstation)
    84	QuestionType=0x21
    85	QuestionClass=0x1
       

    86	 (ttl 111, id 32433, len 78)
    87	14:57:23.761669 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 181, len 106)
    88	14:57:25.261685 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    89	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    90	TrnID=0xA5C5
    91	OpCode=0
    92	NmFlags=0x0
    93	Rcode=0
    94	QueryCount=1
    95	AnswerCount=0
    96	AuthorityCount=0
    97	AddressRecCount=0
    98	QuestionRecords:
    99	Name=*               NameType=0x00 (Workstation)
   100	QuestionType=0x21
   101	QuestionClass=0x1
       

   102	 (ttl 111, id 32728, len 78)
   103	14:57:25.262160 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 182, len 106)
   104	15:35:00.285126 168.148.27.14 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 60428, len 422)
   105	15:35:56.667243 10.39.81.89 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 41688, len 422)
   106	15:40:23.804323 3D72F7E5.osaka.meta.ne.jp.3673 > 172.16.183.2.sunrpc: S [tcp sum ok] 1673438256:1673438256(0) win 32120 <mss 1460,sackOK,timestamp 404000327 0,nop,wscale 0> (DF) (ttl 45, id 35948, len 60)
   107	15:40:23.808741 3D72F7E5.osaka.meta.ne.jp.3675 > 172.16.183.8.sunrpc: S [tcp sum ok] 1676823404:1676823404(0) win 32120 <mss 1460,sackOK,timestamp 404000327 0,nop,wscale 0> (DF) (ttl 45, id 35950, len 60)
   108	15:40:23.817653 172.16.183.8.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3675: S [tcp sum ok] 1103499552:1103499552(0) ack 1676823405 win 5792 <mss 1460,sackOK,timestamp 10555925 404000327,nop,wscale 0> (DF) (ttl 64, id 0, len 60)
   109	15:40:23.824450 172.16.183.2.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3673: S [tcp sum ok] 3444177268:3444177268(0) ack 1673438257 win 32120 <mss 1460,sackOK,timestamp 2154221 404000327,nop,wscale 0> (DF) (ttl 64, id 37, len 60)
   110	15:40:27.335420 172.16.183.2.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3673: S [tcp sum ok] 3444177268:3444177268(0) ack 1673438257 win 32120 <mss 1460,sackOK,timestamp 2154572 404000327,nop,wscale 0> (DF) (ttl 64, id 38, len 60)
   111	15:40:27.537352 3D72F7E5.osaka.meta.ne.jp.3673 > 172.16.183.2.sunrpc: R [tcp sum ok] 1673438257:1673438257(0) win 0 (ttl 236, id 39589, len 40)
   112	15:40:27.825398 172.16.183.8.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3675: S [tcp sum ok] 1103499552:1103499552(0) ack 1676823405 win 5792 <mss 1460,sackOK,timestamp 10556326 404000327,nop,wscale 0> (DF) (ttl 64, id 0, len 60)
   113	15:40:28.025654 3D72F7E5.osaka.meta.ne.jp.3675 > 172.16.183.8.sunrpc: R [tcp sum ok] 1676823405:1676823405(0) win 0 (ttl 236, id 39592, len 40)
   114	15:57:37.983480 58.248.76.90 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 4308, len 422)
   115	15:57:39.114395 172.16.183.2.1025 > 11.11.11.11.8882: S [bad tcp cksum df29!] 240028091:240028091(0) win 32120 <mss 1460,sackOK,timestamp 2257780 0,nop,wscale 0> (DF) (ttl 64, id 39, len 60, bad cksum 978d!)
   116	15:57:39.181019 11.11.11.11.8882 > 172.16.183.2.1025: S [bad tcp cksum df29!] 138504693:138504693(0) ack 240028092 win 32120 <mss 1460,sackOK,timestamp 181750773 2257780,nop,wscale 0> (DF) (ttl 53, id 524, len 60, bad cksum a0a8!)
   117	15:57:39.186541 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 1 win 32120 <nop,nop,timestamp 2257788 181750773> (DF) (ttl 64, id 40, len 52, bad cksum 9794!)
   118	15:57:39.191581 172.16.183.2.1025 > 11.11.11.11.8882: P [bad tcp cksum df29!] 1:546(545) ack 1 win 32120 <nop,nop,timestamp 2257788 181750773> (DF) (ttl 64, id 41, len 597, bad cksum 9572!)
   119	15:57:39.287189 11.11.11.11.8882 > 172.16.183.2.1025: . [bad tcp cksum df29!] ack 546 win 31856 <nop,nop,timestamp 181750784 2257788> (DF) (ttl 53, id 527, len 52, bad cksum a0ad!)
   120	15:57:39.290486 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 1:115(114) ack 546 win 31856 <nop,nop,timestamp 181750784 2257788> (DF) (ttl 53, id 528, len 166, bad cksum a03a!)
   121	15:57:39.291603 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 115 win 32120 <nop,nop,timestamp 2257799 181750784> (DF) (ttl 64, id 42, len 52, bad cksum 9792!)
   122	15:57:39.307966 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 115:839(724) ack 546 win 31856 <nop,nop,timestamp 181750785 2257788> (DF) (ttl 53, id 529, len 776, bad cksum 9dd7!)
   123	15:57:39.334972 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 839 win 32120 <nop,nop,timestamp 2257807 181750785> (DF) (ttl 64, id 43, len 52, bad cksum 9791!)
   124	15:57:39.375334 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 839:2287(1448) ack 546 win 31856 <nop,nop,timestamp 181750790 2257799> (DF) (ttl 53, id 531, len 1500, bad cksum 9b01!)
   125	15:57:39.389619 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 2287:3735(1448) ack 546 win 31856 <nop,nop,timestamp 181750790 2257799> (DF) (ttl 53, id 532, len 1500, bad cksum 9b00!)
   126	15:57:39.390451 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 3735 win 31856 <nop,nop,timestamp 2257812 181750790> (DF) (ttl 64, id 44, len 52, bad cksum 9790!)
   127	15:57:39.414498 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 3735:5183(1448) ack 546 win 31856 <nop,nop,timestamp 181750794 2257807> (DF) (ttl 53, id 533, len 1500, bad cksum 9aff!)
   128	15:57:39.427797 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 5183:6631(1448) ack 546 win 31856 <nop,nop,timestamp 181750794 2257807> (DF) (ttl 53, id 534, len 1500, bad cksum 9afe!)
   129	15:57:39.428475 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 6631 win 31856 <nop,nop,timestamp 2257816 181750794> (DF) (ttl 64, id 45, len 52, bad cksum 978f!)
   130	15:57:39.470699 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 6631:8079(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 536, len 1500, bad cksum 9afc!)
   131	15:57:39.483229 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 8079:9527(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 537, len 1500, bad cksum 9afb!)
   132	15:57:39.483900 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 9527 win 31856 <nop,nop,timestamp 2257821 181750800> (DF) (ttl 64, id 46, len 52, bad cksum 978e!)
   133	15:57:39.495078 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 9527:10975(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 538, len 1500, bad cksum 9afa!)
   134	15:57:39.510347 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 10975:12423(1448) ack 546 win 31856 <nop,nop,timestamp 181750804 2257816> (DF) (ttl 53, id 540, len 1500, bad cksum 9af8!)
   135	15:57:39.511089 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 12423 win 31856 <nop,nop,timestamp 2257824 181750800> (DF) (ttl 64, id 47, len 52, bad cksum 978d!)
   136	15:57:39.517776 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 12423:13316(893) ack 546 win 31856 <nop,nop,timestamp 181750804 2257816> (DF) (ttl 53, id 541, len 945, bad cksum 9d22!)
   137	15:57:39.534945 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 13316 win 31856 <nop,nop,timestamp 2257827 181750804> (DF) (ttl 64, id 48, len 52, bad cksum 978c!)
   138	15:57:39.563961 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 13316:14040(724) ack 546 win 31856 <nop,nop,timestamp 181750810 2257821> (DF) (ttl 53, id 542, len 776, bad cksum 9dca!)
   139	15:57:39.572822 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 14040:14764(724) ack 546 win 31856 <nop,nop,timestamp 181750811 2257821> (DF) (ttl 53, id 543, len 776, bad cksum 9dc9!)
   140	15:57:39.573479 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 14764 win 31856 <nop,nop,timestamp 2257829 181750810> (DF) (ttl 64, id 49, len 52, bad cksum 978b!)
   141	15:57:39.587613 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 14764:15488(724) ack 546 win 31856 <nop,nop,timestamp 181750812 2257824> (DF) (ttl 53, id 545, len 776, bad cksum 9dc7!)
   142	15:57:39.595250 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 15488:16212(724) ack 546 win 31856 <nop,nop,timestamp 181750813 2257824> (DF) (ttl 53, id 546, len 776, bad cksum 9dc6!)
   143	15:57:39.595900 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 16212 win 31856 <nop,nop,timestamp 2257833 181750812> (DF) (ttl 64, id 50, len 52, bad cksum 978a!)
   144	15:57:39.600919 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 16212:16936(724) ack 546 win 31856 <nop,nop,timestamp 181750814 2257827> (DF) (ttl 53, id 547, len 776, bad cksum 9dc5!)
   145	15:57:39.604915 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 16936 win 31856 <nop,nop,timestamp 2257835 181750814> (DF) (ttl 64, id 51, len 52, bad cksum 9789!)
   146	15:57:39.611753 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 16936:17660(724) ack 546 win 31856 <nop,nop,timestamp 181750815 2257827> (DF) (ttl 53, id 548, len 776, bad cksum 9dc4!)
   147	15:57:39.623828 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 17660:18384(724) ack 546 win 31856 <nop,nop,timestamp 181750817 2257827> (DF) (ttl 53, id 549, len 776, bad cksum 9dc3!)
   148	15:57:39.624464 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 18384 win 31856 <nop,nop,timestamp 2257836 181750815> (DF) (ttl 64, id 52, len 52, bad cksum 9788!)
   149	15:57:39.634659 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 18384:19108(724) ack 546 win 31856 <nop,nop,timestamp 181750818 2257827> (DF) (ttl 53, id 550, len 776, bad cksum 9dc2!)
   150	15:57:39.643048 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 19108:19832(724) ack 546 win 31856 <nop,nop,timestamp 181750819 2257829> (DF) (ttl 53, id 551, len 776, bad cksum 9dc1!)
   151	15:57:39.643738 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 19832 win 31856 <nop,nop,timestamp 2257837 181750818> (DF) (ttl 64, id 53, len 52, bad cksum 9787!)
   152	15:57:39.658817 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 19832:20556(724) ack 546 win 31856 <nop,nop,timestamp 181750819 2257829> (DF) (ttl 53, id 552, len 776, bad cksum 9dc0!)
   153	15:57:39.666200 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 20556:21280(724) ack 546 win 31856 <nop,nop,timestamp 181750820 2257829> (DF) (ttl 53, id 553, len 776, bad cksum 9dbf!)
   154	15:57:39.666858 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 21280 win 31856 <nop,nop,timestamp 2257841 181750819> (DF) (ttl 64, id 54, len 52, bad cksum 9786!)
   155	15:57:39.676054 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 21280:22004(724) ack 546 win 31856 <nop,nop,timestamp 181750821 2257835> (DF) (ttl 53, id 555, len 776, bad cksum 9dbd!)
   156	15:57:39.687887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 22004:22728(724) ack 546 win 31856 <nop,nop,timestamp 181750822 2257835> (DF) (ttl 53, id 556, len 776, bad cksum 9dbc!)
   157	15:57:39.688515 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 22728 win 31856 <nop,nop,timestamp 2257843 181750821> (DF) (ttl 64, id 55, len 52, bad cksum 9785!)
   158	15:57:39.693054 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 22728:23452(724) ack 546 win 31856 <nop,nop,timestamp 181750823 2257836> (DF) (ttl 53, id 557, len 776, bad cksum 9dbb!)
   159	15:57:39.694982 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 23452 win 31856 <nop,nop,timestamp 2257845 181750823> (DF) (ttl 64, id 56, len 52, bad cksum 9784!)
   160	15:57:39.702907 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 23452:24176(724) ack 546 win 31856 <nop,nop,timestamp 181750824 2257836> (DF) (ttl 53, id 558, len 776, bad cksum 9dba!)
   161	15:57:39.715238 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 24176:24900(724) ack 546 win 31856 <nop,nop,timestamp 181750826 2257837> (DF) (ttl 53, id 559, len 776, bad cksum 9db9!)
   162	15:57:39.716238 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 24900 win 31856 <nop,nop,timestamp 2257847 181750824> (DF) (ttl 64, id 57, len 52, bad cksum 9783!)
   163	15:57:39.728286 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 24900:25624(724) ack 546 win 31856 <nop,nop,timestamp 181750827 2257837> (DF) (ttl 53, id 560, len 776, bad cksum 9db8!)
   164	15:57:39.733470 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 25624:26348(724) ack 546 win 31856 <nop,nop,timestamp 181750828 2257841> (DF) (ttl 53, id 561, len 776, bad cksum 9db7!)
   165	15:57:39.734134 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 26348 win 31856 <nop,nop,timestamp 2257848 181750827> (DF) (ttl 64, id 58, len 52, bad cksum 9782!)
   166	15:57:39.745284 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 26348:27072(724) ack 546 win 31856 <nop,nop,timestamp 181750829 2257841> (DF) (ttl 53, id 562, len 776, bad cksum 9db6!)
   167	15:57:39.762784 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 27072:27796(724) ack 546 win 31856 <nop,nop,timestamp 181750830 2257841> (DF) (ttl 53, id 564, len 776, bad cksum 9db4!)
   168	15:57:39.763444 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 27796 win 31856 <nop,nop,timestamp 2257851 181750829> (DF) (ttl 64, id 59, len 52, bad cksum 9781!)
   169	15:57:39.835708 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 27796:28520(724) ack 546 win 31856 <nop,nop,timestamp 181750837 2257848> (DF) (ttl 53, id 565, len 776, bad cksum 9db3!)
   170	15:57:39.848771 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 28520:29244(724) ack 546 win 31856 <nop,nop,timestamp 181750838 2257851> (DF) (ttl 53, id 567, len 776, bad cksum 9db1!)
   171	15:57:39.849435 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 29244 win 31856 <nop,nop,timestamp 2257860 181750837> (DF) (ttl 64, id 60, len 52, bad cksum 9780!)
   172	15:57:39.853203 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 29244:29968(724) ack 546 win 31856 <nop,nop,timestamp 181750839 2257851> (DF) (ttl 53, id 568, len 776, bad cksum 9db0!)
   173	15:57:39.864996 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 29968 win 31856 <nop,nop,timestamp 2257863 181750839> (DF) (ttl 64, id 61, len 52, bad cksum 977f!)
   174	15:57:39.866261 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 29968:30692(724) ack 546 win 31856 <nop,nop,timestamp 181750840 2257851> (DF) (ttl 53, id 569, len 776, bad cksum 9daf!)
   175	15:57:39.873647 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 30692:31416(724) ack 546 win 31856 <nop,nop,timestamp 181750841 2257851> (DF) (ttl 53, id 570, len 776, bad cksum 9dae!)
   176	15:57:39.874355 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 31416 win 31856 <nop,nop,timestamp 2257863 181750840> (DF) (ttl 64, id 62, len 52, bad cksum 977e!)
   177	15:57:39.885719 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 31416:32140(724) ack 546 win 31856 <nop,nop,timestamp 181750842 2257851> (DF) (ttl 53, id 571, len 776, bad cksum 9dad!)
   178	15:57:39.890405 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 32140:32864(724) ack 546 win 31856 <nop,nop,timestamp 181750843 2257851> (DF) (ttl 53, id 572, len 776, bad cksum 9dac!)
   179	15:57:39.891049 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 32864 win 31856 <nop,nop,timestamp 2257865 181750842> (DF) (ttl 64, id 63, len 52, bad cksum 977d!)
   180	15:57:39.897058 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 32864:33588(724) ack 546 win 31856 <nop,nop,timestamp 181750844 2257851> (DF) (ttl 53, id 573, len 776, bad cksum 9dab!)
   181	15:57:39.924977 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 33588 win 31856 <nop,nop,timestamp 2257870 181750844> (DF) (ttl 64, id 64, len 52, bad cksum 977c!)
   182	15:57:39.940663 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 33588:34312(724) ack 546 win 31856 <nop,nop,timestamp 181750848 2257863> (DF) (ttl 53, id 575, len 776, bad cksum 9da9!)
   183	15:57:39.949282 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 34312:35036(724) ack 546 win 31856 <nop,nop,timestamp 181750849 2257863> (DF) (ttl 53, id 576, len 776, bad cksum 9da8!)
   184	15:57:39.949901 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 35036 win 31856 <nop,nop,timestamp 2257872 181750848> (DF) (ttl 64, id 65, len 52, bad cksum 977b!)
   185	15:57:39.959869 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 35036:35760(724) ack 546 win 31856 <nop,nop,timestamp 181750850 2257865> (DF) (ttl 53, id 577, len 776, bad cksum 9da7!)
   186	15:57:39.971462 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 35760:36484(724) ack 546 win 31856 <nop,nop,timestamp 181750851 2257865> (DF) (ttl 53, id 578, len 776, bad cksum 9da6!)
   187	15:57:39.972102 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 36484 win 31856 <nop,nop,timestamp 2257874 181750850> (DF) (ttl 64, id 66, len 52, bad cksum 977a!)
   188	15:57:39.980333 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 36484:37208(724) ack 546 win 31856 <nop,nop,timestamp 181750852 2257865> (DF) (ttl 53, id 579, len 776, bad cksum 9da5!)
   189	15:57:39.994948 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 37208 win 31856 <nop,nop,timestamp 2257877 181750852> (DF) (ttl 64, id 67, len 52, bad cksum 9779!)
   190	15:57:39.995090 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 37208:37932(724) ack 546 win 31856 <nop,nop,timestamp 181750853 2257865> (DF) (ttl 53, id 580, len 776, bad cksum 9da4!)
   191	15:57:40.002748 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 37932:38656(724) ack 546 win 31856 <nop,nop,timestamp 181750854 2257870> (DF) (ttl 53, id 581, len 776, bad cksum 9da3!)
   192	15:57:40.003354 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 38656 win 31856 <nop,nop,timestamp 2257877 181750853> (DF) (ttl 64, id 68, len 52, bad cksum 9778!)
   193	15:57:40.014580 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 38656:39380(724) ack 546 win 31856 <nop,nop,timestamp 181750855 2257870> (DF) (ttl 53, id 583, len 776, bad cksum 9da1!)
   194	15:57:40.019753 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 39380:40104(724) ack 546 win 31856 <nop,nop,timestamp 181750856 2257872> (DF) (ttl 53, id 584, len 776, bad cksum 9da0!)
   195	15:57:40.020384 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 40104 win 31856 <nop,nop,timestamp 2257879 181750855> (DF) (ttl 64, id 69, len 52, bad cksum 9777!)
   196	15:57:40.027887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 40104:40828(724) ack 546 win 31856 <nop,nop,timestamp 181750857 2257872> (DF) (ttl 53, id 585, len 776, bad cksum 9d9f!)
   197	15:57:40.038491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 40828:41552(724) ack 546 win 31856 <nop,nop,timestamp 181750858 2257874> (DF) (ttl 53, id 586, len 776, bad cksum 9d9e!)
   198	15:57:40.039112 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 41552 win 31856 <nop,nop,timestamp 2257882 181750857> (DF) (ttl 64, id 70, len 52, bad cksum 9776!)
   199	15:57:40.052508 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 41552:42276(724) ack 546 win 31856 <nop,nop,timestamp 181750859 2257874> (DF) (ttl 53, id 587, len 776, bad cksum 9d9d!)
   200	15:57:40.061887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 42276:43000(724) ack 546 win 31856 <nop,nop,timestamp 181750860 2257874> (DF) (ttl 53, id 588, len 776, bad cksum 9d9c!)
   201	15:57:40.062507 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 43000 win 31856 <nop,nop,timestamp 2257884 181750859> (DF) (ttl 64, id 71, len 52, bad cksum 9775!)
   202	15:57:40.069510 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 43000:43724(724) ack 546 win 31856 <nop,nop,timestamp 181750861 2257877> (DF) (ttl 53, id 589, len 776, bad cksum 9d9b!)
   203	15:57:40.077899 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 43724:44448(724) ack 546 win 31856 <nop,nop,timestamp 181750862 2257877> (DF) (ttl 53, id 590, len 776, bad cksum 9d9a!)
   204	15:57:40.078522 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 44448 win 31856 <nop,nop,timestamp 2257886 181750861> (DF) (ttl 64, id 72, len 52, bad cksum 9774!)
   205	15:57:40.089227 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 44448:45172(724) ack 546 win 31856 <nop,nop,timestamp 181750863 2257879> (DF) (ttl 53, id 591, len 776, bad cksum 9d99!)
   206	15:57:40.104883 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 45172 win 31856 <nop,nop,timestamp 2257889 181750863> (DF) (ttl 64, id 73, len 52, bad cksum 9773!)
   207	15:57:40.104977 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 45172:45896(724) ack 546 win 31856 <nop,nop,timestamp 181750864 2257879> (DF) (ttl 53, id 593, len 776, bad cksum 9d97!)
   208	15:57:40.109675 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 45896:46620(724) ack 546 win 31856 <nop,nop,timestamp 181750865 2257882> (DF) (ttl 53, id 594, len 776, bad cksum 9d96!)
   209	15:57:40.110285 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 46620 win 31856 <nop,nop,timestamp 2257889 181750864> (DF) (ttl 64, id 74, len 52, bad cksum 9772!)
   210	15:57:40.117312 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 46620:47344(724) ack 546 win 31856 <nop,nop,timestamp 181750866 2257882> (DF) (ttl 53, id 595, len 776, bad cksum 9d95!)
   211	15:57:40.127407 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 47344:48068(724) ack 546 win 31856 <nop,nop,timestamp 181750867 2257884> (DF) (ttl 53, id 596, len 776, bad cksum 9d94!)
   212	15:57:40.128020 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 48068 win 31856 <nop,nop,timestamp 2257892 181750866> (DF) (ttl 64, id 75, len 52, bad cksum 9771!)
   213	15:57:40.136530 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 48068:48792(724) ack 546 win 31856 <nop,nop,timestamp 181750868 2257884> (DF) (ttl 53, id 597, len 776, bad cksum 9d93!)
   214	15:57:40.149350 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 48792:49516(724) ack 546 win 31856 <nop,nop,timestamp 181750869 2257886> (DF) (ttl 53, id 598, len 776, bad cksum 9d92!)
   215	15:57:40.150015 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 49516 win 31856 <nop,nop,timestamp 2257894 181750868> (DF) (ttl 64, id 76, len 52, bad cksum 9770!)
   216	15:57:40.159196 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 49516:50240(724) ack 546 win 31856 <nop,nop,timestamp 181750870 2257886> (DF) (ttl 53, id 599, len 776, bad cksum 9d91!)
   217	15:57:40.171025 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 50240:50964(724) ack 546 win 31856 <nop,nop,timestamp 181750871 2257886> (DF) (ttl 53, id 600, len 776, bad cksum 9d90!)
   218	15:57:40.171645 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 50964 win 31856 <nop,nop,timestamp 2257896 181750870> (DF) (ttl 64, id 77, len 52, bad cksum 976f!)
   219	15:57:40.183087 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 50964:51688(724) ack 546 win 31856 <nop,nop,timestamp 181750872 2257889> (DF) (ttl 53, id 602, len 776, bad cksum 9d8e!)
   220	15:57:40.189748 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 51688:52412(724) ack 546 win 31856 <nop,nop,timestamp 181750873 2257889> (DF) (ttl 53, id 603, len 776, bad cksum 9d8d!)
   221	15:57:40.190368 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 52412 win 31856 <nop,nop,timestamp 2257898 181750872> (DF) (ttl 64, id 78, len 52, bad cksum 976e!)
   222	15:57:40.197634 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 52412:53136(724) ack 546 win 31856 <nop,nop,timestamp 181750874 2257892> (DF) (ttl 53, id 604, len 776, bad cksum 9d8c!)
   223	15:57:40.207983 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 53136:53860(724) ack 546 win 31856 <nop,nop,timestamp 181750875 2257892> (DF) (ttl 53, id 605, len 776, bad cksum 9d8b!)
   224	15:57:40.208629 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 53860 win 31856 <nop,nop,timestamp 2257900 181750874> (DF) (ttl 64, id 79, len 52, bad cksum 976d!)
   225	15:57:40.217093 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 53860:54584(724) ack 546 win 31856 <nop,nop,timestamp 181750876 2257894> (DF) (ttl 53, id 606, len 776, bad cksum 9d8a!)
   226	15:57:40.227687 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 54584:55308(724) ack 546 win 31856 <nop,nop,timestamp 181750877 2257894> (DF) (ttl 53, id 607, len 776, bad cksum 9d89!)
   227	15:57:40.228313 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 55308 win 31856 <nop,nop,timestamp 2257903 181750876> (DF) (ttl 64, id 80, len 52, bad cksum 976c!)
   228	15:57:40.237303 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 55308:56032(724) ack 546 win 31856 <nop,nop,timestamp 181750878 2257896> (DF) (ttl 53, id 608, len 776, bad cksum 9d88!)
   229	15:57:40.247890 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 56032:56756(724) ack 546 win 31856 <nop,nop,timestamp 181750879 2257896> (DF) (ttl 53, id 609, len 776, bad cksum 9d87!)
   230	15:57:40.248511 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 56756 win 31856 <nop,nop,timestamp 2257905 181750878> (DF) (ttl 64, id 81, len 52, bad cksum 976b!)
   231	15:57:40.257504 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 56756:57480(724) ack 546 win 31856 <nop,nop,timestamp 181750880 2257898> (DF) (ttl 53, id 610, len 776, bad cksum 9d86!)
   232	15:57:40.270564 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 57480:58204(724) ack 546 win 31856 <nop,nop,timestamp 181750881 2257898> (DF) (ttl 53, id 612, len 776, bad cksum 9d84!)
   233	15:57:40.271190 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 58204 win 31856 <nop,nop,timestamp 2257907 181750880> (DF) (ttl 64, id 82, len 52, bad cksum 976a!)
   234	15:57:40.276968 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 58204:58928(724) ack 546 win 31856 <nop,nop,timestamp 181750882 2257900> (DF) (ttl 53, id 613, len 776, bad cksum 9d83!)
   235	15:57:40.286334 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 58928:59652(724) ack 546 win 31856 <nop,nop,timestamp 181750883 2257900> (DF) (ttl 53, id 614, len 776, bad cksum 9d82!)
   236	15:57:40.286955 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 59652 win 31856 <nop,nop,timestamp 2257909 181750882> (DF) (ttl 64, id 83, len 52, bad cksum 9769!)
   237	15:57:40.296916 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 59652:60376(724) ack 546 win 31856 <nop,nop,timestamp 181750884 2257903> (DF) (ttl 53, id 615, len 776, bad cksum 9d81!)
   238	15:57:40.306036 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 60376:61100(724) ack 546 win 31856 <nop,nop,timestamp 181750885 2257903> (DF) (ttl 53, id 616, len 776, bad cksum 9d80!)
   239	15:57:40.306665 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 61100 win 31856 <nop,nop,timestamp 2257911 181750884> (DF) (ttl 64, id 84, len 52, bad cksum 9768!)
   240	15:57:40.316882 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 61100:61824(724) ack 546 win 31856 <nop,nop,timestamp 181750886 2257905> (DF) (ttl 53, id 617, len 776, bad cksum 9d7f!)
   241	15:57:40.327720 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 61824:62548(724) ack 546 win 31856 <nop,nop,timestamp 181750887 2257905> (DF) (ttl 53, id 618, len 776, bad cksum 9d7e!)
   242	15:57:40.328329 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 62548 win 31856 <nop,nop,timestamp 2257913 181750886> (DF) (ttl 64, id 85, len 52, bad cksum 9767!)
   243	15:57:40.339287 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 62548:63272(724) ack 546 win 31856 <nop,nop,timestamp 181750888 2257907> (DF) (ttl 53, id 619, len 776, bad cksum 9d7d!)
   244	15:57:40.353835 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 63272:63996(724) ack 546 win 31856 <nop,nop,timestamp 181750889 2257907> (DF) (ttl 53, id 621, len 776, bad cksum 9d7b!)
   245	15:57:40.354448 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 63996 win 31856 <nop,nop,timestamp 2257915 181750888> (DF) (ttl 64, id 86, len 52, bad cksum 9766!)
   246	15:57:40.359266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 63996:64720(724) ack 546 win 31856 <nop,nop,timestamp 181750890 2257909> (DF) (ttl 53, id 622, len 776, bad cksum 9d7a!)
   247	15:57:40.364920 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 64720 win 31856 <nop,nop,timestamp 2257917 181750890> (DF) (ttl 64, id 87, len 52, bad cksum 9765!)
   248	15:57:40.366161 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 64720:65444(724) ack 546 win 31856 <nop,nop,timestamp 181750891 2257909> (DF) (ttl 53, id 623, len 776, bad cksum 9d79!)
   249	15:57:40.376750 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 65444:66168(724) ack 546 win 31856 <nop,nop,timestamp 181750892 2257911> (DF) (ttl 53, id 624, len 776, bad cksum 9d78!)
   250	15:57:40.377360 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 66168 win 31856 <nop,nop,timestamp 2257918 181750891> (DF) (ttl 64, id 88, len 52, bad cksum 9764!)
   251	15:57:40.384641 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 66168:66892(724) ack 546 win 31856 <nop,nop,timestamp 181750893 2257911> (DF) (ttl 53, id 625, len 776, bad cksum 9d77!)
   252	15:57:40.395197 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 66892 win 31856 <nop,nop,timestamp 2257920 181750893> (DF) (ttl 64, id 89, len 52, bad cksum 9763!)
   253	15:57:40.396456 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 66892:67616(724) ack 546 win 31856 <nop,nop,timestamp 181750894 2257911> (DF) (ttl 53, id 626, len 776, bad cksum 9d76!)
   254	15:57:40.404099 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 67616:68340(724) ack 546 win 31856 <nop,nop,timestamp 181750895 2257913> (DF) (ttl 53, id 627, len 776, bad cksum 9d75!)
   255	15:57:40.404947 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 68340 win 31856 <nop,nop,timestamp 2257921 181750894> (DF) (ttl 64, id 90, len 52, bad cksum 9762!)
   256	15:57:40.415911 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 68340:69064(724) ack 546 win 31856 <nop,nop,timestamp 181750896 2257913> (DF) (ttl 53, id 628, len 776, bad cksum 9d74!)
   257	15:57:40.425279 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 69064:69788(724) ack 546 win 31856 <nop,nop,timestamp 181750897 2257915> (DF) (ttl 53, id 629, len 776, bad cksum 9d73!)
   258	15:57:40.425886 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 69788 win 31856 <nop,nop,timestamp 2257923 181750896> (DF) (ttl 64, id 91, len 52, bad cksum 9761!)
   259	15:57:40.439819 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 69788:70512(724) ack 546 win 31856 <nop,nop,timestamp 181750898 2257917> (DF) (ttl 53, id 631, len 776, bad cksum 9d71!)
   260	15:57:40.445731 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 70512:71236(724) ack 546 win 31856 <nop,nop,timestamp 181750899 2257918> (DF) (ttl 53, id 632, len 776, bad cksum 9d70!)
   261	15:57:40.446349 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 71236 win 31856 <nop,nop,timestamp 2257925 181750898> (DF) (ttl 64, id 92, len 52, bad cksum 9760!)
   262	15:57:40.454614 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 71236:71960(724) ack 546 win 31856 <nop,nop,timestamp 181750900 2257918> (DF) (ttl 53, id 633, len 776, bad cksum 9d6f!)
   263	15:57:40.464721 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 71960:72684(724) ack 546 win 31856 <nop,nop,timestamp 181750901 2257920> (DF) (ttl 53, id 634, len 776, bad cksum 9d6e!)
   264	15:57:40.465512 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 72684 win 31856 <nop,nop,timestamp 2257926 181750900> (DF) (ttl 64, id 93, len 52, bad cksum 975f!)
   265	15:57:40.474548 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 72684:73408(724) ack 546 win 31856 <nop,nop,timestamp 181750902 2257921> (DF) (ttl 53, id 635, len 776, bad cksum 9d6d!)
   266	15:57:40.484913 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 73408:74132(724) ack 546 win 31856 <nop,nop,timestamp 181750903 2257921> (DF) (ttl 53, id 636, len 776, bad cksum 9d6c!)
   267	15:57:40.485591 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 73408 win 31856 <nop,nop,timestamp 2257928 181750902> (DF) (ttl 64, id 94, len 52, bad cksum 975e!)
   268	15:57:40.494575 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 74132:74856(724) ack 546 win 31856 <nop,nop,timestamp 181750904 2257923> (DF) (ttl 53, id 637, len 776, bad cksum 9d6b!)
   269	15:57:40.495474 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 74856 win 31856 <nop,nop,timestamp 2257928 181750903> (DF) (ttl 64, id 95, len 52, bad cksum 975d!)
   270	15:57:40.504854 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 74856:75580(724) ack 546 win 31856 <nop,nop,timestamp 181750905 2257923> (DF) (ttl 53, id 638, len 776, bad cksum 9d6a!)
   271	15:57:40.515703 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 75580:76304(724) ack 546 win 31856 <nop,nop,timestamp 181750906 2257925> (DF) (ttl 53, id 639, len 776, bad cksum 9d69!)
   272	15:57:40.516308 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 76304 win 31856 <nop,nop,timestamp 2257931 181750905> (DF) (ttl 64, id 96, len 52, bad cksum 975c!)
   273	15:57:40.527766 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 76304:77028(724) ack 546 win 31856 <nop,nop,timestamp 181750907 2257925> (DF) (ttl 53, id 641, len 776, bad cksum 9d67!)
   274	15:57:40.534931 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 77028:77752(724) ack 546 win 31856 <nop,nop,timestamp 181750908 2257926> (DF) (ttl 53, id 642, len 776, bad cksum 9d66!)
   275	15:57:40.535593 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 77752 win 31856 <nop,nop,timestamp 2257933 181750907> (DF) (ttl 64, id 97, len 52, bad cksum 975b!)
   276	15:57:40.544792 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 77752:78476(724) ack 546 win 31856 <nop,nop,timestamp 181750909 2257926> (DF) (ttl 53, id 643, len 776, bad cksum 9d65!)
   277	15:57:40.553638 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 78476:79200(724) ack 546 win 31856 <nop,nop,timestamp 181750910 2257928> (DF) (ttl 53, id 644, len 776, bad cksum 9d64!)
   278	15:57:40.554309 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 79200 win 31856 <nop,nop,timestamp 2257934 181750909> (DF) (ttl 64, id 98, len 52, bad cksum 975a!)
   279	15:57:40.563250 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 79200:79924(724) ack 546 win 31856 <nop,nop,timestamp 181750911 2257928> (DF) (ttl 53, id 645, len 776, bad cksum 9d63!)
   280	15:57:40.564887 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 79924 win 31856 <nop,nop,timestamp 2257936 181750911> (DF) (ttl 64, id 99, len 52, bad cksum 9759!)
   281	15:57:40.573836 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 79924:80648(724) ack 546 win 31856 <nop,nop,timestamp 181750912 2257928> (DF) (ttl 53, id 646, len 776, bad cksum 9d62!)
   282	15:57:40.583696 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 80648:81372(724) ack 546 win 31856 <nop,nop,timestamp 181750913 2257931> (DF) (ttl 53, id 647, len 776, bad cksum 9d61!)
   283	15:57:40.584314 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 81372 win 31856 <nop,nop,timestamp 2257936 181750912> (DF) (ttl 64, id 100, len 52, bad cksum 9758!)
   284	15:57:40.600459 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 81372:82096(724) ack 546 win 31856 <nop,nop,timestamp 181750914 2257931> (DF) (ttl 53, id 649, len 776, bad cksum 9d5f!)
   285	15:57:40.612052 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 82096:82820(724) ack 546 win 31856 <nop,nop,timestamp 181750915 2257933> (DF) (ttl 53, id 651, len 776, bad cksum 9d5d!)
   286	15:57:40.612667 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 82820 win 31856 <nop,nop,timestamp 2257939 181750914> (DF) (ttl 64, id 101, len 52, bad cksum 9757!)
   287	15:57:40.617442 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 82820:83544(724) ack 546 win 31856 <nop,nop,timestamp 181750916 2257933> (DF) (ttl 53, id 652, len 776, bad cksum 9d5c!)
   288	15:57:40.623614 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 83544:84268(724) ack 546 win 31856 <nop,nop,timestamp 181750917 2257934> (DF) (ttl 53, id 653, len 776, bad cksum 9d5b!)
   289	15:57:40.624263 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 84268 win 31856 <nop,nop,timestamp 2257940 181750916> (DF) (ttl 64, id 102, len 52, bad cksum 9756!)
   290	15:57:40.632512 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 84268:84992(724) ack 546 win 31856 <nop,nop,timestamp 181750918 2257936> (DF) (ttl 53, id 654, len 776, bad cksum 9d5a!)
   291	15:57:40.642345 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 84992:85716(724) ack 546 win 31856 <nop,nop,timestamp 181750918 2257936> (DF) (ttl 53, id 655, len 776, bad cksum 9d59!)
   292	15:57:40.642975 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 85716 win 31856 <nop,nop,timestamp 2257942 181750918> (DF) (ttl 64, id 103, len 52, bad cksum 9755!)
   293	15:57:40.651446 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 85716:86440(724) ack 546 win 31856 <nop,nop,timestamp 181750919 2257936> (DF) (ttl 53, id 656, len 776, bad cksum 9d58!)
   294	15:57:40.660815 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 86440:87164(724) ack 546 win 31856 <nop,nop,timestamp 181750920 2257936> (DF) (ttl 53, id 657, len 776, bad cksum 9d57!)
   295	15:57:40.661428 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 87164 win 31856 <nop,nop,timestamp 2257944 181750919> (DF) (ttl 64, id 104, len 52, bad cksum 9754!)
   296	15:57:40.669433 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 87164:87888(724) ack 546 win 31856 <nop,nop,timestamp 181750921 2257936> (DF) (ttl 53, id 658, len 776, bad cksum 9d56!)
   297	15:57:40.680030 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 87888:88612(724) ack 546 win 31856 <nop,nop,timestamp 181750922 2257939> (DF) (ttl 53, id 659, len 776, bad cksum 9d55!)
   298	15:57:40.680640 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 88612 win 31856 <nop,nop,timestamp 2257946 181750921> (DF) (ttl 64, id 105, len 52, bad cksum 9753!)
   299	15:57:40.692848 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 88612:89336(724) ack 546 win 31856 <nop,nop,timestamp 181750923 2257940> (DF) (ttl 53, id 661, len 776, bad cksum 9d53!)
   300	15:57:40.700232 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 89336:90060(724) ack 546 win 31856 <nop,nop,timestamp 181750924 2257940> (DF) (ttl 53, id 662, len 776, bad cksum 9d52!)
   301	15:57:40.700846 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 90060 win 31856 <nop,nop,timestamp 2257948 181750923> (DF) (ttl 64, id 106, len 52, bad cksum 9752!)
   302	15:57:40.709835 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 90060:90784(724) ack 546 win 31856 <nop,nop,timestamp 181750925 2257942> (DF) (ttl 53, id 663, len 776, bad cksum 9d51!)
   303	15:57:40.719703 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 90784:91508(724) ack 546 win 31856 <nop,nop,timestamp 181750926 2257942> (DF) (ttl 53, id 664, len 776, bad cksum 9d50!)
   304	15:57:40.720318 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 91508 win 31856 <nop,nop,timestamp 2257950 181750925> (DF) (ttl 64, id 107, len 52, bad cksum 9751!)
   305	15:57:40.729302 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 91508:92232(724) ack 546 win 31856 <nop,nop,timestamp 181750927 2257944> (DF) (ttl 53, id 665, len 776, bad cksum 9d4f!)
   306	15:57:40.739181 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 92232:92956(724) ack 546 win 31856 <nop,nop,timestamp 181750928 2257944> (DF) (ttl 53, id 666, len 776, bad cksum 9d4e!)
   307	15:57:40.739793 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 92956 win 31856 <nop,nop,timestamp 2257952 181750927> (DF) (ttl 64, id 108, len 52, bad cksum 9750!)
   308	15:57:40.749504 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 92956:93680(724) ack 546 win 31856 <nop,nop,timestamp 181750929 2257946> (DF) (ttl 53, id 667, len 776, bad cksum 9d4d!)
   309	15:57:40.757639 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 93680:94404(724) ack 546 win 31856 <nop,nop,timestamp 181750930 2257946> (DF) (ttl 53, id 668, len 776, bad cksum 9d4c!)
   310	15:57:40.758243 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 94404 win 31856 <nop,nop,timestamp 2257954 181750929> (DF) (ttl 64, id 109, len 52, bad cksum 974f!)
   311	15:57:40.767249 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 94404:95128(724) ack 546 win 31856 <nop,nop,timestamp 181750931 2257948> (DF) (ttl 53, id 669, len 776, bad cksum 9d4b!)
   312	15:57:40.779808 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 95128:95852(724) ack 546 win 31856 <nop,nop,timestamp 181750932 2257948> (DF) (ttl 53, id 671, len 776, bad cksum 9d49!)
   313	15:57:40.780434 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 95852 win 31856 <nop,nop,timestamp 2257956 181750931> (DF) (ttl 64, id 110, len 52, bad cksum 974e!)
   314	15:57:40.787447 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 95852:96576(724) ack 546 win 31856 <nop,nop,timestamp 181750933 2257948> (DF) (ttl 53, id 672, len 776, bad cksum 9d48!)
   315	15:57:40.796403 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 96576:97300(724) ack 546 win 31856 <nop,nop,timestamp 181750934 2257950> (DF) (ttl 53, id 673, len 776, bad cksum 9d47!)
   316	15:57:40.797011 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 97300 win 31856 <nop,nop,timestamp 2257958 181750933> (DF) (ttl 64, id 111, len 52, bad cksum 974d!)
   317	15:57:40.806419 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 97300:98024(724) ack 546 win 31856 <nop,nop,timestamp 181750935 2257952> (DF) (ttl 53, id 674, len 776, bad cksum 9d46!)
   318	15:57:40.819253 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 98024:98748(724) ack 546 win 31856 <nop,nop,timestamp 181750936 2257952> (DF) (ttl 53, id 675, len 776, bad cksum 9d45!)
   319	15:57:40.819855 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 98748 win 31856 <nop,nop,timestamp 2257960 181750935> (DF) (ttl 64, id 112, len 52, bad cksum 974c!)
   320	15:57:40.827108 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 98748:99472(724) ack 546 win 31856 <nop,nop,timestamp 181750937 2257954> (DF) (ttl 53, id 676, len 776, bad cksum 9d44!)
   321	15:57:40.835009 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 99472:100196(724) ack 546 win 31856 <nop,nop,timestamp 181750938 2257954> (DF) (ttl 53, id 677, len 776, bad cksum 9d43!)
   322	15:57:40.835660 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 100196 win 31856 <nop,nop,timestamp 2257962 181750937> (DF) (ttl 64, id 113, len 52, bad cksum 974b!)
   323	15:57:40.844369 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 100196:100920(724) ack 546 win 31856 <nop,nop,timestamp 181750939 2257954> (DF) (ttl 53, id 678, len 776, bad cksum 9d42!)
   324	15:57:40.854974 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 100920 win 31856 <nop,nop,timestamp 2257964 181750939> (DF) (ttl 64, id 114, len 52, bad cksum 974a!)
   325	15:57:40.857422 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 100920:101644(724) ack 546 win 31856 <nop,nop,timestamp 181750940 2257956> (DF) (ttl 53, id 679, len 776, bad cksum 9d41!)
   326	15:57:40.877146 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 101644:102368(724) ack 546 win 31856 <nop,nop,timestamp 181750941 2257958> (DF) (ttl 53, id 682, len 776, bad cksum 9d3e!)
   327	15:57:40.880243 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 102368 win 31856 <nop,nop,timestamp 2257965 181750940> (DF) (ttl 64, id 115, len 52, bad cksum 9749!)
   328	15:57:40.881803 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 102368:103092(724) ack 546 win 31856 <nop,nop,timestamp 181750942 2257958> (DF) (ttl 53, id 683, len 776, bad cksum 9d3d!)
   329	15:57:40.884923 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 103092 win 31856 <nop,nop,timestamp 2257967 181750942> (DF) (ttl 64, id 116, len 52, bad cksum 9748!)
   330	15:57:40.886823 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 103092:103816(724) ack 546 win 31856 <nop,nop,timestamp 181750943 2257958> (DF) (ttl 53, id 684, len 776, bad cksum 9d3c!)
   331	15:57:40.895355 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 103816:104540(724) ack 546 win 31856 <nop,nop,timestamp 181750944 2257960> (DF) (ttl 53, id 685, len 776, bad cksum 9d3b!)
   332	15:57:40.895970 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 104540 win 31856 <nop,nop,timestamp 2257968 181750943> (DF) (ttl 64, id 117, len 52, bad cksum 9747!)
   333	15:57:40.914324 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 104540:105264(724) ack 546 win 31856 <nop,nop,timestamp 181750945 2257962> (DF) (ttl 53, id 686, len 776, bad cksum 9d3a!)
   334	15:57:40.919252 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 105264:105988(724) ack 546 win 31856 <nop,nop,timestamp 181750946 2257962> (DF) (ttl 53, id 687, len 776, bad cksum 9d39!)
   335	15:57:40.919853 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 105988 win 31856 <nop,nop,timestamp 2257969 181750945> (DF) (ttl 64, id 118, len 52, bad cksum 9746!)
   336	15:57:40.927629 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 105988:106712(724) ack 546 win 31856 <nop,nop,timestamp 181750947 2257964> (DF) (ttl 53, id 688, len 776, bad cksum 9d38!)
   337	15:57:40.937978 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 106712:107436(724) ack 546 win 31856 <nop,nop,timestamp 181750948 2257964> (DF) (ttl 53, id 689, len 776, bad cksum 9d37!)
   338	15:57:40.938593 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 107436 win 31856 <nop,nop,timestamp 2257972 181750947> (DF) (ttl 64, id 119, len 52, bad cksum 9745!)
   339	15:57:40.956956 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 107436:108160(724) ack 546 win 31856 <nop,nop,timestamp 181750949 2257964> (DF) (ttl 53, id 691, len 776, bad cksum 9d35!)
   340	15:57:40.961636 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 108160:108884(724) ack 546 win 31856 <nop,nop,timestamp 181750950 2257967> (DF) (ttl 53, id 692, len 776, bad cksum 9d34!)
   341	15:57:40.962233 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 108884 win 31856 <nop,nop,timestamp 2257974 181750949> (DF) (ttl 64, id 120, len 52, bad cksum 9744!)
   342	15:57:40.966067 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 108884:109608(724) ack 546 win 31856 <nop,nop,timestamp 181750950 2257968> (DF) (ttl 53, id 693, len 776, bad cksum 9d33!)
   343	15:57:40.976179 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 109608:110332(724) ack 546 win 31856 <nop,nop,timestamp 181750951 2257968> (DF) (ttl 53, id 694, len 776, bad cksum 9d32!)
   344	15:57:40.976783 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 110332 win 31856 <nop,nop,timestamp 2257977 181750950> (DF) (ttl 64, id 121, len 52, bad cksum 9743!)
   345	15:57:40.991686 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 110332:111056(724) ack 546 win 31856 <nop,nop,timestamp 181750952 2257968> (DF) (ttl 53, id 695, len 776, bad cksum 9d31!)
   346	15:57:40.997618 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 111056:111780(724) ack 546 win 31856 <nop,nop,timestamp 181750953 2257969> (DF) (ttl 53, id 696, len 776, bad cksum 9d30!)
   347	15:57:40.998226 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 111780 win 31856 <nop,nop,timestamp 2257979 181750952> (DF) (ttl 64, id 122, len 52, bad cksum 9742!)
   348	15:57:41.005491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 111780:112504(724) ack 546 win 31856 <nop,nop,timestamp 181750954 2257969> (DF) (ttl 53, id 697, len 776, bad cksum 9d2f!)
   349	15:57:41.018802 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 112504:113228(724) ack 546 win 31856 <nop,nop,timestamp 181750955 2257972> (DF) (ttl 53, id 698, len 776, bad cksum 9d2e!)
   350	15:57:41.019433 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 113228 win 31856 <nop,nop,timestamp 2257982 181750954> (DF) (ttl 64, id 123, len 52, bad cksum 9741!)
   351	15:57:41.028150 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 113228:113952(724) ack 546 win 31856 <nop,nop,timestamp 181750956 2257972> (DF) (ttl 53, id 699, len 776, bad cksum 9d2d!)
   352	15:57:41.039981 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 113952:114676(724) ack 546 win 31856 <nop,nop,timestamp 181750957 2257974> (DF) (ttl 53, id 701, len 776, bad cksum 9d2b!)
   353	15:57:41.040597 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 114676 win 31856 <nop,nop,timestamp 2257984 181750956> (DF) (ttl 64, id 124, len 52, bad cksum 9740!)
   354	15:57:41.044659 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 114676:115400(724) ack 546 win 31856 <nop,nop,timestamp 181750958 2257974> (DF) (ttl 53, id 702, len 776, bad cksum 9d2a!)
   355	15:57:41.050827 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 115400:116124(724) ack 546 win 31856 <nop,nop,timestamp 181750959 2257977> (DF) (ttl 53, id 703, len 776, bad cksum 9d29!)
   356	15:57:41.051442 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 116124 win 31856 <nop,nop,timestamp 2257985 181750958> (DF) (ttl 64, id 125, len 52, bad cksum 973f!)
   357	15:57:41.059930 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 116124:116848(724) ack 546 win 31856 <nop,nop,timestamp 181750960 2257977> (DF) (ttl 53, id 704, len 776, bad cksum 9d28!)
   358	15:57:41.069064 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 116848:117572(724) ack 546 win 31856 <nop,nop,timestamp 181750961 2257979> (DF) (ttl 53, id 705, len 776, bad cksum 9d27!)
   359	15:57:41.069681 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 117572 win 31856 <nop,nop,timestamp 2257987 181750960> (DF) (ttl 64, id 126, len 52, bad cksum 973e!)
   360	15:57:41.077429 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 117572:118296(724) ack 546 win 31856 <nop,nop,timestamp 181750962 2257979> (DF) (ttl 53, id 706, len 776, bad cksum 9d26!)
   361	15:57:41.088756 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 118296:119020(724) ack 546 win 31856 <nop,nop,timestamp 181750963 2257982> (DF) (ttl 53, id 707, len 776, bad cksum 9d25!)
   362	15:57:41.089372 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 119020 win 31856 <nop,nop,timestamp 2257989 181750962> (DF) (ttl 64, id 127, len 52, bad cksum 973d!)
   363	15:57:41.098627 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 119020:119744(724) ack 546 win 31856 <nop,nop,timestamp 181750964 2257982> (DF) (ttl 53, id 708, len 776, bad cksum 9d24!)
   364	15:57:41.107981 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 119744:120468(724) ack 546 win 31856 <nop,nop,timestamp 181750965 2257982> (DF) (ttl 53, id 709, len 776, bad cksum 9d23!)
   365	15:57:41.108617 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 120468 win 31856 <nop,nop,timestamp 2257991 181750964> (DF) (ttl 64, id 128, len 52, bad cksum 973c!)
   366	15:57:41.124487 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 120468:121192(724) ack 546 win 31856 <nop,nop,timestamp 181750966 2257985> (DF) (ttl 53, id 711, len 776, bad cksum 9d21!)
   367	15:57:41.131631 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 121192:121916(724) ack 546 win 31856 <nop,nop,timestamp 181750967 2257985> (DF) (ttl 53, id 712, len 776, bad cksum 9d20!)
   368	15:57:41.132237 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 121916 win 31856 <nop,nop,timestamp 2257992 181750966> (DF) (ttl 64, id 129, len 52, bad cksum 973b!)
   369	15:57:41.136798 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 121916:122640(724) ack 546 win 31856 <nop,nop,timestamp 181750968 2257987> (DF) (ttl 53, id 713, len 776, bad cksum 9d1f!)
   370	15:57:41.146421 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 122640:123364(724) ack 546 win 31856 <nop,nop,timestamp 181750969 2257987> (DF) (ttl 53, id 714, len 776, bad cksum 9d1e!)
   371	15:57:41.147034 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 123364 win 31856 <nop,nop,timestamp 2257995 181750968> (DF) (ttl 64, id 130, len 52, bad cksum 973a!)
   372	15:57:41.156762 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 123364:124088(724) ack 546 win 31856 <nop,nop,timestamp 181750970 2257989> (DF) (ttl 53, id 715, len 776, bad cksum 9d1d!)
   373	15:57:41.167362 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 124088:124812(724) ack 546 win 31856 <nop,nop,timestamp 181750971 2257989> (DF) (ttl 53, id 716, len 776, bad cksum 9d1c!)
   374	15:57:41.167979 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 124812 win 31856 <nop,nop,timestamp 2257997 181750970> (DF) (ttl 64, id 131, len 52, bad cksum 9739!)
   375	15:57:41.176219 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 124812:125536(724) ack 546 win 31856 <nop,nop,timestamp 181750972 2257991> (DF) (ttl 53, id 717, len 776, bad cksum 9d1b!)
   376	15:57:41.187066 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 125536:126260(724) ack 546 win 31856 <nop,nop,timestamp 181750973 2257991> (DF) (ttl 53, id 718, len 776, bad cksum 9d1a!)
   377	15:57:41.187702 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 126260 win 31856 <nop,nop,timestamp 2257999 181750972> (DF) (ttl 64, id 132, len 52, bad cksum 9738!)
   378	15:57:41.199147 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 126260:126984(724) ack 546 win 31856 <nop,nop,timestamp 181750974 2257991> (DF) (ttl 53, id 719, len 776, bad cksum 9d19!)
   379	15:57:41.211707 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 126984:127708(724) ack 546 win 31856 <nop,nop,timestamp 181750975 2257992> (DF) (ttl 53, id 721, len 776, bad cksum 9d17!)
   380	15:57:41.212344 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 127708 win 31856 <nop,nop,timestamp 2258001 181750974> (DF) (ttl 64, id 133, len 52, bad cksum 9737!)
   381	15:57:41.218353 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 127708:128432(724) ack 546 win 31856 <nop,nop,timestamp 181750976 2257995> (DF) (ttl 53, id 722, len 776, bad cksum 9d16!)
   382	15:57:41.226974 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 128432:129156(724) ack 546 win 31856 <nop,nop,timestamp 181750977 2257995> (DF) (ttl 53, id 723, len 776, bad cksum 9d15!)
   383	15:57:41.227586 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 129156 win 31856 <nop,nop,timestamp 2258004 181750976> (DF) (ttl 64, id 134, len 52, bad cksum 9736!)
   384	15:57:41.237317 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 129156:129880(724) ack 546 win 31856 <nop,nop,timestamp 181750978 2257997> (DF) (ttl 53, id 724, len 776, bad cksum 9d14!)
   385	15:57:41.245458 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 129880:130604(724) ack 546 win 31856 <nop,nop,timestamp 181750979 2257997> (DF) (ttl 53, id 725, len 776, bad cksum 9d13!)
   386	15:57:41.246085 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 130604 win 31856 <nop,nop,timestamp 2258006 181750978> (DF) (ttl 64, id 135, len 52, bad cksum 9735!)
   387	15:57:41.256300 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 130604:131328(724) ack 546 win 31856 <nop,nop,timestamp 181750980 2257999> (DF) (ttl 53, id 726, len 776, bad cksum 9d12!)
   388	15:57:41.266648 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 131328:132052(724) ack 546 win 31856 <nop,nop,timestamp 181750981 2257999> (DF) (ttl 53, id 727, len 776, bad cksum 9d11!)
   389	15:57:41.267265 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 132052 win 31856 <nop,nop,timestamp 2258008 181750980> (DF) (ttl 64, id 136, len 52, bad cksum 9734!)
   390	15:57:41.275509 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 132052:132776(724) ack 546 win 31856 <nop,nop,timestamp 181750982 2257999> (DF) (ttl 53, id 728, len 776, bad cksum 9d10!)
   391	15:57:41.289316 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 132776:133500(724) ack 546 win 31856 <nop,nop,timestamp 181750983 2258001> (DF) (ttl 53, id 730, len 776, bad cksum 9d0e!)
   392	15:57:41.289937 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 133500 win 31856 <nop,nop,timestamp 2258010 181750982> (DF) (ttl 64, id 137, len 52, bad cksum 9733!)
   393	15:57:41.295712 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 133500:134224(724) ack 546 win 31856 <nop,nop,timestamp 181750984 2258004> (DF) (ttl 53, id 731, len 776, bad cksum 9d0d!)
   394	15:57:41.304095 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 134224:134948(724) ack 546 win 31856 <nop,nop,timestamp 181750985 2258004> (DF) (ttl 53, id 732, len 776, bad cksum 9d0c!)
   395	15:57:41.304942 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 134948 win 31856 <nop,nop,timestamp 2258011 181750984> (DF) (ttl 64, id 138, len 52, bad cksum 9732!)
   396	15:57:41.314201 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 134948:135672(724) ack 546 win 31856 <nop,nop,timestamp 181750986 2258006> (DF) (ttl 53, id 733, len 776, bad cksum 9d0b!)
   397	15:57:41.326515 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 135672:136396(724) ack 546 win 31856 <nop,nop,timestamp 181750987 2258006> (DF) (ttl 53, id 734, len 776, bad cksum 9d0a!)
   398	15:57:41.327127 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 136396 win 31856 <nop,nop,timestamp 2258013 181750986> (DF) (ttl 64, id 139, len 52, bad cksum 9731!)
   399	15:57:41.333409 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 136396:137120(724) ack 546 win 31856 <nop,nop,timestamp 181750988 2258008> (DF) (ttl 53, id 735, len 776, bad cksum 9d09!)
   400	15:57:41.334986 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 137120 win 31856 <nop,nop,timestamp 2258015 181750988> (DF) (ttl 64, id 140, len 52, bad cksum 9730!)
   401	15:57:41.344499 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 137120:137844(724) ack 546 win 31856 <nop,nop,timestamp 181750989 2258008> (DF) (ttl 53, id 736, len 776, bad cksum 9d08!)
   402	15:57:41.354852 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 137844:138568(724) ack 546 win 31856 <nop,nop,timestamp 181750990 2258008> (DF) (ttl 53, id 737, len 776, bad cksum 9d07!)
   403	15:57:41.355518 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 138568 win 31856 <nop,nop,timestamp 2258015 181750989> (DF) (ttl 64, id 141, len 52, bad cksum 972f!)
   404	15:57:41.363720 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 138568:139292(724) ack 546 win 31856 <nop,nop,timestamp 181750991 2258010> (DF) (ttl 53, id 738, len 776, bad cksum 9d06!)
   405	15:57:41.373814 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 139292:140016(724) ack 546 win 31856 <nop,nop,timestamp 181750992 2258011> (DF) (ttl 53, id 739, len 776, bad cksum 9d05!)
   406	15:57:41.374439 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 140016 win 31856 <nop,nop,timestamp 2258017 181750991> (DF) (ttl 64, id 142, len 52, bad cksum 972e!)
   407	15:57:41.382674 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 140016:140740(724) ack 546 win 31856 <nop,nop,timestamp 181750993 2258011> (DF) (ttl 53, id 740, len 776, bad cksum 9d04!)
   408	15:57:41.384919 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 140740 win 31856 <nop,nop,timestamp 2258019 181750993> (DF) (ttl 64, id 143, len 52, bad cksum 972d!)
   409	15:57:41.392542 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 140740:141464(724) ack 546 win 31856 <nop,nop,timestamp 181750994 2258011> (DF) (ttl 53, id 741, len 776, bad cksum 9d03!)
   410	15:57:41.403402 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 141464:142188(724) ack 546 win 31856 <nop,nop,timestamp 181750995 2258015> (DF) (ttl 53, id 742, len 776, bad cksum 9d02!)
   411	15:57:41.404054 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 142188 win 31856 <nop,nop,timestamp 2258020 181750994> (DF) (ttl 64, id 144, len 52, bad cksum 972c!)
   412	15:57:41.412989 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 142188:142912(724) ack 546 win 31856 <nop,nop,timestamp 181750996 2258015> (DF) (ttl 53, id 743, len 776, bad cksum 9d01!)
   413	15:57:41.414979 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 142912 win 31856 <nop,nop,timestamp 2258022 181750996> (DF) (ttl 64, id 145, len 52, bad cksum 972b!)
   414	15:57:41.422593 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 142912:143636(724) ack 546 win 31856 <nop,nop,timestamp 181750997 2258015> (DF) (ttl 53, id 744, len 776, bad cksum 9d00!)
   415	15:57:41.432209 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 143636:144360(724) ack 546 win 31856 <nop,nop,timestamp 181750998 2258015> (DF) (ttl 53, id 745, len 776, bad cksum 9cff!)
   416	15:57:41.432830 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 144360 win 31856 <nop,nop,timestamp 2258024 181750997> (DF) (ttl 64, id 146, len 52, bad cksum 972a!)
   417	15:57:41.441564 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 144360:145084(724) ack 546 win 31856 <nop,nop,timestamp 181750999 2258015> (DF) (ttl 53, id 746, len 776, bad cksum 9cfe!)
   418	15:57:41.452160 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 145084:145808(724) ack 546 win 31856 <nop,nop,timestamp 181751000 2258019> (DF) (ttl 53, id 747, len 776, bad cksum 9cfd!)
   419	15:57:41.452773 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 145808 win 31856 <nop,nop,timestamp 2258026 181750999> (DF) (ttl 64, id 147, len 52, bad cksum 9729!)
   420	15:57:41.461535 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 145808:146532(724) ack 546 win 31856 <nop,nop,timestamp 181751001 2258019> (DF) (ttl 53, id 748, len 776, bad cksum 9cfc!)
   421	15:57:41.467652 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 146532 win 31856 <nop,nop,timestamp 2258029 181751001> (DF) (ttl 64, id 148, len 52, bad cksum 9728!)
   422	15:57:41.474851 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 146532:147256(724) ack 546 win 31856 <nop,nop,timestamp 181751002 2258020> (DF) (ttl 53, id 749, len 776, bad cksum 9cfb!)
   423	15:57:41.482218 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 147256:147980(724) ack 546 win 31856 <nop,nop,timestamp 181751003 2258022> (DF) (ttl 53, id 750, len 776, bad cksum 9cfa!)
   424	15:57:41.482840 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 147980 win 31856 <nop,nop,timestamp 2258029 181751002> (DF) (ttl 64, id 149, len 52, bad cksum 9727!)
   425	15:57:41.490603 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 147980:148704(724) ack 546 win 31856 <nop,nop,timestamp 181751003 2258022> (DF) (ttl 53, id 751, len 776, bad cksum 9cf9!)
   426	15:57:41.502426 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 148704:149428(724) ack 546 win 31856 <nop,nop,timestamp 181751004 2258024> (DF) (ttl 53, id 752, len 776, bad cksum 9cf8!)
   427	15:57:41.503047 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 149428 win 31856 <nop,nop,timestamp 2258032 181751003> (DF) (ttl 64, id 150, len 52, bad cksum 9726!)
   428	15:57:41.510052 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 149428:150152(724) ack 546 win 31856 <nop,nop,timestamp 181751005 2258024> (DF) (ttl 53, id 753, len 776, bad cksum 9cf7!)
   429	15:57:41.521150 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 150152:150876(724) ack 546 win 31856 <nop,nop,timestamp 181751006 2258026> (DF) (ttl 53, id 754, len 776, bad cksum 9cf6!)
   430	15:57:41.521777 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 150876 win 31856 <nop,nop,timestamp 2258034 181751005> (DF) (ttl 64, id 151, len 52, bad cksum 9725!)
   431	15:57:41.529520 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 150876:151600(724) ack 546 win 31856 <nop,nop,timestamp 181751007 2258026> (DF) (ttl 53, id 755, len 776, bad cksum 9cf5!)
   432	15:57:41.540117 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 151600:152324(724) ack 546 win 31856 <nop,nop,timestamp 181751008 2258029> (DF) (ttl 53, id 756, len 776, bad cksum 9cf4!)
   433	15:57:41.540741 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 152324 win 31856 <nop,nop,timestamp 2258036 181751007> (DF) (ttl 64, id 152, len 52, bad cksum 9724!)
   434	15:57:41.549974 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 152324:153048(724) ack 546 win 31856 <nop,nop,timestamp 181751009 2258029> (DF) (ttl 53, id 757, len 776, bad cksum 9cf3!)
   435	15:57:41.559836 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 153048:153772(724) ack 546 win 31856 <nop,nop,timestamp 181751010 2258029> (DF) (ttl 53, id 758, len 776, bad cksum 9cf2!)
   436	15:57:41.560454 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 153772 win 31856 <nop,nop,timestamp 2258038 181751009> (DF) (ttl 64, id 153, len 52, bad cksum 9723!)
   437	15:57:41.571175 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 153772:154496(724) ack 546 win 31856 <nop,nop,timestamp 181751011 2258032> (DF) (ttl 53, id 759, len 776, bad cksum 9cf1!)
   438	15:57:41.579286 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 154496:155220(724) ack 546 win 31856 <nop,nop,timestamp 181751012 2258032> (DF) (ttl 53, id 760, len 776, bad cksum 9cf0!)
   439	15:57:41.579923 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 155220 win 31856 <nop,nop,timestamp 2258040 181751011> (DF) (ttl 64, id 154, len 52, bad cksum 9722!)
   440	15:57:41.589387 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 155220:155944(724) ack 546 win 31856 <nop,nop,timestamp 181751013 2258034> (DF) (ttl 53, id 761, len 776, bad cksum 9cef!)
   441	15:57:41.600479 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 155944:156668(724) ack 546 win 31856 <nop,nop,timestamp 181751014 2258034> (DF) (ttl 53, id 762, len 776, bad cksum 9cee!)
   442	15:57:41.601107 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 156668 win 31856 <nop,nop,timestamp 2258042 181751013> (DF) (ttl 64, id 155, len 52, bad cksum 9721!)
   443	15:57:41.609843 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 156668:157392(724) ack 546 win 31856 <nop,nop,timestamp 181751015 2258036> (DF) (ttl 53, id 763, len 776, bad cksum 9ced!)
   444	15:57:41.619719 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 157392:158116(724) ack 546 win 31856 <nop,nop,timestamp 181751016 2258036> (DF) (ttl 53, id 764, len 776, bad cksum 9cec!)
   445	15:57:41.620368 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 158116 win 31856 <nop,nop,timestamp 2258044 181751015> (DF) (ttl 64, id 156, len 52, bad cksum 9720!)
   446	15:57:41.628325 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 158116:158840(724) ack 546 win 31856 <nop,nop,timestamp 181751017 2258038> (DF) (ttl 53, id 765, len 776, bad cksum 9ceb!)
   447	15:57:41.640633 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 158840:159564(724) ack 546 win 31856 <nop,nop,timestamp 181751018 2258038> (DF) (ttl 53, id 766, len 776, bad cksum 9cea!)
   448	15:57:41.641257 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 159564 win 31856 <nop,nop,timestamp 2258046 181751017> (DF) (ttl 64, id 157, len 52, bad cksum 971f!)
   449	15:57:41.649266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 159564:160288(724) ack 546 win 31856 <nop,nop,timestamp 181751019 2258040> (DF) (ttl 53, id 767, len 776, bad cksum 9ce9!)
   450	15:57:41.657888 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 160288:161012(724) ack 546 win 31856 <nop,nop,timestamp 181751020 2258040> (DF) (ttl 53, id 768, len 776, bad cksum 9ce8!)
   451	15:57:41.658510 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 161012 win 31856 <nop,nop,timestamp 2258048 181751019> (DF) (ttl 64, id 158, len 52, bad cksum 971e!)
   452	15:57:41.668486 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 161012:161736(724) ack 546 win 31856 <nop,nop,timestamp 181751021 2258042> (DF) (ttl 53, id 769, len 776, bad cksum 9ce7!)
   453	15:57:41.677598 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 161736:162460(724) ack 546 win 31856 <nop,nop,timestamp 181751022 2258042> (DF) (ttl 53, id 770, len 776, bad cksum 9ce6!)
   454	15:57:41.678238 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 162460 win 31856 <nop,nop,timestamp 2258050 181751021> (DF) (ttl 64, id 159, len 52, bad cksum 971d!)
   455	15:57:41.689179 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 162460:163184(724) ack 546 win 31856 <nop,nop,timestamp 181751023 2258044> (DF) (ttl 53, id 771, len 776, bad cksum 9ce5!)
   456	15:57:41.699276 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 163184:163908(724) ack 546 win 31856 <nop,nop,timestamp 181751024 2258044> (DF) (ttl 53, id 772, len 776, bad cksum 9ce4!)
   457	15:57:41.699904 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 163908 win 31856 <nop,nop,timestamp 2258052 181751023> (DF) (ttl 64, id 160, len 52, bad cksum 971c!)
   458	15:57:41.708876 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 163908:164632(724) ack 546 win 31856 <nop,nop,timestamp 181751025 2258044> (DF) (ttl 53, id 773, len 776, bad cksum 9ce3!)
   459	15:57:41.718497 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 164632:165356(724) ack 546 win 31856 <nop,nop,timestamp 181751026 2258046> (DF) (ttl 53, id 774, len 776, bad cksum 9ce2!)
   460	15:57:41.719122 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 165356 win 31856 <nop,nop,timestamp 2258054 181751025> (DF) (ttl 64, id 161, len 52, bad cksum 971b!)
   461	15:57:41.729824 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 165356:166080(724) ack 546 win 31856 <nop,nop,timestamp 181751027 2258048> (DF) (ttl 53, id 775, len 776, bad cksum 9ce1!)
   462	15:57:41.737221 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 166080:166804(724) ack 546 win 31856 <nop,nop,timestamp 181751028 2258048> (DF) (ttl 53, id 776, len 776, bad cksum 9ce0!)
   463	15:57:41.737842 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 166804 win 31856 <nop,nop,timestamp 2258056 181751027> (DF) (ttl 64, id 162, len 52, bad cksum 971a!)
   464	15:57:41.747815 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 166804:167528(724) ack 546 win 31856 <nop,nop,timestamp 181751029 2258050> (DF) (ttl 53, id 777, len 776, bad cksum 9cdf!)
   465	15:57:41.756922 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 167528:168252(724) ack 546 win 31856 <nop,nop,timestamp 181751030 2258050> (DF) (ttl 53, id 778, len 776, bad cksum 9cde!)
   466	15:57:41.757606 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 168252 win 31856 <nop,nop,timestamp 2258058 181751029> (DF) (ttl 64, id 163, len 52, bad cksum 9719!)
   467	15:57:41.767272 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 168252:168976(724) ack 546 win 31856 <nop,nop,timestamp 181751031 2258052> (DF) (ttl 53, id 779, len 776, bad cksum 9cdd!)
   468	15:57:41.778357 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 168976:169700(724) ack 546 win 31856 <nop,nop,timestamp 181751032 2258052> (DF) (ttl 53, id 780, len 776, bad cksum 9cdc!)
   469	15:57:41.778980 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 169700 win 31856 <nop,nop,timestamp 2258060 181751031> (DF) (ttl 64, id 164, len 52, bad cksum 9718!)
   470	15:57:41.786491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 169700:170424(724) ack 546 win 31856 <nop,nop,timestamp 181751033 2258054> (DF) (ttl 53, id 781, len 776, bad cksum 9cdb!)
   471	15:57:41.797338 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 170424:171148(724) ack 546 win 31856 <nop,nop,timestamp 181751034 2258054> (DF) (ttl 53, id 782, len 776, bad cksum 9cda!)
   472	15:57:41.797957 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 171148 win 31856 <nop,nop,timestamp 2258062 181751033> (DF) (ttl 64, id 165, len 52, bad cksum 9717!)
   473	15:57:41.805708 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 171148:171872(724) ack 546 win 31856 <nop,nop,timestamp 181751035 2258056> (DF) (ttl 53, id 783, len 776, bad cksum 9cd9!)
   474	15:57:41.816055 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 171872:172596(724) ack 546 win 31856 <nop,nop,timestamp 181751036 2258056> (DF) (ttl 53, id 784, len 776, bad cksum 9cd8!)
   475	15:57:41.816708 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 172596 win 31856 <nop,nop,timestamp 2258064 181751035> (DF) (ttl 64, id 166, len 52, bad cksum 9716!)
   476	15:57:41.828622 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 172596:173320(724) ack 546 win 31856 <nop,nop,timestamp 181751037 2258058> (DF) (ttl 53, id 785, len 776, bad cksum 9cd7!)
   477	15:57:41.837496 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 173320:174044(724) ack 546 win 31856 <nop,nop,timestamp 181751038 2258058> (DF) (ttl 53, id 786, len 776, bad cksum 9cd6!)
   478	15:57:41.838120 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 174044 win 31856 <nop,nop,timestamp 2258066 181751037> (DF) (ttl 64, id 167, len 52, bad cksum 9715!)
   479	15:57:41.845652 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 174044:174768(724) ack 546 win 31856 <nop,nop,timestamp 181751039 2258060> (DF) (ttl 53, id 787, len 776, bad cksum 9cd5!)
   480	15:57:41.854480 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 174768:175492(724) ack 546 win 31856 <nop,nop,timestamp 181751040 2258060> (DF) (ttl 53, id 788, len 776, bad cksum 9cd4!)
   481	15:57:41.855365 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 175492 win 31856 <nop,nop,timestamp 2258067 181751039> (DF) (ttl 64, id 168, len 52, bad cksum 9714!)
   482	15:57:41.868801 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 175492:176216(724) ack 546 win 31856 <nop,nop,timestamp 181751041 2258062> (DF) (ttl 53, id 789, len 776, bad cksum 9cd3!)
   483	15:57:41.875194 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 176216:176940(724) ack 546 win 31856 <nop,nop,timestamp 181751042 2258062> (DF) (ttl 53, id 790, len 776, bad cksum 9cd2!)
   484	15:57:41.875821 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 176940 win 31856 <nop,nop,timestamp 2258070 181751041> (DF) (ttl 64, id 169, len 52, bad cksum 9713!)
   485	15:57:41.884548 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 176940:177664(724) ack 546 win 31856 <nop,nop,timestamp 181751043 2258064> (DF) (ttl 53, id 791, len 776, bad cksum 9cd1!)
   486	15:57:41.894980 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 177664 win 31856 <nop,nop,timestamp 2258072 181751043> (DF) (ttl 64, id 170, len 52, bad cksum 9712!)
   487	15:57:41.896130 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 177664:178388(724) ack 546 win 31856 <nop,nop,timestamp 181751044 2258064> (DF) (ttl 53, id 792, len 776, bad cksum 9cd0!)
   488	15:57:41.904515 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 178388:179112(724) ack 546 win 31856 <nop,nop,timestamp 181751045 2258066> (DF) (ttl 53, id 793, len 776, bad cksum 9ccf!)
   489	15:57:41.905353 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 179112 win 31856 <nop,nop,timestamp 2258072 181751044> (DF) (ttl 64, id 171, len 52, bad cksum 9711!)
   490	15:57:41.913368 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 179112:179836(724) ack 546 win 31856 <nop,nop,timestamp 181751046 2258066> (DF) (ttl 53, id 794, len 776, bad cksum 9cce!)
   491	15:57:41.914982 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 179836 win 31856 <nop,nop,timestamp 2258075 181751046> (DF) (ttl 64, id 172, len 52, bad cksum 9710!)
   492	15:57:41.924743 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 179836:180560(724) ack 546 win 31856 <nop,nop,timestamp 181751047 2258067> (DF) (ttl 53, id 795, len 776, bad cksum 9ccd!)
   493	15:57:41.933336 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 180560:181284(724) ack 546 win 31856 <nop,nop,timestamp 181751048 2258067> (DF) (ttl 53, id 796, len 776, bad cksum 9ccc!)
   494	15:57:41.933938 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 181284 win 31856 <nop,nop,timestamp 2258075 181751047> (DF) (ttl 64, id 173, len 52, bad cksum 970f!)
   495	15:57:41.942718 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 181284:182008(724) ack 546 win 31856 <nop,nop,timestamp 181751049 2258070> (DF) (ttl 53, id 797, len 776, bad cksum 9ccb!)
   496	15:57:41.944915 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 182008 win 31856 <nop,nop,timestamp 2258078 181751049> (DF) (ttl 64, id 174, len 52, bad cksum 970e!)
   497	15:57:41.952539 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 182008:182732(724) ack 546 win 31856 <nop,nop,timestamp 181751050 2258070> (DF) (ttl 53, id 798, len 776, bad cksum 9cca!)
   498	15:57:41.966599 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 182732:183456(724) ack 546 win 31856 <nop,nop,timestamp 181751051 2258070> (DF) (ttl 53, id 799, len 776, bad cksum 9cc9!)
   499	15:57:41.967555 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 183456 win 31856 <nop,nop,timestamp 2258079 181751050> (DF) (ttl 64, id 175, len 52, bad cksum 970d!)
   500	15:57:41.976709 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 183456:184180(724) ack 546 win 31856 <nop,nop,timestamp 181751052 2258072> (DF) (ttl 53, id 800, len 776, bad cksum 9cc8!)
   501	15:57:41.982858 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 184180:184904(724) ack 546 win 31856 <nop,nop,timestamp 181751053 2258075> (DF) (ttl 53, id 801, len 776, bad cksum 9cc7!)
   502	15:57:41.983469 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 184904 win 31856 <nop,nop,timestamp 2258080 181751052> (DF) (ttl 64, id 176, len 52, bad cksum 970c!)
   503	15:57:41.994458 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 184904:185628(724) ack 546 win 31856 <nop,nop,timestamp 181751054 2258075> (DF) (ttl 53, id 802, len 776, bad cksum 9cc6!)
   504	15:57:42.002068 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 185628:186352(724) ack 546 win 31856 <nop,nop,timestamp 181751055 2258075> (DF) (ttl 53, id 803, len 776, bad cksum 9cc5!)
   505	15:57:42.002640 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 186352 win 31856 <nop,nop,timestamp 2258082 181751054> (DF) (ttl 64, id 177, len 52, bad cksum 970b!)
   506	15:57:42.011929 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 186352:187076(724) ack 546 win 31856 <nop,nop,timestamp 181751056 2258078> (DF) (ttl 53, id 804, len 776, bad cksum 9cc4!)
   507	15:57:42.020558 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 187076:187800(724) ack 546 win 31856 <nop,nop,timestamp 181751056 2258078> (DF) (ttl 53, id 805, len 776, bad cksum 9cc3!)
   508	15:57:42.021145 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 187800 win 31856 <nop,nop,timestamp 2258085 181751056> (DF) (ttl 64, id 178, len 52, bad cksum 970a!)
   509	15:57:42.030882 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 187800:188524(724) ack 546 win 31856 <nop,nop,timestamp 181751057 2258078> (DF) (ttl 53, id 806, len 776, bad cksum 9cc2!)
   510	15:57:42.040747 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 188524:189248(724) ack 546 win 31856 <nop,nop,timestamp 181751058 2258079> (DF) (ttl 53, id 807, len 776, bad cksum 9cc1!)
   511	15:57:42.041396 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 189248 win 31856 <nop,nop,timestamp 2258087 181751057> (DF) (ttl 64, id 179, len 52, bad cksum 9709!)
   512	15:57:42.050112 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 189248:189972(724) ack 546 win 31856 <nop,nop,timestamp 181751059 2258080> (DF) (ttl 53, id 808, len 776, bad cksum 9cc0!)
   513	15:57:42.059971 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 189972:190696(724) ack 546 win 31856 <nop,nop,timestamp 181751060 2258080> (DF) (ttl 53, id 809, len 776, bad cksum 9cbf!)
   514	15:57:42.060538 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 190696 win 31856 <nop,nop,timestamp 2258089 181751059> (DF) (ttl 64, id 180, len 52, bad cksum 9708!)
   515	15:57:42.070065 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 190696:191420(724) ack 546 win 31856 <nop,nop,timestamp 181751061 2258082> (DF) (ttl 53, id 810, len 776, bad cksum 9cbe!)
   516	15:57:42.079700 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 191420:192144(724) ack 546 win 31856 <nop,nop,timestamp 181751062 2258082> (DF) (ttl 53, id 811, len 776, bad cksum 9cbd!)
   517	15:57:42.080322 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 192144 win 31856 <nop,nop,timestamp 2258091 181751061> (DF) (ttl 64, id 181, len 52, bad cksum 9707!)
   518	15:57:42.090266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 192144:192868(724) ack 546 win 31856 <nop,nop,timestamp 181751063 2258085> (DF) (ttl 53, id 812, len 776, bad cksum 9cbc!)
   519	15:57:42.100385 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 192868:193592(724) ack 546 win 31856 <nop,nop,timestamp 181751064 2258085> (DF) (ttl 53, id 813, len 776, bad cksum 9cbb!)
   520	15:57:42.101011 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 193592 win 31856 <nop,nop,timestamp 2258093 181751063> (DF) (ttl 64, id 182, len 52, bad cksum 9706!)
   521	15:57:42.109730 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 193592:194316(724) ack 546 win 31856 <nop,nop,timestamp 181751065 2258087> (DF) (ttl 53, id 814, len 776, bad cksum 9cba!)
   522	15:57:42.119340 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 194316:195040(724) ack 546 win 31856 <nop,nop,timestamp 181751066 2258087> (DF) (ttl 53, id 815, len 776, bad cksum 9cb9!)
   523	15:57:42.119966 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 195040 win 31856 <nop,nop,timestamp 2258095 181751065> (DF) (ttl 64, id 183, len 52, bad cksum 9705!)
   524	15:57:42.128454 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 195040:195764(724) ack 546 win 31856 <nop,nop,timestamp 181751067 2258089> (DF) (ttl 53, id 816, len 776, bad cksum 9cb8!)
   525	15:57:42.136855 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 195764:196488(724) ack 546 win 31856 <nop,nop,timestamp 181751068 2258089> (DF) (ttl 53, id 817, len 776, bad cksum 9cb7!)
   526	15:57:42.137484 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 196488 win 31856 <nop,nop,timestamp 2258097 181751067> (DF) (ttl 64, id 184, len 52, bad cksum 9704!)
   527	15:57:42.147691 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 196488:197212(724) ack 546 win 31856 <nop,nop,timestamp 181751069 2258091> (DF) (ttl 53, id 818, len 776, bad cksum 9cb6!)
   528	15:57:42.156795 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 197212:197936(724) ack 546 win 31856 <nop,nop,timestamp 181751070 2258091> (DF) (ttl 53, id 819, len 776, bad cksum 9cb5!)
   529	15:57:42.157470 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 197936 win 31856 <nop,nop,timestamp 2258099 181751069> (DF) (ttl 64, id 185, len 52, bad cksum 9703!)
   530	15:57:42.166161 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 197936:198660(724) ack 546 win 31856 <nop,nop,timestamp 181751071 2258093> (DF) (ttl 53, id 820, len 776, bad cksum 9cb4!)
   531	15:57:42.176254 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 198660:199384(724) ack 546 win 31856 <nop,nop,timestamp 181751072 2258093> (DF) (ttl 53, id 821, len 776, bad cksum 9cb3!)
   532	15:57:42.176885 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 199384 win 31856 <nop,nop,timestamp 2258101 181751071> (DF) (ttl 64, id 186, len 52, bad cksum 9702!)
   533	15:57:42.190787 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 199384:200108(724) ack 546 win 31856 <nop,nop,timestamp 181751073 2258093> (DF) (ttl 53, id 822, len 776, bad cksum 9cb2!)
   534	15:57:42.197446 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 200108:200832(724) ack 546 win 31856 <nop,nop,timestamp 181751074 2258095> (DF) (ttl 53, id 823, len 776, bad cksum 9cb1!)
   535	15:57:42.198092 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 200832 win 31856 <nop,nop,timestamp 2258103 181751073> (DF) (ttl 64, id 187, len 52, bad cksum 9701!)
   536	15:57:42.204846 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 200832:201556(724) ack 546 win 31856 <nop,nop,timestamp 181751075 2258097> (DF) (ttl 53, id 824, len 776, bad cksum 9cb0!)
   537	15:57:42.214985 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 201556 win 31856 <nop,nop,timestamp 2258105 181751075> (DF) (ttl 64, id 188, len 52, bad cksum 9700!)
   538	15:57:42.218128 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 201556:202280(724) ack 546 win 31856 <nop,nop,timestamp 181751076 2258097> (DF) (ttl 53, id 825, len 776, bad cksum 9caf!)
   539	15:57:42.224809 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 202280:203004(724) ack 546 win 31856 <nop,nop,timestamp 181751077 2258097> (DF) (ttl 53, id 826, len 776, bad cksum 9cae!)
   540	15:57:42.225570 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 203004 win 31856 <nop,nop,timestamp 2258105 181751076> (DF) (ttl 64, id 189, len 52, bad cksum 96ff!)
   541	15:57:42.234156 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 203004:203728(724) ack 546 win 31856 <nop,nop,timestamp 181751078 2258099> (DF) (ttl 53, id 827, len 776, bad cksum 9cad!)
   542	15:57:42.244377 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 203728:204452(724) ack 546 win 31856 <nop,nop,timestamp 181751079 2258101> (DF) (ttl 53, id 828, len 776, bad cksum 9cac!)
   543	15:57:42.245228 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 204452 win 31856 <nop,nop,timestamp 2258107 181751078> (DF) (ttl 64, id 190, len 52, bad cksum 96fe!)
   544	15:57:42.257303 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 204452:205176(724) ack 546 win 31856 <nop,nop,timestamp 181751080 2258101> (DF) (ttl 53, id 829, len 776, bad cksum 9cab!)
   545	15:57:42.265688 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 205176:205900(724) ack 546 win 31856 <nop,nop,timestamp 181751081 2258103> (DF) (ttl 53, id 830, len 776, bad cksum 9caa!)
   546	15:57:42.266285 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 205900 win 31856 <nop,nop,timestamp 2258109 181751080> (DF) (ttl 64, id 191, len 52, bad cksum 96fd!)
   547	15:57:42.274057 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 205900:206624(724) ack 546 win 31856 <nop,nop,timestamp 181751082 2258103> (DF) (ttl 53, id 831, len 776, bad cksum 9ca9!)
   548	15:57:42.284873 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 206624 win 31856 <nop,nop,timestamp 2258111 181751082> (DF) (ttl 64, id 192, len 52, bad cksum 96fc!)
   549	15:57:42.287613 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 206624:207348(724) ack 546 win 31856 <nop,nop,timestamp 181751083 2258105> (DF) (ttl 53, id 832, len 776, bad cksum 9ca8!)
   550	15:57:42.293783 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 207348:208072(724) ack 546 win 31856 <nop,nop,timestamp 181751084 2258105> (DF) (ttl 53, id 833, len 776, bad cksum 9ca7!)
   551	15:57:42.294375 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 208072 win 31856 <nop,nop,timestamp 2258111 181751083> (DF) (ttl 64, id 193, len 52, bad cksum 96fb!)
   552	15:57:42.306588 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 208072:208796(724) ack 546 win 31856 <nop,nop,timestamp 181751085 2258105> (DF) (ttl 53, id 834, len 776, bad cksum 9ca6!)
   553	15:57:42.312509 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 208796:209520(724) ack 546 win 31856 <nop,nop,timestamp 181751086 2258107> (DF) (ttl 53, id 835, len 776, bad cksum 9ca5!)
   554	15:57:42.313087 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 209520 win 31856 <nop,nop,timestamp 2258113 181751085> (DF) (ttl 64, id 194, len 52, bad cksum 96fa!)
   555	15:57:42.321859 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 209520:210244(724) ack 546 win 31856 <nop,nop,timestamp 181751087 2258107> (DF) (ttl 53, id 836, len 776, bad cksum 9ca4!)
   556	15:57:42.334667 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 210244:210968(724) ack 546 win 31856 <nop,nop,timestamp 181751088 2258109> (DF) (ttl 53, id 837, len 776, bad cksum 9ca3!)
   557	15:57:42.335455 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 210968 win 31856 <nop,nop,timestamp 2258116 181751087> (DF) (ttl 64, id 195, len 52, bad cksum 96f9!)
   558	15:57:42.341337 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 210968:211692(724) ack 546 win 31856 <nop,nop,timestamp 181751089 2258109> (DF) (ttl 53, id 838, len 776, bad cksum 9ca2!)
   559	15:57:42.344888 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 211692 win 31856 <nop,nop,timestamp 2258118 181751089> (DF) (ttl 64, id 196, len 52, bad cksum 96f8!)
   560	15:57:42.351419 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 211692:212416(724) ack 546 win 31856 <nop,nop,timestamp 181751090 2258111> (DF) (ttl 53, id 839, len 776, bad cksum 9ca1!)
   561	15:57:42.360542 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 212416:213140(724) ack 546 win 31856 <nop,nop,timestamp 181751091 2258111> (DF) (ttl 53, id 840, len 776, bad cksum 9ca0!)
   562	15:57:42.361216 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 213140 win 31856 <nop,nop,timestamp 2258119 181751090> (DF) (ttl 64, id 197, len 52, bad cksum 96f7!)
   563	15:57:42.370645 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 213140:213864(724) ack 546 win 31856 <nop,nop,timestamp 181751092 2258111> (DF) (ttl 53, id 841, len 776, bad cksum 9c9f!)
   564	15:57:42.382218 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 213864:214588(724) ack 546 win 31856 <nop,nop,timestamp 181751093 2258113> (DF) (ttl 53, id 842, len 776, bad cksum 9c9e!)
   565	15:57:42.382856 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 214588 win 31856 <nop,nop,timestamp 2258121 181751092> (DF) (ttl 64, id 198, len 52, bad cksum 96f6!)
   566	15:57:42.390597 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 214588:215312(724) ack 546 win 31856 <nop,nop,timestamp 181751093 2258113> (DF) (ttl 53, id 843, len 776, bad cksum 9c9d!)
   567	15:57:42.404859 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 215312 win 31856 <nop,nop,timestamp 2258124 181751093> (DF) (ttl 64, id 199, len 52, bad cksum 96f5!)
   568	15:57:42.464652 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 215312:215579(267) ack 546 win 31856 <nop,nop,timestamp 181751101 2258124> (DF) (ttl 53, id 844, len 319, bad cksum 9e65!)
   569	15:57:42.484853 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 215579 win 31856 <nop,nop,timestamp 2258131 181751101> (DF) (ttl 64, id 200, len 52, bad cksum 96f4!)
   570	15:57:52.376036 11.11.11.11.8882 > 172.16.183.2.1025: R [bad tcp cksum df29!] 215579:215579(0) ack 546 win 31856 <nop,nop,timestamp 181752094 2258131> (DF) (ttl 53, id 852, len 52, bad cksum 9f68!)
   571	15:57:55.439307 172.16.183.2.1025 > 11.11.11.11.53413:  [bad udp cksum df29!] udp 3 (ttl 64, id 201, len 31, bad cksum d6fd!)
   572	15:57:55.493471 11.11.11.11.53413 > 172.16.183.2.1025:  [bad udp cksum df29!] udp 10 (ttl 53, id 867, len 38, bad cksum df5c!)
   573	15:58:05.406445 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50723+ A? web.icq.com. [|domain] (ttl 64, id 202, len 57)
   574	15:58:05.429792 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50723* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 24510, len 233)
   575	15:58:05.433078 172.16.183.2.1026 > clustera.icq.com.http: S [tcp sum ok] 254898872:254898872(0) win 32120 <mss 1460,sackOK,timestamp 2260448 0,nop,wscale 0> (DF) (ttl 64, id 203, len 60)
   576	15:58:05.451837 clustera.icq.com.http > 172.16.183.2.1026: S [tcp sum ok] 1276441227:1276441227(0) ack 254898873 win 65535 <nop,nop,timestamp 200303873 2260448,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 61963, len 64)
   577	15:58:05.452439 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2260450 200303873> (DF) (ttl 64, id 204, len 52)
   578	15:58:06.455233 172.16.183.2.1026 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2260550 200303873> (DF) (ttl 64, id 205, len 104)
   579	15:58:06.482173 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200303976 2260550> (DF) (ttl 240, id 61964, len 52)
   580	15:58:07.099276 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200304036 2260550> (DF) (ttl 240, id 61965, len 1500)
   581	15:58:07.100091 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2260646 200304036> (DF) (ttl 64, id 206, len 52)
   582	15:58:07.107889 clustera.icq.com.http > 172.16.183.2.1026: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200304036 2260550> (DF) (ttl 240, id 61966, len 1500)
   583	15:58:07.115019 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2260650 200304036> (DF) (ttl 64, id 207, len 52)
   584	15:58:07.125854 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200304039 2260646> (DF) (ttl 240, id 61967, len 1477)
   585	15:58:07.134747 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200304039 2260646> (DF) (ttl 240, id 61968, len 1500)
   586	15:58:07.143619 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200304041 2260650> (DF) (ttl 240, id 61969, len 1500)
   587	15:58:07.144454 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 2260654 200304039> (DF) (ttl 64, id 208, len 52)
   588	15:58:07.150812 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200304041 2260650> (DF) (ttl 240, id 61970, len 1252)
   589	15:58:07.155013 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2260656 200304041> (DF) (ttl 64, id 209, len 52)
   590	15:58:07.170467 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61971, len 1500)
   591	15:58:07.179090 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61972, len 1500)
   592	15:58:07.179838 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2260659 200304044> (DF) (ttl 64, id 210, len 52)
   593	15:58:07.186524 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61973, len 1252)
   594	15:58:07.195351 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61974, len 1500)
   595	15:58:07.204089 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2260664 200304044> (DF) (ttl 64, id 211, len 52)
   596	15:58:07.204187 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200304045 2260656> (DF) (ttl 240, id 61975, len 1500)
   597	15:58:07.211413 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200304045 2260656> (DF) (ttl 240, id 61976, len 1252)
   598	15:58:07.216747 172.16.183.2.1026 > clustera.icq.com.http: P [bad tcp cksum e55e!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   599	15:58:07.216747 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2260665 200304045> (DF) (ttl 64, id 212, len 52)
   600	15:58:07.220710 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61977, len 1500)
   601	15:58:07.225125 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 213, len 40)
   602	15:58:07.229337 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61978, len 1500)
   603	15:58:07.233123 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 214, len 40)
   604	15:58:07.236772 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61979, len 1252)
   605	15:58:07.237571 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 215, len 40)
   606	15:58:07.245596 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61980, len 1500)
   607	15:58:07.246418 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 216, len 40)
   608	15:58:07.254467 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61981, len 1500)
   609	15:58:07.255552 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 217, len 40)
   610	15:58:07.261656 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61982, len 1252)
   611	15:58:07.262399 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 218, len 40)
   612	15:58:09.196239 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50724+ A? web.icq.com. [|domain] (ttl 64, id 219, len 57)
   613	15:58:09.226430 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50724 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 24794, len 244)
   614	15:58:09.234260 172.16.183.2.1027 > clusterc.icq.com.http: S [tcp sum ok] 266039804:266039804(0) win 32120 <mss 1460,sackOK,timestamp 2260871 0,nop,wscale 0> (DF) (ttl 64, id 220, len 60)
   615	15:58:09.252140 clusterc.icq.com.http > 172.16.183.2.1027: S [tcp sum ok] 3152951843:3152951843(0) ack 266039805 win 65535 <nop,nop,timestamp 19651147 2260871,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34543, len 64)
   616	15:58:09.255151 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2260873 19651147> (DF) (ttl 64, id 221, len 52)
   617	15:58:10.256300 172.16.183.2.1027 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2260974 19651147> (DF) (ttl 64, id 222, len 104)
   618	15:58:10.283206 clusterc.icq.com.http > 172.16.183.2.1027: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 19651250 2260974> (DF) (ttl 240, id 34544, len 52)
   619	15:58:10.557953 clusterc.icq.com.http > 172.16.183.2.1027: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 19651277 2260974> (DF) (ttl 240, id 34545, len 391)
   620	15:58:10.558386 clusterc.icq.com.http > 172.16.183.2.1027: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 19651277 2260974> (DF) (ttl 240, id 34546, len 52)
   621	15:58:10.559376 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2261020 19651277> (DF) (ttl 64, id 223, len 52)
   622	15:58:10.559864 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2261020 19651277> (DF) (ttl 64, id 224, len 52)
   623	15:58:27.474391 172.16.183.2.1027 > clusterc.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2263522 19651277> (DF) (ttl 64, id 225, len 52)
   624	15:58:27.491393 172.16.183.2.1027 > clusterc.icq.com.http: P [bad tcp cksum 27e1!] 2886912380:2886912431(51) ack 1408055311 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   625	15:58:27.491393 clusterc.icq.com.http > 172.16.183.2.1027: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 19652971 2263522> (DF) (ttl 240, id 34547, len 52)
   626	15:58:28.475978 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50725+ A? web.icq.com. [|domain] (ttl 64, id 226, len 57)
   627	15:58:28.489116 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50725 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27239, len 233)
   628	15:58:28.490024 172.16.183.2.1028 > clustera.icq.com.http: S [tcp sum ok] 300477277:300477277(0) win 32120 <mss 1460,sackOK,timestamp 2263624 0,nop,wscale 0> (DF) (ttl 64, id 227, len 60)
   629	15:58:28.506960 clustera.icq.com.http > 172.16.183.2.1028: S [tcp sum ok] 1964720785:1964720785(0) ack 300477278 win 65535 <nop,nop,timestamp 500573950 2263624,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34285, len 64)
   630	15:58:28.507417 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2263626 500573950> (DF) (ttl 64, id 228, len 52)
   631	15:58:29.506557 172.16.183.2.1028 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2263726 500573950> (DF) (ttl 64, id 229, len 104)
   632	15:58:29.524244 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500574052 2263726> (DF) (ttl 240, id 34286, len 52)
   633	15:58:30.029019 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500574101 2263726> (DF) (ttl 240, id 34287, len 1500)
   634	15:58:30.029825 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2263777 500574101> (DF) (ttl 64, id 230, len 52)
   635	15:58:30.042307 clustera.icq.com.http > 172.16.183.2.1028: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500574101 2263726> (DF) (ttl 240, id 34288, len 1500)
   636	15:58:30.043938 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2263779 500574101> (DF) (ttl 64, id 231, len 52)
   637	15:58:30.062975 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500574104 2263777> (DF) (ttl 240, id 34289, len 1477)
   638	15:58:30.076298 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500574104 2263777> (DF) (ttl 240, id 34290, len 1500)
   639	15:58:30.089604 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500574106 2263779> (DF) (ttl 240, id 34291, len 1500)
   640	15:58:30.090397 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2263783 500574104> (DF) (ttl 64, id 232, len 52)
   641	15:58:30.100741 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500574106 2263779> (DF) (ttl 240, id 34292, len 1252)
   642	15:58:30.120902 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34293, len 1500)
   643	15:58:30.133224 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34294, len 1500)
   644	15:58:30.133991 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2263787 500574106> (DF) (ttl 64, id 233, len 52)
   645	15:58:30.142861 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34295, len 1252)
   646	15:58:30.154923 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34296, len 1500)
   647	15:58:30.155698 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2263790 500574110> (DF) (ttl 64, id 234, len 52)
   648	15:58:30.167211 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34297, len 1500)
   649	15:58:30.167947 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2263791 500574110> (DF) (ttl 64, id 235, len 52)
   650	15:58:30.170250 172.16.183.2.1028 > clustera.icq.com.http: P [bad tcp cksum 286f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   651	15:58:30.170250 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2263791 500574110> (DF) (ttl 64, id 236, len 52)
   652	15:58:30.177103 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34298, len 1252)
   653	15:58:30.177876 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 237, len 40)
   654	15:58:30.189133 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34299, len 1500)
   655	15:58:30.189882 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 238, len 40)
   656	15:58:30.201694 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34300, len 1500)
   657	15:58:30.202467 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 239, len 40)
   658	15:58:30.210857 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500574117 2263790> (DF) (ttl 240, id 34301, len 1252)
   659	15:58:30.211591 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 240, len 40)
   660	15:58:30.222141 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500574117 2263790> (DF) (ttl 240, id 34302, len 1500)
   661	15:58:30.222857 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 241, len 40)
   662	15:58:30.232983 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34303, len 1500)
   663	15:58:30.233717 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 242, len 40)
   664	15:58:30.241648 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34304, len 1252)
   665	15:58:30.242322 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 243, len 40)
   666	15:58:30.252943 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34305, len 1500)
   667	15:58:30.253729 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 244, len 40)
   668	15:58:32.166574 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50726+ A? web.icq.com. [|domain] (ttl 64, id 245, len 57)
   669	15:58:32.180777 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50726 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27639, len 233)
   670	15:58:32.181793 172.16.183.2.1029 > clustera.icq.com.http: S [tcp sum ok] 304003451:304003451(0) win 32120 <mss 1460,sackOK,timestamp 2263993 0,nop,wscale 0> (DF) (ttl 64, id 246, len 60)
   671	15:58:32.199123 clustera.icq.com.http > 172.16.183.2.1029: S [tcp sum ok] 1246240099:1246240099(0) ack 304003452 win 33304 <nop,nop,timestamp 16966795 2263993,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 60783, len 64)
   672	15:58:32.199646 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2263994 16966795> (DF) (ttl 64, id 247, len 52)
   673	15:58:33.196108 172.16.183.2.1029 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2264094 16966795> (DF) (ttl 64, id 248, len 104)
   674	15:58:33.215659 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 16966896 2264094> (DF) (ttl 49, id 60784, len 52)
   675	15:58:34.396227 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60785, len 1500)
   676	15:58:34.397050 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2264215 16967012> (DF) (ttl 64, id 249, len 52)
   677	15:58:34.417412 clustera.icq.com.http > 172.16.183.2.1029: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60786, len 1500)
   678	15:58:34.433827 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2264219 16967012> (DF) (ttl 64, id 250, len 52)
   679	15:58:34.437099 clustera.icq.com.http > 172.16.183.2.1029: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60787, len 1477)
   680	15:58:34.457342 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 16967016 2264215> (DF) (ttl 49, id 60788, len 1500)
   681	15:58:34.463832 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2264222 16967012> (DF) (ttl 64, id 251, len 52)
   682	15:58:34.476535 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 16967016 2264215> (DF) (ttl 49, id 60789, len 1500)
   683	15:58:34.491115 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 16967020 2264219> (DF) (ttl 49, id 60790, len 1252)
   684	15:58:34.503839 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2264226 16967016> (DF) (ttl 64, id 252, len 52)
   685	15:58:34.508320 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 16967020 2264219> (DF) (ttl 49, id 60791, len 1500)
   686	15:58:34.526307 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60792, len 1500)
   687	15:58:34.527038 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2264228 16967020> (DF) (ttl 64, id 253, len 52)
   688	15:58:34.540650 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60793, len 1252)
   689	15:58:34.553822 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2264231 16967023> (DF) (ttl 64, id 254, len 52)
   690	15:58:34.558094 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60794, len 1500)
   691	15:58:34.574106 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60795, len 1500)
   692	15:58:34.575016 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2264233 16967023> (DF) (ttl 64, id 255, len 52)
   693	15:58:34.577681 172.16.183.2.1029 > clustera.icq.com.http: P [bad tcp cksum d3f0!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   694	15:58:34.577681 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2264233 16967023> (DF) (ttl 64, id 256, len 52)
   695	15:58:34.586945 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60796, len 1252)
   696	15:58:34.587698 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 257, len 40)
   697	15:58:34.601924 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60797, len 1500)
   698	15:58:34.602652 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 258, len 40)
   699	15:58:34.617454 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60798, len 1500)
   700	15:58:34.618174 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 259, len 40)
   701	15:58:34.629814 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60799, len 1252)
   702	15:58:34.630541 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 260, len 40)
   703	15:58:34.645290 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60800, len 1500)
   704	15:58:34.646042 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 261, len 40)
   705	15:58:34.660327 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 16967032 2264231> (DF) (ttl 49, id 60801, len 1500)
   706	15:58:34.661095 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 262, len 40)
   707	15:58:34.671709 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 16967032 2264231> (DF) (ttl 49, id 60802, len 1252)
   708	15:58:34.672444 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 263, len 40)
   709	15:58:34.684967 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60803, len 1500)
   710	15:58:34.685776 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 264, len 40)
   711	15:58:34.698258 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60804, len 1500)
   712	15:58:34.698999 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 265, len 40)
   713	15:58:34.709641 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60805, len 1252)
   714	15:58:34.710344 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 266, len 40)
   715	15:58:36.586486 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50727+ A? web.icq.com. [|domain] (ttl 64, id 267, len 57)
   716	15:58:36.600726 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50727 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27968, len 233)
   717	15:58:36.601717 172.16.183.2.1030 > clustera.icq.com.http: S [tcp sum ok] 304796124:304796124(0) win 32120 <mss 1460,sackOK,timestamp 2264435 0,nop,wscale 0> (DF) (ttl 64, id 268, len 60)
   718	15:58:36.618571 clustera.icq.com.http > 172.16.183.2.1030: S [tcp sum ok] 3786313445:3786313445(0) ack 304796125 win 65535 <nop,nop,timestamp 501158035 2264435,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 42431, len 64)
   719	15:58:36.619128 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2264436 501158035> (DF) (ttl 64, id 269, len 52)
   720	15:58:37.646070 172.16.183.2.1030 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2264536 501158035> (DF) (ttl 64, id 270, len 104)
   721	15:58:37.665654 clustera.icq.com.http > 172.16.183.2.1030: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501158139 2264536> (DF) (ttl 240, id 42432, len 52)
   722	15:58:37.930302 clustera.icq.com.http > 172.16.183.2.1030: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501158165 2264536> (DF) (ttl 240, id 42433, len 391)
   723	15:58:37.931004 clustera.icq.com.http > 172.16.183.2.1030: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501158166 2264536> (DF) (ttl 240, id 42434, len 52)
   724	15:58:37.931475 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2264568 501158165> (DF) (ttl 64, id 271, len 52)
   725	15:58:37.931947 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2264568 501158166> (DF) (ttl 64, id 272, len 52)
   726	15:59:03.453603 172.16.183.2.1030 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2267122 501158166> (DF) (ttl 64, id 273, len 52)
   727	15:59:03.471298 172.16.183.2.1030 > clustera.icq.com.http: P [bad tcp cksum b004!] 3481517662:3481517713(51) ack 813450029 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   728	15:59:03.471298 clustera.icq.com.http > 172.16.183.2.1030: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501160720 2267122> (DF) (ttl 240, id 42435, len 52)
   729	15:59:04.456666 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50728+ A? web.icq.com. [|domain] (ttl 64, id 274, len 57)
   730	15:59:04.471487 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50728 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 30793, len 233)
   731	15:59:04.472796 172.16.183.2.1031 > clusterb.icq.com.http: S [tcp sum ok] 335649146:335649146(0) win 32120 <mss 1460,sackOK,timestamp 2267223 0,nop,wscale 0> (DF) (ttl 64, id 275, len 60)
   732	15:59:04.489845 clusterb.icq.com.http > 172.16.183.2.1031: S [tcp sum ok] 3782308872:3782308872(0) ack 335649147 win 65535 <nop,nop,timestamp 501154927 2267223,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 11351, len 64)
   733	15:59:04.490443 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2267225 501154927> (DF) (ttl 64, id 276, len 52)
   734	15:59:05.486638 172.16.183.2.1031 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2267325 501154927> (DF) (ttl 64, id 277, len 104)
   735	15:59:05.504661 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501155029 2267325> (DF) (ttl 240, id 11352, len 52)
   736	15:59:06.439817 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501155121 2267325> (DF) (ttl 240, id 11353, len 1500)
   737	15:59:06.440556 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2267420 501155121> (DF) (ttl 64, id 278, len 52)
   738	15:59:06.452618 clusterb.icq.com.http > 172.16.183.2.1031: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501155121 2267325> (DF) (ttl 240, id 11354, len 1500)
   739	15:59:06.473061 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501155124 2267420> (DF) (ttl 240, id 11355, len 1477)
   740	15:59:06.483545 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2267424 501155121> (DF) (ttl 64, id 279, len 52)
   741	15:59:06.485141 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501155124 2267420> (DF) (ttl 240, id 11356, len 1500)
   742	15:59:06.494938 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2267426 501155124> (DF) (ttl 64, id 280, len 52)
   743	15:59:06.514240 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11357, len 1500)
   744	15:59:06.523864 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11358, len 1252)
   745	15:59:06.535155 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11359, len 1500)
   746	15:59:06.535921 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2267430 501155128> (DF) (ttl 64, id 281, len 52)
   747	15:59:06.546000 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501155130 2267426> (DF) (ttl 240, id 11360, len 1500)
   748	15:59:06.554900 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501155130 2267426> (DF) (ttl 240, id 11361, len 1252)
   749	15:59:06.563539 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2267433 501155130> (DF) (ttl 64, id 282, len 52)
   750	15:59:06.566436 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11362, len 1500)
   751	15:59:06.577280 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11363, len 1500)
   752	15:59:06.578015 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2267434 501155134> (DF) (ttl 64, id 283, len 52)
   753	15:59:06.580181 172.16.183.2.1031 > clusterb.icq.com.http: P [bad tcp cksum ff20!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   754	15:59:06.580181 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2267434 501155134> (DF) (ttl 64, id 284, len 52)
   755	15:59:06.585949 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11364, len 1252)
   756	15:59:06.586728 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 285, len 40)
   757	15:59:06.596984 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11365, len 1500)
   758	15:59:06.597728 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 286, len 40)
   759	15:59:06.607825 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11366, len 1500)
   760	15:59:06.608556 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 287, len 40)
   761	15:59:06.616984 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11367, len 1252)
   762	15:59:06.617733 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 288, len 40)
   763	15:59:06.627278 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11368, len 1500)
   764	15:59:06.628033 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 289, len 40)
   765	15:59:06.636920 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11369, len 1500)
   766	15:59:06.637701 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 290, len 40)
   767	15:59:06.645070 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11370, len 1252)
   768	15:59:06.645757 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 291, len 40)
   769	15:59:06.655617 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11371, len 1500)
   770	15:59:06.656317 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 292, len 40)
   771	15:59:08.585356 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50729+ A? web.icq.com. [|domain] (ttl 64, id 293, len 57)
   772	15:59:08.596507 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50729 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 31241, len 233)
   773	15:59:08.597279 172.16.183.2.1032 > clusterb.icq.com.http: S [tcp sum ok] 328275828:328275828(0) win 32120 <mss 1460,sackOK,timestamp 2267635 0,nop,wscale 0> (DF) (ttl 64, id 294, len 60)
   774	15:59:08.613137 clusterb.icq.com.http > 172.16.183.2.1032: S [tcp sum ok] 2553383892:2553383892(0) ack 328275829 win 65535 <nop,nop,timestamp 502584542 2267635,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 20653, len 64)
   775	15:59:08.613685 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2267636 502584542> (DF) (ttl 64, id 295, len 52)
   776	15:59:09.606039 172.16.183.2.1032 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2267736 502584542> (DF) (ttl 64, id 296, len 104)
   777	15:59:09.622776 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502584643 2267736> (DF) (ttl 240, id 20654, len 52)
   778	15:59:10.236943 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502584703 2267736> (DF) (ttl 240, id 20655, len 1500)
   779	15:59:10.237683 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2267800 502584703> (DF) (ttl 64, id 297, len 52)
   780	15:59:10.245546 clusterb.icq.com.http > 172.16.183.2.1032: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502584703 2267736> (DF) (ttl 240, id 20656, len 1500)
   781	15:59:10.253516 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2267802 502584703> (DF) (ttl 64, id 298, len 52)
   782	15:59:10.264742 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502584706 2267800> (DF) (ttl 240, id 20657, len 1477)
   783	15:59:10.273878 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502584706 2267800> (DF) (ttl 240, id 20658, len 1500)
   784	15:59:10.282496 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502584708 2267802> (DF) (ttl 240, id 20659, len 1500)
   785	15:59:10.283290 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2267805 502584706> (DF) (ttl 64, id 299, len 52)
   786	15:59:10.289929 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502584708 2267802> (DF) (ttl 240, id 20660, len 1252)
   787	15:59:10.303501 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2267807 502584708> (DF) (ttl 64, id 300, len 52)
   788	15:59:10.310094 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20661, len 1500)
   789	15:59:10.318956 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20662, len 1500)
   790	15:59:10.319678 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2267808 502584711> (DF) (ttl 64, id 301, len 52)
   791	15:59:10.326156 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20663, len 1252)
   792	15:59:10.335218 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20664, len 1500)
   793	15:59:10.343513 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2267811 502584711> (DF) (ttl 64, id 302, len 52)
   794	15:59:10.344090 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20665, len 1500)
   795	15:59:10.348408 172.16.183.2.1032 > clusterb.icq.com.http: P [bad tcp cksum e7d4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   796	15:59:10.348408 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2267811 502584713> (DF) (ttl 64, id 303, len 52)
   797	15:59:10.351264 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20666, len 1252)
   798	15:59:10.351995 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 304, len 40)
   799	15:59:10.360339 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20667, len 1500)
   800	15:59:10.361110 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 305, len 40)
   801	15:59:10.369203 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20668, len 1500)
   802	15:59:10.369928 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 306, len 40)
   803	15:59:10.376408 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20669, len 1252)
   804	15:59:10.377091 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 307, len 40)
   805	15:59:10.385460 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20670, len 1500)
   806	15:59:10.386265 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 308, len 40)
   807	15:59:10.394337 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20671, len 1500)
   808	15:59:10.395364 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 309, len 40)
   809	15:59:10.401526 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20672, len 1252)
   810	15:59:10.402216 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 310, len 40)
   811	15:59:12.357499 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50730+ A? web.icq.com. [|domain] (ttl 64, id 311, len 57)
   812	15:59:12.369724 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50730 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 31536, len 233)
   813	15:59:12.370762 172.16.183.2.1033 > clustera.icq.com.http: S [tcp sum ok] 345909800:345909800(0) win 32120 <mss 1460,sackOK,timestamp 2268013 0,nop,wscale 0> (DF) (ttl 64, id 312, len 60)
   814	15:59:12.390033 clustera.icq.com.http > 172.16.183.2.1033: S [tcp sum ok] 497357939:497357939(0) ack 345909801 win 33304 <nop,nop,timestamp 16970814 2268013,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 60806, len 64)
   815	15:59:12.390635 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268015 16970814> (DF) (ttl 64, id 313, len 52)
   816	15:59:13.385433 172.16.183.2.1033 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268115 16970814> (DF) (ttl 64, id 314, len 104)
   817	15:59:13.405341 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 16970916 2268115> (DF) (ttl 49, id 60807, len 52)
   818	15:59:14.222508 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60808, len 1500)
   819	15:59:14.223278 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2268198 16970996> (DF) (ttl 64, id 315, len 52)
   820	15:59:14.242064 clustera.icq.com.http > 172.16.183.2.1033: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60809, len 1500)
   821	15:59:14.253464 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2268202 16970996> (DF) (ttl 64, id 316, len 52)
   822	15:59:14.259438 clustera.icq.com.http > 172.16.183.2.1033: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60810, len 1477)
   823	15:59:14.276460 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 16971000 2268198> (DF) (ttl 49, id 60811, len 1500)
   824	15:59:14.283495 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2268205 16970996> (DF) (ttl 64, id 317, len 52)
   825	15:59:14.294199 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 16971000 2268198> (DF) (ttl 49, id 60812, len 1500)
   826	15:59:14.308294 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 16971003 2268202> (DF) (ttl 49, id 60813, len 1252)
   827	15:59:14.323476 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2268209 16971000> (DF) (ttl 64, id 318, len 52)
   828	15:59:14.325979 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 16971003 2268202> (DF) (ttl 49, id 60814, len 1500)
   829	15:59:14.342004 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60815, len 1500)
   830	15:59:14.342719 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2268210 16971003> (DF) (ttl 64, id 319, len 52)
   831	15:59:14.354831 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60816, len 1252)
   832	15:59:14.369843 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60817, len 1500)
   833	15:59:14.383469 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2268215 16971006> (DF) (ttl 64, id 320, len 52)
   834	15:59:14.384841 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60818, len 1500)
   835	15:59:14.388962 172.16.183.2.1033 > clustera.icq.com.http: P [bad tcp cksum 32b3!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   836	15:59:14.388962 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2268215 16971010> (DF) (ttl 64, id 321, len 52)
   837	15:59:14.397213 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60819, len 1252)
   838	15:59:14.397982 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 322, len 40)
   839	15:59:14.412444 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60820, len 1500)
   840	15:59:14.413237 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 323, len 40)
   841	15:59:14.427472 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60821, len 1500)
   842	15:59:14.428354 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 324, len 40)
   843	15:59:14.439340 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60822, len 1252)
   844	15:59:14.440102 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 325, len 40)
   845	15:59:14.452859 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60823, len 1500)
   846	15:59:14.453609 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 326, len 40)
   847	15:59:14.466149 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60824, len 1500)
   848	15:59:14.466936 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 327, len 40)
   849	15:59:14.477036 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60825, len 1252)
   850	15:59:14.477727 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 328, len 40)
   851	15:59:14.490544 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60826, len 1500)
   852	15:59:14.491306 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 329, len 40)
   853	15:59:16.397321 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50731+ A? web.icq.com. [|domain] (ttl 64, id 330, len 57)
   854	15:59:16.409015 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50731 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 31928, len 233)
   855	15:59:16.410055 172.16.183.2.1034 > clustera.icq.com.http: S [tcp sum ok] 349239666:349239666(0) win 32120 <mss 1460,sackOK,timestamp 2268417 0,nop,wscale 0> (DF) (ttl 64, id 331, len 60)
   856	15:59:16.429075 clustera.icq.com.http > 172.16.183.2.1034: S [tcp sum ok] 2920270530:2920270530(0) ack 349239667 win 65535 <nop,nop,timestamp 500578743 2268417,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34306, len 64)
   857	15:59:16.429605 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268419 500578743> (DF) (ttl 64, id 332, len 52)
   858	15:59:17.425733 172.16.183.2.1034 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268519 500578743> (DF) (ttl 64, id 333, len 104)
   859	15:59:17.443650 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500578844 2268519> (DF) (ttl 240, id 34307, len 52)
   860	15:59:18.422932 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500578940 2268519> (DF) (ttl 240, id 34308, len 1500)
   861	15:59:18.423705 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2268618 500578940> (DF) (ttl 64, id 334, len 52)
   862	15:59:18.440176 clustera.icq.com.http > 172.16.183.2.1034: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500578940 2268519> (DF) (ttl 240, id 34309, len 1500)
   863	15:59:18.453427 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2268622 500578940> (DF) (ttl 64, id 335, len 52)
   864	15:59:18.456897 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500578944 2268618> (DF) (ttl 240, id 34310, len 1477)
   865	15:59:18.471963 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500578944 2268618> (DF) (ttl 240, id 34311, len 1500)
   866	15:59:18.483437 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2268625 500578944> (DF) (ttl 64, id 336, len 52)
   867	15:59:18.486981 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500578947 2268622> (DF) (ttl 240, id 34312, len 1500)
   868	15:59:18.499600 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500578947 2268622> (DF) (ttl 240, id 34313, len 1252)
   869	15:59:18.513427 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2268628 500578947> (DF) (ttl 64, id 337, len 52)
   870	15:59:18.516546 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34314, len 1500)
   871	15:59:18.531577 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34315, len 1500)
   872	15:59:18.532331 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2268629 500578950> (DF) (ttl 64, id 338, len 52)
   873	15:59:18.542711 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34316, len 1252)
   874	15:59:18.556224 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34317, len 1500)
   875	15:59:18.569547 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34318, len 1500)
   876	15:59:18.570286 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2268634 500578950> (DF) (ttl 64, id 339, len 52)
   877	15:59:18.572998 172.16.183.2.1034 > clustera.icq.com.http: P [bad tcp cksum f99c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   878	15:59:18.572998 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2268634 500578953> (DF) (ttl 64, id 340, len 52)
   879	15:59:18.580643 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34319, len 1252)
   880	15:59:18.581478 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 341, len 40)
   881	15:59:18.594150 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34320, len 1500)
   882	15:59:18.595179 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 342, len 40)
   883	15:59:18.607445 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34321, len 1500)
   884	15:59:18.608237 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 343, len 40)
   885	15:59:18.618817 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34322, len 1252)
   886	15:59:18.619543 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 344, len 40)
   887	15:59:18.631098 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34323, len 1500)
   888	15:59:18.631860 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 345, len 40)
   889	15:59:18.643661 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34324, len 1500)
   890	15:59:18.644399 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 346, len 40)
   891	15:59:18.653561 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34325, len 1252)
   892	15:59:18.654263 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 347, len 40)
   893	15:59:20.597190 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50732+ A? web.icq.com. [|domain] (ttl 64, id 348, len 57)
   894	15:59:20.610668 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50732 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 32375, len 233)
   895	15:59:20.611670 172.16.183.2.1035 > clustera.icq.com.http: S [tcp sum ok] 353775413:353775413(0) win 32120 <mss 1460,sackOK,timestamp 2268836 0,nop,wscale 0> (DF) (ttl 64, id 349, len 60)
   896	15:59:20.629503 clustera.icq.com.http > 172.16.183.2.1035: S [tcp sum ok] 3685924677:3685924677(0) ack 353775414 win 33304 <nop,nop,timestamp 18558534 2268836,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 52925, len 64)
   897	15:59:20.630065 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268837 18558534> (DF) (ttl 64, id 350, len 52)
   898	15:59:21.625757 172.16.183.2.1035 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268937 18558534> (DF) (ttl 64, id 351, len 104)
   899	15:59:21.655915 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18558636 2268937> (DF) (ttl 49, id 52926, len 52)
   900	15:59:22.343987 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52927, len 1500)
   901	15:59:22.344979 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269011 18558704> (DF) (ttl 64, id 352, len 52)
   902	15:59:22.361231 clustera.icq.com.http > 172.16.183.2.1035: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52928, len 1500)
   903	15:59:22.378440 clustera.icq.com.http > 172.16.183.2.1035: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52929, len 1477)
   904	15:59:22.395700 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18558708 2269011> (DF) (ttl 49, id 52930, len 1500)
   905	15:59:22.396456 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2269016 18558704> (DF) (ttl 64, id 353, len 52)
   906	15:59:22.413188 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18558708 2269011> (DF) (ttl 49, id 52931, len 1500)
   907	15:59:22.428271 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52932, len 1252)
   908	15:59:22.443393 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2269021 18558708> (DF) (ttl 64, id 354, len 52)
   909	15:59:22.443708 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52933, len 1500)
   910	15:59:22.459519 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52934, len 1500)
   911	15:59:22.460256 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2269022 18558713> (DF) (ttl 64, id 355, len 52)
   912	15:59:22.471621 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52935, len 1252)
   913	15:59:22.486863 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52936, len 1500)
   914	15:59:22.501888 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52937, len 1500)
   915	15:59:22.502637 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269026 18558713> (DF) (ttl 64, id 356, len 52)
   916	15:59:22.506781 172.16.183.2.1035 > clustera.icq.com.http: P [bad tcp cksum c944!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   917	15:59:22.506781 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2269027 18558713> (DF) (ttl 64, id 357, len 52)
   918	15:59:22.514478 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52938, len 1252)
   919	15:59:22.515409 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 358, len 40)
   920	15:59:22.528483 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52939, len 1500)
   921	15:59:22.529227 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 359, len 40)
   922	15:59:22.541780 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52940, len 1500)
   923	15:59:22.542491 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 360, len 40)
   924	15:59:22.553404 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52941, len 1252)
   925	15:59:22.554126 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 361, len 40)
   926	15:59:22.566906 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52942, len 1500)
   927	15:59:22.567729 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 362, len 40)
   928	15:59:22.580222 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52943, len 1500)
   929	15:59:22.581046 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 363, len 40)
   930	15:59:22.591099 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52944, len 1252)
   931	15:59:22.591853 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 364, len 40)
   932	15:59:22.604620 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52945, len 1500)
   933	15:59:22.605537 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 365, len 40)
   934	15:59:24.517977 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50733+ A? web.icq.com. [|domain] (ttl 64, id 366, len 57)
   935	15:59:24.531712 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50733 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 32752, len 233)
   936	15:59:24.532804 172.16.183.2.1036 > clusterb.icq.com.http: S [tcp sum ok] 345024297:345024297(0) win 32120 <mss 1460,sackOK,timestamp 2269229 0,nop,wscale 0> (DF) (ttl 64, id 367, len 60)
   937	15:59:24.550303 clusterb.icq.com.http > 172.16.183.2.1036: S [tcp sum ok] 1842368025:1842368025(0) ack 345024298 win 65535 <nop,nop,timestamp 500619613 2269229,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 32163, len 64)
   938	15:59:24.550905 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2269231 500619613> (DF) (ttl 64, id 368, len 52)
   939	15:59:25.545233 172.16.183.2.1036 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2269331 500619613> (DF) (ttl 64, id 369, len 104)
   940	15:59:25.565353 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500619715 2269331> (DF) (ttl 240, id 32164, len 52)
   941	15:59:26.298768 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500619787 2269331> (DF) (ttl 240, id 32165, len 1500)
   942	15:59:26.299524 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269406 500619787> (DF) (ttl 64, id 370, len 52)
   943	15:59:26.309092 clusterb.icq.com.http > 172.16.183.2.1036: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500619787 2269331> (DF) (ttl 240, id 32166, len 1500)
   944	15:59:26.313368 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2269408 500619787> (DF) (ttl 64, id 371, len 52)
   945	15:59:26.328075 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500619790 2269406> (DF) (ttl 240, id 32167, len 1477)
   946	15:59:26.338175 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500619790 2269406> (DF) (ttl 240, id 32168, len 1500)
   947	15:59:26.343372 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2269411 500619790> (DF) (ttl 64, id 372, len 52)
   948	15:59:26.348261 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500619791 2269408> (DF) (ttl 240, id 32169, len 1500)
   949	15:59:26.356449 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500619791 2269408> (DF) (ttl 240, id 32170, len 1252)
   950	15:59:26.363364 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2269413 500619791> (DF) (ttl 64, id 373, len 52)
   951	15:59:26.372404 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32171, len 1500)
   952	15:59:26.382030 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32172, len 1500)
   953	15:59:26.382765 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2269414 500619794> (DF) (ttl 64, id 374, len 52)
   954	15:59:26.389714 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32173, len 1252)
   955	15:59:26.399270 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32174, len 1500)
   956	15:59:26.408389 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32175, len 1500)
   957	15:59:26.409103 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269417 500619794> (DF) (ttl 64, id 375, len 52)
   958	15:59:26.415821 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32176, len 1252)
   959	15:59:26.418187 172.16.183.2.1036 > clusterb.icq.com.http: P [bad tcp cksum a1a6!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   960	15:59:26.418187 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2269418 500619796> (DF) (ttl 64, id 376, len 52)
   961	15:59:26.425619 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32177, len 1500)
   962	15:59:26.426512 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 377, len 40)
   963	15:59:26.434749 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32178, len 1500)
   964	15:59:26.435692 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 378, len 40)
   965	15:59:26.442172 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32179, len 1252)
   966	15:59:26.442888 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 379, len 40)
   967	15:59:26.451735 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32180, len 1500)
   968	15:59:26.452567 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 380, len 40)
   969	15:59:26.460853 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32181, len 1500)
   970	15:59:26.461664 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 381, len 40)
   971	15:59:26.468288 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32182, len 1252)
   972	15:59:26.469043 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 382, len 40)
   973	15:59:26.477620 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32183, len 1500)
   974	15:59:26.478404 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 383, len 40)
   975	15:59:28.417369 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50734+ A? web.icq.com. [|domain] (ttl 64, id 384, len 57)
   976	15:59:28.429342 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50734 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 33104, len 233)
   977	15:59:28.430421 172.16.183.2.1037 > clusterb.icq.com.http: S [tcp sum ok] 356706602:356706602(0) win 32120 <mss 1460,sackOK,timestamp 2269619 0,nop,wscale 0> (DF) (ttl 64, id 385, len 60)
   978	15:59:28.447431 clusterb.icq.com.http > 172.16.183.2.1037: S [tcp sum ok] 1673736519:1673736519(0) ack 356706603 win 65535 <nop,nop,timestamp 500709525 2269619,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 13779, len 64)
   979	15:59:28.448032 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2269621 500709525> (DF) (ttl 64, id 386, len 52)
   980	15:59:29.445652 172.16.183.2.1037 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2269721 500709525> (DF) (ttl 64, id 387, len 104)
   981	15:59:29.466685 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500709627 2269721> (DF) (ttl 240, id 13780, len 52)
   982	15:59:30.369096 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500709715 2269721> (DF) (ttl 240, id 13781, len 1500)
   983	15:59:30.369896 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269814 500709715> (DF) (ttl 64, id 388, len 52)
   984	15:59:30.387319 clusterb.icq.com.http > 172.16.183.2.1037: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500709715 2269721> (DF) (ttl 240, id 13782, len 1500)
   985	15:59:30.393333 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2269816 500709715> (DF) (ttl 64, id 389, len 52)
   986	15:59:30.406515 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500709719 2269814> (DF) (ttl 240, id 13783, len 1477)
   987	15:59:30.423335 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2269819 500709719> (DF) (ttl 64, id 390, len 52)
   988	15:59:30.424022 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500709719 2269814> (DF) (ttl 240, id 13784, len 1500)
   989	15:59:30.441034 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500709721 2269816> (DF) (ttl 240, id 13785, len 1500)
   990	15:59:30.441779 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2269820 500709719> (DF) (ttl 64, id 391, len 52)
   991	15:59:30.454131 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500709721 2269816> (DF) (ttl 240, id 13786, len 1252)
   992	15:59:30.469603 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500709724 2269819> (DF) (ttl 240, id 13787, len 1500)
   993	15:59:30.483334 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2269825 500709721> (DF) (ttl 64, id 392, len 52)
   994	15:59:30.484651 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500709724 2269819> (DF) (ttl 240, id 13788, len 1500)
   995	15:59:30.497507 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13789, len 1252)
   996	15:59:30.503330 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2269827 500709724> (DF) (ttl 64, id 393, len 52)
   997	15:59:30.512725 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13790, len 1500)
   998	15:59:30.527750 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13791, len 1500)
   999	15:59:30.528476 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269829 500709726> (DF) (ttl 64, id 394, len 52)
  1000	15:59:30.532602 172.16.183.2.1037 > clusterb.icq.com.http: P [bad tcp cksum 7b8f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1001	15:59:30.532602 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2269829 500709726> (DF) (ttl 64, id 395, len 52)
  1002	15:59:30.540591 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13792, len 1252)
  1003	15:59:30.541341 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 396, len 40)
  1004	15:59:30.554336 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13793, len 1500)
  1005	15:59:30.556220 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 397, len 40)
  1006	15:59:30.567896 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13794, len 1500)
  1007	15:59:30.568673 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 398, len 40)
  1008	15:59:30.578536 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13795, len 1252)
  1009	15:59:30.579265 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 399, len 40)
  1010	15:59:30.592560 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13796, len 1500)
  1011	15:59:30.593411 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 400, len 40)
  1012	15:59:30.605840 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13797, len 1500)
  1013	15:59:30.606656 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 401, len 40)
  1014	15:59:30.617212 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13798, len 1252)
  1015	15:59:30.617949 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 402, len 40)
  1016	15:59:30.630718 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13799, len 1500)
  1017	15:59:30.631456 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 403, len 40)
  1018	15:59:30.643040 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13800, len 1500)
  1019	15:59:30.643824 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 404, len 40)
  1020	15:59:32.537559 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50735+ A? web.icq.com. [|domain] (ttl 64, id 405, len 57)
  1021	15:59:32.550188 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50735 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 33382, len 233)
  1022	15:59:32.551274 172.16.183.2.1038 > clustera.icq.com.http: S [tcp sum ok] 358047615:358047615(0) win 32120 <mss 1460,sackOK,timestamp 2270032 0,nop,wscale 0> (DF) (ttl 64, id 406, len 60)
  1023	15:59:32.569756 clustera.icq.com.http > 172.16.183.2.1038: S [tcp sum ok] 602579997:602579997(0) ack 358047616 win 65535 <nop,nop,timestamp 501163630 2270032,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 42436, len 64)
  1024	15:59:32.570325 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2270034 501163630> (DF) (ttl 64, id 407, len 52)
  1025	15:59:33.565328 172.16.183.2.1038 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2270134 501163630> (DF) (ttl 64, id 408, len 104)
  1026	15:59:33.587284 clustera.icq.com.http > 172.16.183.2.1038: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501163732 2270134> (DF) (ttl 240, id 42437, len 52)
  1027	15:59:33.782945 clustera.icq.com.http > 172.16.183.2.1038: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501163751 2270134> (DF) (ttl 240, id 42438, len 391)
  1028	15:59:33.783645 clustera.icq.com.http > 172.16.183.2.1038: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501163751 2270134> (DF) (ttl 240, id 42439, len 52)
  1029	15:59:33.783999 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2270154 501163751> (DF) (ttl 64, id 409, len 52)
  1030	15:59:33.784422 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2270154 501163751> (DF) (ttl 64, id 410, len 52)
  1031	15:59:59.443090 172.16.183.2.1038 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2272722 501163751> (DF) (ttl 64, id 411, len 52)
  1032	15:59:59.460182 172.16.183.2.1038 > clustera.icq.com.http: P [bad tcp cksum 671b!] 244532723:244532774(51) ack 4050434968 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1033	15:59:59.460182 clustera.icq.com.http > 172.16.183.2.1038: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501166319 2272722> (DF) (ttl 240, id 42440, len 52)
  1034	16:00:00.447611 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50736+ A? web.icq.com. [|domain] (ttl 64, id 412, len 57)
  1035	16:00:00.462101 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50736 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36119, len 233)
  1036	16:00:00.463184 172.16.183.2.1039 > clustera.icq.com.http: S [tcp sum ok] 394055014:394055014(0) win 32120 <mss 1460,sackOK,timestamp 2272823 0,nop,wscale 0> (DF) (ttl 64, id 413, len 60)
  1037	16:00:00.480429 clustera.icq.com.http > 172.16.183.2.1039: S [tcp sum ok] 3797363675:3797363675(0) ack 394055015 win 65535 <nop,nop,timestamp 500583148 2272823,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 60729, len 64)
  1038	16:00:00.481023 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2272824 500583148> (DF) (ttl 64, id 414, len 52)
  1039	16:00:01.475340 172.16.183.2.1039 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2272924 500583148> (DF) (ttl 64, id 415, len 104)
  1040	16:00:01.498223 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500583249 2272924> (DF) (ttl 240, id 60730, len 52)
  1041	16:00:02.293937 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500583328 2272924> (DF) (ttl 240, id 60731, len 1500)
  1042	16:00:02.294991 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2273007 500583328> (DF) (ttl 64, id 416, len 52)
  1043	16:00:02.309470 clustera.icq.com.http > 172.16.183.2.1039: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500583328 2272924> (DF) (ttl 240, id 60732, len 1500)
  1044	16:00:02.313048 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2273009 500583328> (DF) (ttl 64, id 417, len 52)
  1045	16:00:02.329094 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500583331 2273007> (DF) (ttl 240, id 60733, len 1477)
  1046	16:00:02.342955 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500583331 2273007> (DF) (ttl 240, id 60734, len 1500)
  1047	16:00:02.353045 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2273012 500583331> (DF) (ttl 64, id 418, len 52)
  1048	16:00:02.357989 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500583333 2273009> (DF) (ttl 240, id 60735, len 1500)
  1049	16:00:02.370349 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500583333 2273009> (DF) (ttl 240, id 60736, len 1252)
  1050	16:00:02.383034 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2273016 500583333> (DF) (ttl 64, id 419, len 52)
  1051	16:00:02.390741 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60737, len 1500)
  1052	16:00:02.403829 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60738, len 1500)
  1053	16:00:02.404570 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2273018 500583337> (DF) (ttl 64, id 420, len 52)
  1054	16:00:02.414936 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60739, len 1252)
  1055	16:00:02.428452 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60740, len 1500)
  1056	16:00:02.429273 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2273021 500583337> (DF) (ttl 64, id 421, len 52)
  1057	16:00:02.442247 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60741, len 1500)
  1058	16:00:02.443060 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2273022 500583340> (DF) (ttl 64, id 422, len 52)
  1059	16:00:02.445406 172.16.183.2.1039 > clustera.icq.com.http: P [bad tcp cksum f92f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1060	16:00:02.445406 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2273022 500583340> (DF) (ttl 64, id 423, len 52)
  1061	16:00:02.452871 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60742, len 1252)
  1062	16:00:02.453610 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 424, len 40)
  1063	16:00:02.466380 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60743, len 1500)
  1064	16:00:02.467161 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 425, len 40)
  1065	16:00:02.478936 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60744, len 1500)
  1066	16:00:02.479701 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 426, len 40)
  1067	16:00:02.488831 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60745, len 1252)
  1068	16:00:02.489520 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 427, len 40)
  1069	16:00:02.500860 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500583344 2273021> (DF) (ttl 240, id 60746, len 1500)
  1070	16:00:02.501606 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 428, len 40)
  1071	16:00:02.513426 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500583344 2273021> (DF) (ttl 240, id 60747, len 1500)
  1072	16:00:02.514204 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 429, len 40)
  1073	16:00:02.523322 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60748, len 1252)
  1074	16:00:02.524000 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 430, len 40)
  1075	16:00:02.535363 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60749, len 1500)
  1076	16:00:02.536125 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 431, len 40)
  1077	16:00:02.547424 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60750, len 1500)
  1078	16:00:02.548197 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 432, len 40)
  1079	16:00:04.457053 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50737+ A? web.icq.com. [|domain] (ttl 64, id 433, len 57)
  1080	16:00:04.469357 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50737 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36503, len 233)
  1081	16:00:04.470137 172.16.183.2.1040 > clustera.icq.com.http: S [tcp sum ok] 392431046:392431046(0) win 32120 <mss 1460,sackOK,timestamp 2273224 0,nop,wscale 0> (DF) (ttl 64, id 434, len 60)
  1082	16:00:04.488701 clustera.icq.com.http > 172.16.183.2.1040: S [tcp sum ok] 1393169427:1393169427(0) ack 392431047 win 33304 <nop,nop,timestamp 199514718 2273224,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 34733, len 64)
  1083	16:00:04.489152 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2273226 199514718> (DF) (ttl 64, id 435, len 52)
  1084	16:00:05.486138 172.16.183.2.1040 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2273326 199514718> (DF) (ttl 64, id 436, len 104)
  1085	16:00:05.506700 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] ack 53 win 33278 <nop,nop,timestamp 199514819 2273326> (DF) (ttl 49, id 34734, len 52)
  1086	16:00:10.184289 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34735, len 1500)
  1087	16:00:10.185303 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2273797 199515285> (DF) (ttl 64, id 437, len 52)
  1088	16:00:10.205223 clustera.icq.com.http > 172.16.183.2.1040: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34736, len 1500)
  1089	16:00:10.225174 clustera.icq.com.http > 172.16.183.2.1040: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34737, len 1477)
  1090	16:00:10.242965 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2273803 199515285> (DF) (ttl 64, id 438, len 52)
  1091	16:00:10.245635 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34738, len 1500)
  1092	16:00:10.264833 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 199515289 2273797> (DF) (ttl 49, id 34739, len 1500)
  1093	16:00:10.265623 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2273805 199515285> (DF) (ttl 64, id 439, len 52)
  1094	16:00:10.279674 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 199515289 2273797> (DF) (ttl 49, id 34740, len 1252)
  1095	16:00:10.292970 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2273808 199515289> (DF) (ttl 64, id 440, len 52)
  1096	16:00:10.296881 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34741, len 1500)
  1097	16:00:10.314629 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34742, len 1500)
  1098	16:00:10.315571 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2273810 199515295> (DF) (ttl 64, id 441, len 52)
  1099	16:00:10.328724 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34743, len 1252)
  1100	16:00:10.342985 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2273813 199515295> (DF) (ttl 64, id 442, len 52)
  1101	16:00:10.346150 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34744, len 1500)
  1102	16:00:10.362414 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34745, len 1500)
  1103	16:00:10.363094 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2273814 199515297> (DF) (ttl 64, id 443, len 52)
  1104	16:00:10.367058 172.16.183.2.1040 > clustera.icq.com.http: P [bad tcp cksum c59e!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1105	16:00:10.367058 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2273815 199515297> (DF) (ttl 64, id 444, len 52)
  1106	16:00:10.375012 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34746, len 1252)
  1107	16:00:10.375761 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 445, len 40)
  1108	16:00:10.390004 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 199515300 2273808> (DF) (ttl 49, id 34747, len 1500)
  1109	16:00:10.390737 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 446, len 40)
  1110	16:00:10.405520 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 199515300 2273808> (DF) (ttl 49, id 34748, len 1500)
  1111	16:00:10.406231 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 447, len 40)
  1112	16:00:10.418120 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34749, len 1252)
  1113	16:00:10.418819 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 448, len 40)
  1114	16:00:10.433592 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34750, len 1500)
  1115	16:00:10.434303 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 449, len 40)
  1116	16:00:10.448630 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34751, len 1500)
  1117	16:00:10.449360 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 450, len 40)
  1118	16:00:10.459754 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 199515305 2273813> (DF) (ttl 49, id 34752, len 1252)
  1119	16:00:10.460429 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 451, len 40)
  1120	16:00:10.473279 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 199515305 2273813> (DF) (ttl 49, id 34753, len 1500)
  1121	16:00:10.473996 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 452, len 40)
  1122	16:00:10.486569 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34754, len 1500)
  1123	16:00:10.487307 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 453, len 40)
  1124	16:00:10.497944 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34755, len 1252)
  1125	16:00:10.498623 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 454, len 40)
  1126	16:00:10.511454 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 28898:30346(1448) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34756, len 1500)
  1127	16:00:10.512161 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 455, len 40)
  1128	16:00:12.377009 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50738+ A? web.icq.com. [|domain] (ttl 64, id 456, len 57)
  1129	16:00:12.389776 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50738 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 37209, len 233)
  1130	16:00:12.390800 172.16.183.2.1041 > clustera.icq.com.http: S [tcp sum ok] 401016398:401016398(0) win 32120 <mss 1460,sackOK,timestamp 2274017 0,nop,wscale 0> (DF) (ttl 64, id 457, len 60)
  1131	16:00:12.409838 clustera.icq.com.http > 172.16.183.2.1041: S [tcp sum ok] 1376461372:1376461372(0) ack 401016399 win 33304 <nop,nop,timestamp 18563713 2274017,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 52946, len 64)
  1132	16:00:12.410400 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274019 18563713> (DF) (ttl 64, id 458, len 52)
  1133	16:00:13.405762 172.16.183.2.1041 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274119 18563713> (DF) (ttl 64, id 459, len 104)
  1134	16:00:13.424902 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18563815 2274119> (DF) (ttl 49, id 52947, len 52)
  1135	16:00:14.788769 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52948, len 1500)
  1136	16:00:14.789545 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2274257 18563949> (DF) (ttl 64, id 460, len 52)
  1137	16:00:14.808709 clustera.icq.com.http > 172.16.183.2.1041: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52949, len 1500)
  1138	16:00:14.822944 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2274261 18563949> (DF) (ttl 64, id 461, len 52)
  1139	16:00:14.825947 clustera.icq.com.http > 172.16.183.2.1041: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52950, len 1477)
  1140	16:00:14.843457 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18563953 2274257> (DF) (ttl 49, id 52951, len 1500)
  1141	16:00:14.852945 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2274264 18563949> (DF) (ttl 64, id 462, len 52)
  1142	16:00:14.860703 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18563953 2274257> (DF) (ttl 49, id 52952, len 1500)
  1143	16:00:14.875037 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18563956 2274261> (DF) (ttl 49, id 52953, len 1252)
  1144	16:00:14.892489 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18563956 2274261> (DF) (ttl 49, id 52954, len 1500)
  1145	16:00:14.893239 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2274267 18563953> (DF) (ttl 64, id 463, len 52)
  1146	16:00:14.908991 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52955, len 1500)
  1147	16:00:14.921358 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52956, len 1252)
  1148	16:00:14.932927 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2274272 18563959> (DF) (ttl 64, id 464, len 52)
  1149	16:00:14.936834 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52957, len 1500)
  1150	16:00:14.951852 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52958, len 1500)
  1151	16:00:14.952615 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2274274 18563959> (DF) (ttl 64, id 465, len 52)
  1152	16:00:14.955356 172.16.183.2.1041 > clustera.icq.com.http: P [bad tcp cksum 8e90!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1153	16:00:14.955356 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2274274 18563959> (DF) (ttl 64, id 466, len 52)
  1154	16:00:14.963977 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52959, len 1252)
  1155	16:00:14.965182 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 467, len 40)
  1156	16:00:14.979440 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52960, len 1500)
  1157	16:00:14.980283 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 468, len 40)
  1158	16:00:14.994466 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52961, len 1500)
  1159	16:00:14.995420 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 469, len 40)
  1160	16:00:15.005842 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52962, len 1252)
  1161	16:00:15.006571 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 470, len 40)
  1162	16:00:15.019356 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52963, len 1500)
  1163	16:00:15.020121 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 471, len 40)
  1164	16:00:15.032655 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52964, len 1500)
  1165	16:00:15.033400 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 472, len 40)
  1166	16:00:15.044029 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52965, len 1252)
  1167	16:00:15.045001 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 473, len 40)
  1168	16:00:15.057532 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52966, len 1500)
  1169	16:00:15.058292 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 474, len 40)
  1170	16:00:15.070836 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52967, len 1500)
  1171	16:00:15.071610 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 475, len 40)
  1172	16:00:16.977087 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50739+ A? web.icq.com. [|domain] (ttl 64, id 476, len 57)
  1173	16:00:16.990301 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50739 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 37512, len 233)
  1174	16:00:16.991304 172.16.183.2.1042 > clusterc.icq.com.http: S [tcp sum ok] 396875548:396875548(0) win 32120 <mss 1460,sackOK,timestamp 2274476 0,nop,wscale 0> (DF) (ttl 64, id 477, len 60)
  1175	16:00:17.008396 clusterc.icq.com.http > 172.16.183.2.1042: S [tcp sum ok] 1930518105:1930518105(0) ack 396875549 win 33304 <nop,nop,timestamp 214680094 2274476,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 38189, len 64)
  1176	16:00:17.008924 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274477 214680094> (DF) (ttl 64, id 478, len 52)
  1177	16:00:17.995679 172.16.183.2.1042 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274577 214680094> (DF) (ttl 64, id 479, len 104)
  1178	16:00:18.021979 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 214680194 2274577> (DF) (ttl 49, id 38190, len 52)
  1179	16:00:18.696238 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38191, len 1500)
  1180	16:00:18.696991 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2274648 214680261> (DF) (ttl 64, id 480, len 52)
  1181	16:00:18.714485 clusterc.icq.com.http > 172.16.183.2.1042: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38192, len 1500)
  1182	16:00:18.731460 clusterc.icq.com.http > 172.16.183.2.1042: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38193, len 1477)
  1183	16:00:18.732293 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2274652 214680261> (DF) (ttl 64, id 481, len 52)
  1184	16:00:18.748960 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 214680264 2274648> (DF) (ttl 49, id 38194, len 1500)
  1185	16:00:18.762886 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2274655 214680261> (DF) (ttl 64, id 482, len 52)
  1186	16:00:18.765971 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 214680264 2274648> (DF) (ttl 49, id 38195, len 1500)
  1187	16:00:18.779820 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 214680268 2274652> (DF) (ttl 49, id 38196, len 1252)
  1188	16:00:18.792890 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2274658 214680264> (DF) (ttl 64, id 483, len 52)
  1189	16:00:18.795063 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 214680268 2274652> (DF) (ttl 49, id 38197, len 1500)
  1190	16:00:18.810557 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38198, len 1500)
  1191	16:00:18.811368 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2274660 214680268> (DF) (ttl 64, id 484, len 52)
  1192	16:00:18.823173 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38199, len 1252)
  1193	16:00:18.838413 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38200, len 1500)
  1194	16:00:18.842916 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2274663 214680271> (DF) (ttl 64, id 485, len 52)
  1195	16:00:18.853433 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38201, len 1500)
  1196	16:00:18.856850 172.16.183.2.1042 > clusterc.icq.com.http: P [bad tcp cksum 9a62!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1197	16:00:18.856850 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2274664 214680274> (DF) (ttl 64, id 486, len 52)
  1198	16:00:18.865780 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38202, len 1252)
  1199	16:00:18.866627 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 487, len 40)
  1200	16:00:18.880027 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38203, len 1500)
  1201	16:00:18.880768 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 488, len 40)
  1202	16:00:18.893324 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38204, len 1500)
  1203	16:00:18.894080 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 489, len 40)
  1204	16:00:18.905195 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38205, len 1252)
  1205	16:00:18.905941 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 490, len 40)
  1206	16:00:18.918698 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38206, len 1500)
  1207	16:00:18.919437 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 491, len 40)
  1208	16:00:18.932254 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38207, len 1500)
  1209	16:00:18.933000 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 492, len 40)
  1210	16:00:18.942890 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38208, len 1252)
  1211	16:00:18.943567 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 493, len 40)
  1212	16:00:18.956401 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38209, len 1500)
  1213	16:00:18.957102 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 494, len 40)
  1214	16:00:20.857265 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50740+ A? web.icq.com. [|domain] (ttl 64, id 495, len 57)
  1215	16:00:20.870933 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50740 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 37839, len 233)
  1216	16:00:20.871940 172.16.183.2.1043 > clusterb.icq.com.http: S [tcp sum ok] 400485699:400485699(0) win 32120 <mss 1460,sackOK,timestamp 2274865 0,nop,wscale 0> (DF) (ttl 64, id 496, len 60)
  1217	16:00:20.892975 clusterb.icq.com.http > 172.16.183.2.1043: S [tcp sum ok] 1033565685:1033565685(0) ack 400485700 win 65535 <nop,nop,timestamp 501162567 2274865,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22215, len 64)
  1218	16:00:20.893513 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274866 501162567> (DF) (ttl 64, id 497, len 52)
  1219	16:00:21.885758 172.16.183.2.1043 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274966 501162567> (DF) (ttl 64, id 498, len 104)
  1220	16:00:21.914667 clusterb.icq.com.http > 172.16.183.2.1043: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501162669 2274966> (DF) (ttl 240, id 22216, len 52)
  1221	16:00:22.105403 clusterb.icq.com.http > 172.16.183.2.1043: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501162689 2274966> (DF) (ttl 240, id 22217, len 391)
  1222	16:00:22.105851 clusterb.icq.com.http > 172.16.183.2.1043: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501162689 2274966> (DF) (ttl 240, id 22218, len 52)
  1223	16:00:22.106286 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2274989 501162689> (DF) (ttl 64, id 499, len 52)
  1224	16:00:22.106723 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2274989 501162689> (DF) (ttl 64, id 500, len 52)
  1225	16:00:47.632750 172.16.183.2.1043 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2277522 501162689> (DF) (ttl 64, id 501, len 52)
  1226	16:00:47.651120 172.16.183.2.1043 > clusterb.icq.com.http: P [bad tcp cksum 691f!] 633080327:633080378(51) ack 3661887364 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1227	16:00:47.651120 clusterb.icq.com.http > 172.16.183.2.1043: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501165243 2277522> (DF) (ttl 240, id 22219, len 52)
  1228	16:00:48.637178 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50741+ A? web.icq.com. [|domain] (ttl 64, id 502, len 57)
  1229	16:00:48.652745 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50741 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 40661, len 233)
  1230	16:00:48.653889 172.16.183.2.1044 > clusterc.icq.com.http: S [tcp sum ok] 432467290:432467290(0) win 32120 <mss 1460,sackOK,timestamp 2277624 0,nop,wscale 0> (DF) (ttl 64, id 503, len 60)
  1231	16:00:48.671587 clusterc.icq.com.http > 172.16.183.2.1044: S [tcp sum ok] 2313883439:2313883439(0) ack 432467291 win 65535 <nop,nop,timestamp 200572841 2277624,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 64667, len 64)
  1232	16:00:48.672146 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2277626 200572841> (DF) (ttl 64, id 504, len 52)
  1233	16:00:49.665636 172.16.183.2.1044 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2277726 200572841> (DF) (ttl 64, id 505, len 104)
  1234	16:00:49.694276 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200572944 2277726> (DF) (ttl 240, id 64668, len 52)
  1235	16:00:50.257685 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200572996 2277726> (DF) (ttl 240, id 64669, len 1500)
  1236	16:00:50.258443 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2277805 200572996> (DF) (ttl 64, id 506, len 52)
  1237	16:00:50.275909 clusterc.icq.com.http > 172.16.183.2.1044: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200572996 2277726> (DF) (ttl 240, id 64670, len 1500)
  1238	16:00:50.292617 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2277809 200572996> (DF) (ttl 64, id 507, len 52)
  1239	16:00:50.300313 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200573002 2277805> (DF) (ttl 240, id 64671, len 1477)
  1240	16:00:50.317564 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200573002 2277805> (DF) (ttl 240, id 64672, len 1500)
  1241	16:00:50.322632 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2277812 200573002> (DF) (ttl 64, id 508, len 52)
  1242	16:00:50.341699 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200573005 2277809> (DF) (ttl 240, id 64673, len 1500)
  1243	16:00:50.354069 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200573005 2277809> (DF) (ttl 240, id 64674, len 1252)
  1244	16:00:50.369294 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64675, len 1500)
  1245	16:00:50.370147 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2277817 200573005> (DF) (ttl 64, id 509, len 52)
  1246	16:00:50.384825 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64676, len 1500)
  1247	16:00:50.397437 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64677, len 1252)
  1248	16:00:50.402610 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2277820 200573008> (DF) (ttl 64, id 510, len 52)
  1249	16:00:50.412653 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64678, len 1500)
  1250	16:00:50.427687 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64679, len 1500)
  1251	16:00:50.428377 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2277822 200573013> (DF) (ttl 64, id 511, len 52)
  1252	16:00:50.432928 172.16.183.2.1044 > clusterc.icq.com.http: P [bad tcp cksum 8982!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1253	16:00:50.432928 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2277823 200573013> (DF) (ttl 64, id 512, len 52)
  1254	16:00:50.438799 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64680, len 1252)
  1255	16:00:50.439539 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 513, len 40)
  1256	16:00:50.452297 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64681, len 1500)
  1257	16:00:50.453111 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 514, len 40)
  1258	16:00:50.466341 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64682, len 1500)
  1259	16:00:50.467064 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 515, len 40)
  1260	16:00:50.477226 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64683, len 1252)
  1261	16:00:50.477971 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 516, len 40)
  1262	16:00:50.490730 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64684, len 1500)
  1263	16:00:50.491518 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 517, len 40)
  1264	16:00:50.504060 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64685, len 1500)
  1265	16:00:50.505048 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 518, len 40)
  1266	16:00:50.515173 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64686, len 1252)
  1267	16:00:50.515875 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 519, len 40)
  1268	16:00:50.528188 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64687, len 1500)
  1269	16:00:50.528924 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 520, len 40)
  1270	16:00:52.457167 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50742+ A? web.icq.com. [|domain] (ttl 64, id 521, len 57)
  1271	16:00:52.470071 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50742 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 40970, len 233)
  1272	16:00:52.470890 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278025 0,nop,wscale 0> (DF) (ttl 64, id 522, len 60)
  1273	16:00:55.475442 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278325 0,nop,wscale 0> (DF) (ttl 64, id 523, len 60)
  1274	16:01:01.465370 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278925 0,nop,wscale 0> (DF) (ttl 64, id 524, len 60)
  1275	16:01:13.465357 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2280125 0,nop,wscale 0> (DF) (ttl 64, id 525, len 60)
  1276	16:01:37.545304 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2282525 0,nop,wscale 0> (DF) (ttl 64, id 526, len 60)
  1277	16:02:25.585528 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2287325 0,nop,wscale 0> (DF) (ttl 64, id 527, len 60)
  1278	16:02:40.043361 218.209.145.27 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 5029, len 422)
  1279	16:03:37.492985 122.255.17.55 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 34315, len 422)
  1280	16:04:01.405275 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2296925 0,nop,wscale 0> (DF) (ttl 64, id 528, len 60)
  1281	16:04:01.427339 clusterb.icq.com.http > 172.16.183.2.1045: S [tcp sum ok] 2816262027:2816262027(0) ack 445611524 win 65535 <nop,nop,timestamp 500736823 2296925,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 24615, len 64)
  1282	16:04:01.428219 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2296927 500736823> (DF) (ttl 64, id 529, len 52)
  1283	16:04:02.425771 172.16.183.2.1045 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2297027 500736823> (DF) (ttl 64, id 530, len 104)
  1284	16:04:02.445116 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500736925 2297027> (DF) (ttl 240, id 24616, len 52)
  1285	16:04:02.967859 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500736975 2297027> (DF) (ttl 240, id 24617, len 1500)
  1286	16:04:02.968615 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2297082 500736975> (DF) (ttl 64, id 531, len 52)
  1287	16:04:02.988073 clusterb.icq.com.http > 172.16.183.2.1045: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500736975 2297027> (DF) (ttl 240, id 24618, len 1500)
  1288	16:04:03.000890 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2297086 500736975> (DF) (ttl 64, id 532, len 52)
  1289	16:04:03.007023 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500736979 2297082> (DF) (ttl 240, id 24619, len 1477)
  1290	16:04:03.024283 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500736979 2297082> (DF) (ttl 240, id 24620, len 1500)
  1291	16:04:03.030915 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2297089 500736979> (DF) (ttl 64, id 533, len 52)
  1292	16:04:03.041536 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500736982 2297086> (DF) (ttl 240, id 24621, len 1500)
  1293	16:04:03.055866 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500736982 2297086> (DF) (ttl 240, id 24622, len 1252)
  1294	16:04:03.070897 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2297093 500736982> (DF) (ttl 64, id 534, len 52)
  1295	16:04:03.073791 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24623, len 1500)
  1296	16:04:03.090062 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24624, len 1500)
  1297	16:04:03.091010 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2297095 500736985> (DF) (ttl 64, id 535, len 52)
  1298	16:04:03.102916 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24625, len 1252)
  1299	16:04:03.117911 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24626, len 1500)
  1300	16:04:03.130895 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2297099 500736985> (DF) (ttl 64, id 536, len 52)
  1301	16:04:03.132928 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24627, len 1500)
  1302	16:04:03.137661 172.16.183.2.1045 > clusterb.icq.com.http: P [bad tcp cksum e822!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1303	16:04:03.137661 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2297099 500736989> (DF) (ttl 64, id 537, len 52)
  1304	16:04:03.145527 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24628, len 1252)
  1305	16:04:03.146303 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 538, len 40)
  1306	16:04:03.160766 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24629, len 1500)
  1307	16:04:03.161543 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 539, len 40)
  1308	16:04:03.176030 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24630, len 1500)
  1309	16:04:03.176813 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 540, len 40)
  1310	16:04:03.187413 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24631, len 1252)
  1311	16:04:03.188150 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 541, len 40)
  1312	16:04:03.200911 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24632, len 1500)
  1313	16:04:03.201675 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 542, len 40)
  1314	16:04:03.214210 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24633, len 1500)
  1315	16:04:03.215177 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 543, len 40)
  1316	16:04:03.225105 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24634, len 1252)
  1317	16:04:03.225837 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 544, len 40)
  1318	16:04:05.147413 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50743+ A? web.icq.com. [|domain] (ttl 64, id 545, len 57)
  1319	16:04:05.161020 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50743 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 59442, len 233)
  1320	16:04:05.162886 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2297301 0,nop,wscale 0> (DF) (ttl 64, id 546, len 60)
  1321	16:04:08.165294 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2297602 0,nop,wscale 0> (DF) (ttl 64, id 547, len 60)
  1322	16:04:14.175215 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2298202 0,nop,wscale 0> (DF) (ttl 64, id 548, len 60)
  1323	16:04:26.185231 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2299402 0,nop,wscale 0> (DF) (ttl 64, id 549, len 60)
  1324	16:04:33.707291 26.44.146.84 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 63600, len 422)
  1325	16:04:50.155396 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2301802 0,nop,wscale 0> (DF) (ttl 64, id 550, len 60)
  1326	16:05:38.205079 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2306602 0,nop,wscale 0> (DF) (ttl 64, id 551, len 60)
  1327	16:07:14.275104 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2316202 0,nop,wscale 0> (DF) (ttl 64, id 552, len 60)
  1328	16:07:14.291981 clustera.icq.com.http > 172.16.183.2.1046: S [tcp sum ok] 2841586950:2841586950(0) ack 659617463 win 24616 <nop,nop,timestamp 252426667 2316202,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 16559, len 64)
  1329	16:07:14.292677 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2316203 252426667> (DF) (ttl 64, id 553, len 52)
  1330	16:07:15.285607 172.16.183.2.1046 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2316303 252426667> (DF) (ttl 64, id 554, len 104)
  1331	16:07:15.305108 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252426768 2316303> (DF) (ttl 49, id 16560, len 52)
  1332	16:07:16.231649 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16561, len 1500)
  1333	16:07:16.232439 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2316415 252426860> (DF) (ttl 64, id 555, len 52)
  1334	16:07:16.240513 clustera.icq.com.http > 172.16.183.2.1046: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16562, len 1500)
  1335	16:07:16.249196 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2316417 252426860> (DF) (ttl 64, id 556, len 52)
  1336	16:07:16.249339 clustera.icq.com.http > 172.16.183.2.1046: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16563, len 1477)
  1337	16:07:16.259172 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2316418 252426860> (DF) (ttl 64, id 557, len 52)
  1338	16:07:16.260220 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252426863 2316415> (DF) (ttl 49, id 16564, len 1500)
  1339	16:07:16.268863 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252426863 2316415> (DF) (ttl 49, id 16565, len 1500)
  1340	16:07:16.269722 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2316419 252426863> (DF) (ttl 64, id 558, len 52)
  1341	16:07:16.276780 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252426864 2316417> (DF) (ttl 49, id 16566, len 1252)
  1342	16:07:16.279192 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 2316420 252426863> (DF) (ttl 64, id 559, len 52)
  1343	16:07:16.285866 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252426864 2316417> (DF) (ttl 49, id 16567, len 1500)
  1344	16:07:16.289175 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 30408 <nop,nop,timestamp 2316421 252426864> (DF) (ttl 64, id 560, len 52)
  1345	16:07:16.294697 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252426865 2316418> (DF) (ttl 49, id 16568, len 1500)
  1346	16:07:16.299174 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2316422 252426865> (DF) (ttl 64, id 561, len 52)
  1347	16:07:16.301900 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252426865 2316418> (DF) (ttl 49, id 16569, len 1252)
  1348	16:07:16.309181 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 30408 <nop,nop,timestamp 2316423 252426865> (DF) (ttl 64, id 562, len 52)
  1349	16:07:16.311004 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252426866 2316419> (DF) (ttl 49, id 16570, len 1500)
  1350	16:07:16.319194 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2316424 252426866> (DF) (ttl 64, id 563, len 52)
  1351	16:07:16.319839 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252426866 2316419> (DF) (ttl 49, id 16571, len 1500)
  1352	16:07:16.327041 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16572, len 1252)
  1353	16:07:16.329183 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 16610 win 30408 <nop,nop,timestamp 2316425 252426866> (DF) (ttl 64, id 564, len 52)
  1354	16:07:16.331686 172.16.183.2.1046 > clustera.icq.com.http: P [bad tcp cksum ee28!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1355	16:07:16.331686 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2316425 252426866> (DF) (ttl 64, id 565, len 52)
  1356	16:07:16.336088 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16573, len 1500)
  1357	16:07:16.336887 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 566, len 40)
  1358	16:07:16.344965 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16574, len 1500)
  1359	16:07:16.345720 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 567, len 40)
  1360	16:07:16.352149 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252426868 2316421> (DF) (ttl 49, id 16575, len 1252)
  1361	16:07:16.352889 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 568, len 40)
  1362	16:07:16.361212 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252426868 2316421> (DF) (ttl 49, id 16576, len 1500)
  1363	16:07:16.361947 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 569, len 40)
  1364	16:07:16.370080 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252426869 2316422> (DF) (ttl 49, id 16577, len 1500)
  1365	16:07:16.370816 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 570, len 40)
  1366	16:07:16.377042 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252426869 2316422> (DF) (ttl 49, id 16578, len 1252)
  1367	16:07:16.377737 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 571, len 40)
  1368	16:07:16.386348 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252426870 2316423> (DF) (ttl 49, id 16579, len 1500)
  1369	16:07:16.387046 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 572, len 40)
  1370	16:07:16.395224 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252426870 2316423> (DF) (ttl 49, id 16580, len 1500)
  1371	16:07:16.395956 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 573, len 40)
  1372	16:07:16.402403 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 27698:28898(1200) ack 53 win 24616 <nop,nop,timestamp 252426871 2316424> (DF) (ttl 49, id 16581, len 1252)
  1373	16:07:16.403166 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 574, len 40)
  1374	16:07:16.411235 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 28898:30346(1448) ack 53 win 24616 <nop,nop,timestamp 252426871 2316424> (DF) (ttl 49, id 16582, len 1500)
  1375	16:07:16.411987 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 575, len 40)
  1376	16:07:16.420342 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 30346:31794(1448) ack 53 win 24616 <nop,nop,timestamp 252426872 2316425> (DF) (ttl 49, id 16583, len 1500)
  1377	16:07:16.421077 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 576, len 40)
  1378	16:07:16.427298 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 31794:32994(1200) ack 53 win 24616 <nop,nop,timestamp 252426872 2316425> (DF) (ttl 49, id 16584, len 1252)
  1379	16:07:16.428098 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 577, len 40)
  1380	16:07:18.337287 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50744+ A? web.icq.com. [|domain] (ttl 64, id 578, len 57)
  1381	16:07:18.349897 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50744 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (189) (ttl 61, id 9271, len 217)
  1382	16:07:18.350977 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2316626 0,nop,wscale 0> (DF) (ttl 64, id 579, len 60)
  1383	16:07:21.354948 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2316926 0,nop,wscale 0> (DF) (ttl 64, id 580, len 60)
  1384	16:07:27.355294 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2317526 0,nop,wscale 0> (DF) (ttl 64, id 581, len 60)
  1385	16:07:39.345296 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2318726 0,nop,wscale 0> (DF) (ttl 64, id 582, len 60)
  1386	16:08:03.365057 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2321126 0,nop,wscale 0> (DF) (ttl 64, id 583, len 60)
  1387	16:08:51.355222 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2325926 0,nop,wscale 0> (DF) (ttl 64, id 584, len 60)
  1388	16:10:27.345208 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2335526 0,nop,wscale 0> (DF) (ttl 64, id 585, len 60)
  1389	16:10:27.362622 clusterb.icq.com.http > 172.16.183.2.1047: S [tcp sum ok] 3116560542:3116560542(0) ack 852933309 win 65535 <nop,nop,timestamp 502652418 2335526,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 44053, len 64)
  1390	16:10:27.363146 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2335527 502652418> (DF) (ttl 64, id 586, len 52)
  1391	16:10:28.355443 172.16.183.2.1047 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2335627 502652418> (DF) (ttl 64, id 587, len 104)
  1392	16:10:28.465644 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502652529 2335627> (DF) (ttl 240, id 44054, len 52)
  1393	16:10:29.125383 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502652592 2335627> (DF) (ttl 240, id 44055, len 1500)
  1394	16:10:29.126201 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2335711 502652592> (DF) (ttl 64, id 588, len 52)
  1395	16:10:29.142865 clusterb.icq.com.http > 172.16.183.2.1047: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502652592 2335627> (DF) (ttl 240, id 44056, len 1500)
  1396	16:10:29.145047 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2335713 502652592> (DF) (ttl 64, id 589, len 52)
  1397	16:10:29.159850 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502652597 2335711> (DF) (ttl 240, id 44057, len 1477)
  1398	16:10:29.174919 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502652597 2335711> (DF) (ttl 240, id 44058, len 1500)
  1399	16:10:29.175837 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2335716 502652597> (DF) (ttl 64, id 590, len 52)
  1400	16:10:29.190167 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502652598 2335713> (DF) (ttl 240, id 44059, len 1500)
  1401	16:10:29.190922 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2335717 502652597> (DF) (ttl 64, id 591, len 52)
  1402	16:10:29.202774 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502652598 2335713> (DF) (ttl 240, id 44060, len 1252)
  1403	16:10:29.214915 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2335720 502652598> (DF) (ttl 64, id 592, len 52)
  1404	16:10:29.217760 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502652601 2335716> (DF) (ttl 240, id 44061, len 1500)
  1405	16:10:29.232790 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502652601 2335716> (DF) (ttl 240, id 44062, len 1500)
  1406	16:10:29.233501 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2335721 502652601> (DF) (ttl 64, id 593, len 52)
  1407	16:10:29.244432 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44063, len 1252)
  1408	16:10:29.258415 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44064, len 1500)
  1409	16:10:29.271465 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44065, len 1500)
  1410	16:10:29.272206 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2335725 502652603> (DF) (ttl 64, id 594, len 52)
  1411	16:10:29.276382 172.16.183.2.1047 > clusterb.icq.com.http: P [bad tcp cksum f489!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1412	16:10:29.276382 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2335725 502652603> (DF) (ttl 64, id 595, len 52)
  1413	16:10:29.282336 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502652605 2335720> (DF) (ttl 240, id 44066, len 1252)
  1414	16:10:29.283127 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 596, len 40)
  1415	16:10:29.295862 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502652605 2335720> (DF) (ttl 240, id 44067, len 1500)
  1416	16:10:29.296667 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 597, len 40)
  1417	16:10:29.309394 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44068, len 1500)
  1418	16:10:29.310114 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 598, len 40)
  1419	16:10:29.320289 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44069, len 1252)
  1420	16:10:29.321025 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 599, len 40)
  1421	16:10:29.333289 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44070, len 1500)
  1422	16:10:29.334046 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 600, len 40)
  1423	16:10:29.345855 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44071, len 1500)
  1424	16:10:29.346668 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 601, len 40)
  1425	16:10:29.355516 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44072, len 1252)
  1426	16:10:29.356297 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 602, len 40)
  1427	16:10:29.367796 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44073, len 1500)
  1428	16:10:29.368592 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 603, len 40)
  1429	16:10:29.379618 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44074, len 1500)
  1430	16:10:29.380414 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 604, len 40)
  1431	16:10:31.277357 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50745+ A? web.icq.com. [|domain] (ttl 64, id 605, len 57)
  1432	16:10:31.298336 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50745* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 26750, len 233)
  1433	16:10:31.299306 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2335927 0,nop,wscale 0> (DF) (ttl 64, id 606, len 60)
  1434	16:10:34.307000 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2336227 0,nop,wscale 0> (DF) (ttl 64, id 607, len 60)
  1435	16:10:40.295372 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2336827 0,nop,wscale 0> (DF) (ttl 64, id 608, len 60)
  1436	16:10:52.355292 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2338027 0,nop,wscale 0> (DF) (ttl 64, id 609, len 60)
  1437	16:11:16.375004 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2340427 0,nop,wscale 0> (DF) (ttl 64, id 610, len 60)
  1438	16:12:04.465149 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2345227 0,nop,wscale 0> (DF) (ttl 64, id 611, len 60)
  1439	16:13:40.455172 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2354827 0,nop,wscale 0> (DF) (ttl 64, id 612, len 60)
  1440	16:13:40.472680 clustera.icq.com.http > 172.16.183.2.1048: S [tcp sum ok] 65291330:65291330(0) ack 1071854660 win 65535 <nop,nop,timestamp 17257910 2354827,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22813, len 64)
  1441	16:13:40.473354 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2354828 17257910> (DF) (ttl 64, id 613, len 52)
  1442	16:13:41.465449 172.16.183.2.1048 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2354928 17257910> (DF) (ttl 64, id 614, len 104)
  1443	16:13:41.504486 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17258013 2354928> (DF) (ttl 240, id 22814, len 52)
  1444	16:13:42.087355 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17258069 2354928> (DF) (ttl 240, id 22815, len 1500)
  1445	16:13:42.088136 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2355013 17258069> (DF) (ttl 64, id 615, len 52)
  1446	16:13:42.107805 clustera.icq.com.http > 172.16.183.2.1048: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17258069 2354928> (DF) (ttl 240, id 22816, len 1500)
  1447	16:13:42.124924 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2355017 17258069> (DF) (ttl 64, id 616, len 52)
  1448	16:13:42.134880 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17258074 2355013> (DF) (ttl 240, id 22817, len 1477)
  1449	16:13:42.152145 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17258074 2355013> (DF) (ttl 240, id 22818, len 1500)
  1450	16:13:42.169637 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17258077 2355017> (DF) (ttl 240, id 22819, len 1500)
  1451	16:13:42.170409 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2355021 17258074> (DF) (ttl 64, id 617, len 52)
  1452	16:13:42.183978 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17258077 2355017> (DF) (ttl 240, id 22820, len 1252)
  1453	16:13:42.205357 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22821, len 1500)
  1454	16:13:42.214928 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2355026 17258077> (DF) (ttl 64, id 618, len 52)
  1455	16:13:42.220143 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22822, len 1500)
  1456	16:13:42.233009 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22823, len 1252)
  1457	16:13:42.235739 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2355028 17258081> (DF) (ttl 64, id 619, len 52)
  1458	16:13:42.248471 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22824, len 1500)
  1459	16:13:42.263745 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22825, len 1500)
  1460	16:13:42.264559 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2355031 17258081> (DF) (ttl 64, id 620, len 52)
  1461	16:13:42.275874 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22826, len 1252)
  1462	16:13:42.277946 172.16.183.2.1048 > clustera.icq.com.http: P [bad tcp cksum a61!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1463	16:13:42.277946 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2355032 17258086> (DF) (ttl 64, id 621, len 52)
  1464	16:13:42.291334 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22827, len 1500)
  1465	16:13:42.292188 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 622, len 40)
  1466	16:13:42.304648 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22828, len 1500)
  1467	16:13:42.305835 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 623, len 40)
  1468	16:13:42.316021 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22829, len 1252)
  1469	16:13:42.316728 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 624, len 40)
  1470	16:13:42.330012 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22830, len 1500)
  1471	16:13:42.330726 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 625, len 40)
  1472	16:13:42.343308 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22831, len 1500)
  1473	16:13:42.344042 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 626, len 40)
  1474	16:13:42.353946 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22832, len 1252)
  1475	16:13:42.354939 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 627, len 40)
  1476	16:13:42.367699 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22833, len 1500)
  1477	16:13:42.368450 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 628, len 40)
  1478	16:13:44.287578 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50746+ A? web.icq.com. [|domain] (ttl 64, id 629, len 57)
  1479	16:13:44.334469 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50746 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 42583, len 244)
  1480	16:13:44.335984 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2355236 0,nop,wscale 0> (DF) (ttl 64, id 630, len 60)
  1481	16:13:47.335362 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2355536 0,nop,wscale 0> (DF) (ttl 64, id 631, len 60)
  1482	16:13:53.315161 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2356136 0,nop,wscale 0> (DF) (ttl 64, id 632, len 60)
  1483	16:14:05.315069 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2357336 0,nop,wscale 0> (DF) (ttl 64, id 633, len 60)
  1484	16:14:29.315090 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2359736 0,nop,wscale 0> (DF) (ttl 64, id 634, len 60)
  1485	16:15:17.315322 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2364536 0,nop,wscale 0> (DF) (ttl 64, id 635, len 60)
  1486	16:16:53.365237 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2374136 0,nop,wscale 0> (DF) (ttl 64, id 636, len 60)
  1487	16:16:53.383644 clusterb.icq.com.http > 172.16.183.2.1049: S [tcp sum ok] 3516591145:3516591145(0) ack 1267988836 win 65535 <nop,nop,timestamp 501261818 2374136,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 31685, len 64)
  1488	16:16:53.384579 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2374137 501261818> (DF) (ttl 64, id 637, len 52)
  1489	16:16:54.385509 172.16.183.2.1049 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2374237 501261818> (DF) (ttl 64, id 638, len 104)
  1490	16:16:54.407578 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501261920 2374237> (DF) (ttl 240, id 31686, len 52)
  1491	16:16:55.450176 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501262022 2374237> (DF) (ttl 240, id 31687, len 1500)
  1492	16:16:55.450919 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2374355 501262022> (DF) (ttl 64, id 639, len 52)
  1493	16:16:55.470122 clusterb.icq.com.http > 172.16.183.2.1049: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501262022 2374237> (DF) (ttl 240, id 31688, len 1500)
  1494	16:16:55.484014 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2374359 501262022> (DF) (ttl 64, id 640, len 52)
  1495	16:16:55.487357 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501262026 2374355> (DF) (ttl 240, id 31689, len 1477)
  1496	16:16:55.504633 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501262026 2374355> (DF) (ttl 240, id 31690, len 1500)
  1497	16:16:55.514014 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2374362 501262026> (DF) (ttl 64, id 641, len 52)
  1498	16:16:55.521861 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501262030 2374359> (DF) (ttl 240, id 31691, len 1500)
  1499	16:16:55.536442 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501262030 2374359> (DF) (ttl 240, id 31692, len 1252)
  1500	16:16:55.553903 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31693, len 1500)
  1501	16:16:55.555040 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2374366 501262030> (DF) (ttl 64, id 642, len 52)
  1502	16:16:55.570146 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31694, len 1500)
  1503	16:16:55.570896 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2374367 501262033> (DF) (ttl 64, id 643, len 52)
  1504	16:16:55.582267 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31695, len 1252)
  1505	16:16:55.597498 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31696, len 1500)
  1506	16:16:55.613015 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31697, len 1500)
  1507	16:16:55.613796 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2374372 501262033> (DF) (ttl 64, id 644, len 52)
  1508	16:16:55.616382 172.16.183.2.1049 > clusterb.icq.com.http: P [bad tcp cksum 291f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1509	16:16:55.616382 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2374372 501262037> (DF) (ttl 64, id 645, len 52)
  1510	16:16:55.625127 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31698, len 1252)
  1511	16:16:55.625937 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 646, len 40)
  1512	16:16:55.640357 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31699, len 1500)
  1513	16:16:55.641161 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 647, len 40)
  1514	16:16:55.655378 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31700, len 1500)
  1515	16:16:55.656166 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 648, len 40)
  1516	16:16:55.666759 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31701, len 1252)
  1517	16:16:55.667496 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 649, len 40)
  1518	16:16:55.680512 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31702, len 1500)
  1519	16:16:55.681280 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 650, len 40)
  1520	16:16:55.693577 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31703, len 1500)
  1521	16:16:55.694340 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 651, len 40)
  1522	16:16:55.704717 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31704, len 1252)
  1523	16:16:55.705575 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 652, len 40)
  1524	16:16:57.647218 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50747+ A? web.icq.com. [|domain] (ttl 64, id 653, len 57)
  1525	16:16:57.663043 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50747 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 57051, len 233)
  1526	16:16:57.664155 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2374574 0,nop,wscale 0> (DF) (ttl 64, id 654, len 60)
  1527	16:17:00.664893 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2374874 0,nop,wscale 0> (DF) (ttl 64, id 655, len 60)
  1528	16:17:06.665159 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2375474 0,nop,wscale 0> (DF) (ttl 64, id 656, len 60)
  1529	16:17:18.665180 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2376674 0,nop,wscale 0> (DF) (ttl 64, id 657, len 60)
  1530	16:17:42.665122 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2379074 0,nop,wscale 0> (DF) (ttl 64, id 658, len 60)
  1531	16:18:30.665242 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2383874 0,nop,wscale 0> (DF) (ttl 64, id 659, len 60)
  1532	16:20:06.645248 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2393474 0,nop,wscale 0> (DF) (ttl 64, id 660, len 60)
  1533	16:20:06.670591 clusterb.icq.com.http > 172.16.183.2.1050: S [tcp sum ok] 1408673640:1408673640(0) ack 1464747464 win 65535 <nop,nop,timestamp 501439236 2393474,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 36393, len 64)
  1534	16:20:06.671263 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2393476 501439236> (DF) (ttl 64, id 661, len 52)
  1535	16:20:07.665587 172.16.183.2.1050 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2393576 501439236> (DF) (ttl 64, id 662, len 104)
  1536	16:20:07.687375 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501439338 2393576> (DF) (ttl 240, id 36394, len 52)
  1537	16:20:08.509210 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501439418 2393576> (DF) (ttl 240, id 36395, len 1500)
  1538	16:20:08.510088 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2393668 501439418> (DF) (ttl 64, id 663, len 52)
  1539	16:20:08.526959 clusterb.icq.com.http > 172.16.183.2.1050: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501439418 2393576> (DF) (ttl 240, id 36396, len 1500)
  1540	16:20:08.532295 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2393670 501439418> (DF) (ttl 64, id 664, len 52)
  1541	16:20:08.546394 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501439422 2393668> (DF) (ttl 240, id 36397, len 1477)
  1542	16:20:08.562298 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2393673 501439422> (DF) (ttl 64, id 665, len 52)
  1543	16:20:08.563655 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501439422 2393668> (DF) (ttl 240, id 36398, len 1500)
  1544	16:20:08.580909 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501439424 2393670> (DF) (ttl 240, id 36399, len 1500)
  1545	16:20:08.581672 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2393674 501439422> (DF) (ttl 64, id 666, len 52)
  1546	16:20:08.594495 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501439424 2393670> (DF) (ttl 240, id 36400, len 1252)
  1547	16:20:08.609973 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501439427 2393673> (DF) (ttl 240, id 36401, len 1500)
  1548	16:20:08.622313 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2393679 501439424> (DF) (ttl 64, id 667, len 52)
  1549	16:20:08.624761 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501439427 2393673> (DF) (ttl 240, id 36402, len 1500)
  1550	16:20:08.637622 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36403, len 1252)
  1551	16:20:08.642296 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2393681 501439427> (DF) (ttl 64, id 668, len 52)
  1552	16:20:08.653089 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36404, len 1500)
  1553	16:20:08.668366 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36405, len 1500)
  1554	16:20:08.669060 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2393683 501439429> (DF) (ttl 64, id 669, len 52)
  1555	16:20:08.671392 172.16.183.2.1050 > clusterb.icq.com.http: P [bad tcp cksum 6e89!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1556	16:20:08.671392 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2393683 501439429> (DF) (ttl 64, id 670, len 52)
  1557	16:20:08.680484 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36406, len 1252)
  1558	16:20:08.681307 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 671, len 40)
  1559	16:20:08.694960 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36407, len 1500)
  1560	16:20:08.695757 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 672, len 40)
  1561	16:20:08.708014 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36408, len 1500)
  1562	16:20:08.708794 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 673, len 40)
  1563	16:20:08.718901 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36409, len 1252)
  1564	16:20:08.719595 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 674, len 40)
  1565	16:20:08.732675 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36410, len 1500)
  1566	16:20:08.733541 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 675, len 40)
  1567	16:20:08.746467 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36411, len 1500)
  1568	16:20:08.747225 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 676, len 40)
  1569	16:20:08.757276 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36412, len 1252)
  1570	16:20:08.757997 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 677, len 40)
  1571	16:20:08.770601 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36413, len 1500)
  1572	16:20:08.771316 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 678, len 40)
  1573	16:20:08.783406 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36414, len 1500)
  1574	16:20:08.784225 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 679, len 40)
  1575	16:20:10.677073 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50748+ A? web.icq.com. [|domain] (ttl 64, id 680, len 57)
  1576	16:20:10.689806 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50748 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 7333, len 233)
  1577	16:20:10.690979 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2393885 0,nop,wscale 0> (DF) (ttl 64, id 681, len 60)
  1578	16:20:13.695249 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2394185 0,nop,wscale 0> (DF) (ttl 64, id 682, len 60)
  1579	16:20:19.695459 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2394785 0,nop,wscale 0> (DF) (ttl 64, id 683, len 60)
  1580	16:20:31.695249 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2395985 0,nop,wscale 0> (DF) (ttl 64, id 684, len 60)
  1581	16:20:55.795163 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2398385 0,nop,wscale 0> (DF) (ttl 64, id 685, len 60)
  1582	16:21:43.835257 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2403185 0,nop,wscale 0> (DF) (ttl 64, id 686, len 60)
  1583	16:23:19.895107 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2412785 0,nop,wscale 0> (DF) (ttl 64, id 687, len 60)
  1584	16:23:19.912931 clustera.icq.com.http > 172.16.183.2.1051: S [tcp sum ok] 2244470900:2244470900(0) ack 1660991499 win 24616 <nop,nop,timestamp 252523231 2412785,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 64695, len 64)
  1585	16:23:19.913705 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2412786 252523231> (DF) (ttl 64, id 688, len 52)
  1586	16:23:20.915374 172.16.183.2.1051 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2412886 252523231> (DF) (ttl 64, id 689, len 104)
  1587	16:23:20.942295 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252523334 2412886> (DF) (ttl 49, id 64696, len 52)
  1588	16:23:21.585251 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64697, len 1500)
  1589	16:23:21.586081 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2412981 252523396> (DF) (ttl 64, id 690, len 52)
  1590	16:23:21.602766 clustera.icq.com.http > 172.16.183.2.1051: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64698, len 1500)
  1591	16:23:21.617753 clustera.icq.com.http > 172.16.183.2.1051: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64699, len 1477)
  1592	16:23:21.620577 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2412985 252523396> (DF) (ttl 64, id 691, len 52)
  1593	16:23:21.634299 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252523401 2412981> (DF) (ttl 49, id 64700, len 1500)
  1594	16:23:21.649312 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252523401 2412981> (DF) (ttl 49, id 64701, len 1500)
  1595	16:23:21.650204 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2412988 252523401> (DF) (ttl 64, id 692, len 52)
  1596	16:23:21.662165 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64702, len 1252)
  1597	16:23:21.677400 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64703, len 1500)
  1598	16:23:21.680571 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2412991 252523404> (DF) (ttl 64, id 693, len 52)
  1599	16:23:21.692678 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64704, len 1500)
  1600	16:23:21.704301 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64705, len 1252)
  1601	16:23:21.717792 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64706, len 1500)
  1602	16:23:21.718596 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2412995 252523404> (DF) (ttl 64, id 694, len 52)
  1603	16:23:21.731353 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64707, len 1500)
  1604	16:23:21.732060 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2412996 252523407> (DF) (ttl 64, id 695, len 52)
  1605	16:23:21.741991 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64708, len 1252)
  1606	16:23:21.743119 172.16.183.2.1051 > clustera.icq.com.http: P [bad tcp cksum 994!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1607	16:23:21.743119 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2412997 252523410> (DF) (ttl 64, id 696, len 52)
  1608	16:23:21.755479 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64709, len 1500)
  1609	16:23:21.756326 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 697, len 40)
  1610	16:23:21.769035 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64710, len 1500)
  1611	16:23:21.769790 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 698, len 40)
  1612	16:23:21.779924 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64711, len 1252)
  1613	16:23:21.780655 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 699, len 40)
  1614	16:23:21.793684 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64712, len 1500)
  1615	16:23:21.794442 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 700, len 40)
  1616	16:23:21.805737 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64713, len 1500)
  1617	16:23:21.806554 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 701, len 40)
  1618	16:23:21.815880 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64714, len 1252)
  1619	16:23:21.816864 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 702, len 40)
  1620	16:23:21.827671 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64715, len 1500)
  1621	16:23:21.828380 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 703, len 40)
  1622	16:23:21.839988 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64716, len 1500)
  1623	16:23:21.840815 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 704, len 40)
  1624	16:23:23.757191 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50749+ A? web.icq.com. [|domain] (ttl 64, id 705, len 57)
  1625	16:23:23.778682 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50749* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 30338, len 233)
  1626	16:23:23.780106 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2413200 0,nop,wscale 0> (DF) (ttl 64, id 706, len 60)
  1627	16:23:26.785128 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2413500 0,nop,wscale 0> (DF) (ttl 64, id 707, len 60)
  1628	16:23:32.785291 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2414100 0,nop,wscale 0> (DF) (ttl 64, id 708, len 60)
  1629	16:23:44.775406 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2415300 0,nop,wscale 0> (DF) (ttl 64, id 709, len 60)
  1630	16:24:08.765229 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2417700 0,nop,wscale 0> (DF) (ttl 64, id 710, len 60)
  1631	16:24:56.755483 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2422500 0,nop,wscale 0> (DF) (ttl 64, id 711, len 60)
  1632	16:26:13.699933 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62318, len 48)
  1633	16:26:13.700847 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 2694365744 win 0 (ttl 255, id 712, len 40)
  1634	16:26:14.305254 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62332, len 48)
  1635	16:26:14.305467 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 1 win 0 (ttl 255, id 713, len 40)
  1636	16:26:14.911331 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62343, len 48)
  1637	16:26:14.911544 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 1 win 0 (ttl 255, id 714, len 40)
  1638	16:26:32.805360 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2432100 0,nop,wscale 0> (DF) (ttl 64, id 715, len 60)
  1639	16:26:32.822188 clusterc.icq.com.http > 172.16.183.2.1052: S [tcp sum ok] 2307320426:2307320426(0) ack 1869426068 win 65535 <nop,nop,timestamp 501474729 2432100,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 63643, len 64)
  1640	16:26:32.823113 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2432101 501474729> (DF) (ttl 64, id 716, len 52)
  1641	16:26:33.815609 172.16.183.2.1052 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2432201 501474729> (DF) (ttl 64, id 717, len 104)
  1642	16:26:33.855962 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501474832 2432201> (DF) (ttl 240, id 63644, len 52)
  1643	16:26:34.822686 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501474927 2432201> (DF) (ttl 240, id 63645, len 1500)
  1644	16:26:34.823484 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2432311 501474927> (DF) (ttl 64, id 718, len 52)
  1645	16:26:34.836702 clusterc.icq.com.http > 172.16.183.2.1052: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501474927 2432201> (DF) (ttl 240, id 63646, len 1500)
  1646	16:26:34.838853 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2432313 501474927> (DF) (ttl 64, id 719, len 52)
  1647	16:26:34.858372 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501474930 2432311> (DF) (ttl 240, id 63647, len 1477)
  1648	16:26:34.871697 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501474930 2432311> (DF) (ttl 240, id 63648, len 1500)
  1649	16:26:34.872489 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2432316 501474930> (DF) (ttl 64, id 720, len 52)
  1650	16:26:34.885241 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501474932 2432313> (DF) (ttl 240, id 63649, len 1500)
  1651	16:26:34.885991 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2432317 501474930> (DF) (ttl 64, id 721, len 52)
  1652	16:26:34.896381 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501474932 2432313> (DF) (ttl 240, id 63650, len 1252)
  1653	16:26:34.909152 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501474935 2432316> (DF) (ttl 240, id 63651, len 1500)
  1654	16:26:34.910592 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2432320 501474932> (DF) (ttl 64, id 722, len 52)
  1655	16:26:34.920974 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501474935 2432316> (DF) (ttl 240, id 63652, len 1500)
  1656	16:26:34.921724 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2432321 501474935> (DF) (ttl 64, id 723, len 52)
  1657	16:26:34.931368 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63653, len 1252)
  1658	16:26:34.943648 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63654, len 1500)
  1659	16:26:34.948849 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2432324 501474937> (DF) (ttl 64, id 724, len 52)
  1660	16:26:34.955468 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63655, len 1500)
  1661	16:26:34.960179 172.16.183.2.1052 > clusterc.icq.com.http: P [bad tcp cksum cd10!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1662	16:26:34.960179 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2432325 501474937> (DF) (ttl 64, id 725, len 52)
  1663	16:26:34.965352 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501474939 2432320> (DF) (ttl 240, id 63656, len 1252)
  1664	16:26:34.966107 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 726, len 40)
  1665	16:26:34.977618 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501474939 2432320> (DF) (ttl 240, id 63657, len 1500)
  1666	16:26:34.978356 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 727, len 40)
  1667	16:26:34.989690 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63658, len 1500)
  1668	16:26:34.990421 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 728, len 40)
  1669	16:26:34.999345 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63659, len 1252)
  1670	16:26:35.000049 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 729, len 40)
  1671	16:26:35.010388 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63660, len 1500)
  1672	16:26:35.011206 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 730, len 40)
  1673	16:26:35.021233 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63661, len 1500)
  1674	16:26:35.022066 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 731, len 40)
  1675	16:26:35.030633 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63662, len 1252)
  1676	16:26:35.031396 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 732, len 40)
  1677	16:26:35.041681 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63663, len 1500)
  1678	16:26:35.042403 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 733, len 40)
  1679	16:26:36.967467 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50750+ A? web.icq.com. [|domain] (ttl 64, id 734, len 57)
  1680	16:26:37.004265 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50750 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 58444, len 244)
  1681	16:26:37.005400 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2432528 0,nop,wscale 0> (DF) (ttl 64, id 735, len 60)
  1682	16:26:40.004952 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2432828 0,nop,wscale 0> (DF) (ttl 64, id 736, len 60)
  1683	16:26:45.995260 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2433428 0,nop,wscale 0> (DF) (ttl 64, id 737, len 60)
  1684	16:26:58.065197 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2434628 0,nop,wscale 0> (DF) (ttl 64, id 738, len 60)
  1685	16:27:22.085066 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2437028 0,nop,wscale 0> (DF) (ttl 64, id 739, len 60)
  1686	16:28:10.075085 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2441828 0,nop,wscale 0> (DF) (ttl 64, id 740, len 60)
  1687	16:29:46.055324 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2451428 0,nop,wscale 0> (DF) (ttl 64, id 741, len 60)
  1688	16:29:46.075130 clustera.icq.com.http > 172.16.183.2.1053: S [tcp sum ok] 2574466656:2574466656(0) ack 2068930477 win 33304 <nop,nop,timestamp 17154225 2451428,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 34539, len 64)
  1689	16:29:46.075684 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2451430 17154225> (DF) (ttl 64, id 742, len 52)
  1690	16:29:47.075632 172.16.183.2.1053 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2451530 17154225> (DF) (ttl 64, id 743, len 104)
  1691	16:29:47.114314 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17154329 2451530> (DF) (ttl 49, id 34540, len 52)
  1692	16:29:48.660747 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34541, len 1500)
  1693	16:29:48.661562 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2451701 17154482> (DF) (ttl 64, id 744, len 52)
  1694	16:29:48.680954 clustera.icq.com.http > 172.16.183.2.1053: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34542, len 1500)
  1695	16:29:48.695761 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2451705 17154482> (DF) (ttl 64, id 745, len 52)
  1696	16:29:48.698192 clustera.icq.com.http > 172.16.183.2.1053: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34543, len 1477)
  1697	16:29:48.715448 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17154486 2451701> (DF) (ttl 49, id 34544, len 1500)
  1698	16:29:48.727586 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2451708 17154482> (DF) (ttl 64, id 746, len 52)
  1699	16:29:48.732676 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17154486 2451701> (DF) (ttl 49, id 34545, len 1500)
  1700	16:29:48.744912 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2451710 17154486> (DF) (ttl 64, id 747, len 52)
  1701	16:29:48.747306 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17154489 2451705> (DF) (ttl 49, id 34546, len 1252)
  1702	16:29:48.764722 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17154489 2451705> (DF) (ttl 49, id 34547, len 1500)
  1703	16:29:48.777119 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2451713 17154489> (DF) (ttl 64, id 748, len 52)
  1704	16:29:48.780720 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34548, len 1500)
  1705	16:29:48.793590 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34549, len 1252)
  1706	16:29:48.794362 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2451715 17154492> (DF) (ttl 64, id 749, len 52)
  1707	16:29:48.809061 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34550, len 1500)
  1708	16:29:48.823852 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17154494 2451710> (DF) (ttl 49, id 34551, len 1500)
  1709	16:29:48.824899 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2451717 17154492> (DF) (ttl 64, id 750, len 52)
  1710	16:29:48.832532 172.16.183.2.1053 > clustera.icq.com.http: P [bad tcp cksum 2b6f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1711	16:29:48.832532 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2451718 17154492> (DF) (ttl 64, id 751, len 52)
  1712	16:29:48.836435 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17154494 2451710> (DF) (ttl 49, id 34552, len 1252)
  1713	16:29:48.837244 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 752, len 40)
  1714	16:29:48.851662 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34553, len 1500)
  1715	16:29:48.852438 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 753, len 40)
  1716	16:29:48.866697 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34554, len 1500)
  1717	16:29:48.867440 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 754, len 40)
  1718	16:29:48.878075 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34555, len 1252)
  1719	16:29:48.878805 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 755, len 40)
  1720	16:29:48.891825 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17154499 2451715> (DF) (ttl 49, id 34556, len 1500)
  1721	16:29:48.892593 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 756, len 40)
  1722	16:29:48.905383 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17154499 2451715> (DF) (ttl 49, id 34557, len 1500)
  1723	16:29:48.906162 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 757, len 40)
  1724	16:29:48.916263 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34558, len 1252)
  1725	16:29:48.917093 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 758, len 40)
  1726	16:29:48.929778 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34559, len 1500)
  1727	16:29:48.930553 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 759, len 40)
  1728	16:29:48.943335 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34560, len 1500)
  1729	16:29:48.944113 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 760, len 40)
  1730	16:29:48.954450 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34561, len 1252)
  1731	16:29:48.955458 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 761, len 40)
  1732	16:29:50.837457 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50751+ A? web.icq.com. [|domain] (ttl 64, id 762, len 57)
  1733	16:29:50.851679 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50751 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 9180, len 217)
  1734	16:29:50.852999 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2451920 0,nop,wscale 0> (DF) (ttl 64, id 763, len 60)
  1735	16:29:53.865382 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2452221 0,nop,wscale 0> (DF) (ttl 64, id 764, len 60)
  1736	16:29:59.864847 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2452821 0,nop,wscale 0> (DF) (ttl 64, id 765, len 60)
  1737	16:30:11.865184 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2454021 0,nop,wscale 0> (DF) (ttl 64, id 766, len 60)
  1738	16:30:35.885068 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2456421 0,nop,wscale 0> (DF) (ttl 64, id 767, len 60)
  1739	16:31:23.925086 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2461221 0,nop,wscale 0> (DF) (ttl 64, id 768, len 60)
  1740	16:32:59.945169 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2470821 0,nop,wscale 0> (DF) (ttl 64, id 769, len 60)
  1741	16:32:59.961483 clusterc.icq.com.http > 172.16.183.2.1054: S [tcp sum ok] 2546932478:2546932478(0) ack 2301613155 win 65535 <nop,nop,timestamp 25989686 2470821,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 46621, len 64)
  1742	16:32:59.962155 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2470822 25989686> (DF) (ttl 64, id 770, len 52)
  1743	16:33:00.955497 172.16.183.2.1054 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2470922 25989686> (DF) (ttl 64, id 771, len 104)
  1744	16:33:00.975305 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 25989787 2470922> (DF) (ttl 240, id 46622, len 52)
  1745	16:33:02.131721 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 25989901 2470922> (DF) (ttl 240, id 46623, len 1500)
  1746	16:33:02.132488 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2471054 25989901> (DF) (ttl 64, id 772, len 52)
  1747	16:33:02.151446 clusterc.icq.com.http > 172.16.183.2.1054: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 25989901 2470922> (DF) (ttl 240, id 46624, len 1500)
  1748	16:33:02.164924 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2471058 25989901> (DF) (ttl 64, id 773, len 52)
  1749	16:33:02.168897 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 25989905 2471054> (DF) (ttl 240, id 46625, len 1477)
  1750	16:33:02.185930 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 25989905 2471054> (DF) (ttl 240, id 46626, len 1500)
  1751	16:33:02.195397 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2471061 25989905> (DF) (ttl 64, id 774, len 52)
  1752	16:33:02.203409 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 25989908 2471058> (DF) (ttl 240, id 46627, len 1500)
  1753	16:33:02.214911 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2471063 25989908> (DF) (ttl 64, id 775, len 52)
  1754	16:33:02.217501 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 25989908 2471058> (DF) (ttl 240, id 46628, len 1252)
  1755	16:33:02.235449 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46629, len 1500)
  1756	16:33:02.245400 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2471066 25989908> (DF) (ttl 64, id 776, len 52)
  1757	16:33:02.250960 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46630, len 1500)
  1758	16:33:02.263818 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46631, len 1252)
  1759	16:33:02.264836 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2471068 25989911> (DF) (ttl 64, id 777, len 52)
  1760	16:33:02.279059 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 25989913 2471063> (DF) (ttl 240, id 46632, len 1500)
  1761	16:33:02.294084 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 25989913 2471063> (DF) (ttl 240, id 46633, len 1500)
  1762	16:33:02.295085 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2471071 25989911> (DF) (ttl 64, id 778, len 52)
  1763	16:33:02.299452 172.16.183.2.1054 > clusterc.icq.com.http: P [bad tcp cksum 5b11!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1764	16:33:02.299452 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2471071 25989913> (DF) (ttl 64, id 779, len 52)
  1765	16:33:02.306681 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46634, len 1252)
  1766	16:33:02.307421 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 780, len 40)
  1767	16:33:02.321659 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46635, len 1500)
  1768	16:33:02.322467 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 781, len 40)
  1769	16:33:02.336941 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46636, len 1500)
  1770	16:33:02.337697 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 782, len 40)
  1771	16:33:02.347832 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 25989918 2471068> (DF) (ttl 240, id 46637, len 1252)
  1772	16:33:02.348589 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 783, len 40)
  1773	16:33:02.362058 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 25989918 2471068> (DF) (ttl 240, id 46638, len 1500)
  1774	16:33:02.362833 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 784, len 40)
  1775	16:33:02.375364 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46639, len 1500)
  1776	16:33:02.376107 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 785, len 40)
  1777	16:33:02.386259 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46640, len 1252)
  1778	16:33:02.387041 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 786, len 40)
  1779	16:33:02.399762 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46641, len 1500)
  1780	16:33:02.400563 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 787, len 40)
  1781	16:33:04.297062 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50752+ A? web.icq.com. [|domain] (ttl 64, id 788, len 57)
  1782	16:33:04.310350 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50752 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 25330, len 233)
  1783	16:33:04.311337 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2471272 0,nop,wscale 0> (DF) (ttl 64, id 789, len 60)
  1784	16:33:07.325011 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2471572 0,nop,wscale 0> (DF) (ttl 64, id 790, len 60)
  1785	16:33:13.325240 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2472172 0,nop,wscale 0> (DF) (ttl 64, id 791, len 60)
  1786	16:33:25.325197 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2473372 0,nop,wscale 0> (DF) (ttl 64, id 792, len 60)
  1787	16:33:49.325098 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2475772 0,nop,wscale 0> (DF) (ttl 64, id 793, len 60)
  1788	16:34:37.305215 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2480572 0,nop,wscale 0> (DF) (ttl 64, id 794, len 60)
  1789	16:36:13.285038 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2490172 0,nop,wscale 0> (DF) (ttl 64, id 795, len 60)
  1790	16:36:13.524357 clustera.icq.com.http > 172.16.183.2.1055: S [tcp sum ok] 2296856698:2296856698(0) ack 2486004081 win 33304 <nop,nop,timestamp 17192957 2490172,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 28643, len 64)
  1791	16:36:13.525031 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2490195 17192957> (DF) (ttl 64, id 796, len 52)
  1792	16:36:14.525400 172.16.183.2.1055 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2490295 17192957> (DF) (ttl 64, id 797, len 104)
  1793	16:36:14.623450 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17193089 2490295> (DF) (ttl 49, id 28644, len 52)
  1794	16:36:15.228224 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28645, len 1500)
  1795	16:36:15.228996 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2490370 17193147> (DF) (ttl 64, id 798, len 52)
  1796	16:36:15.248168 clustera.icq.com.http > 172.16.183.2.1055: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28646, len 1500)
  1797	16:36:15.263665 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2490374 17193147> (DF) (ttl 64, id 799, len 52)
  1798	16:36:15.265402 clustera.icq.com.http > 172.16.183.2.1055: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28647, len 1477)
  1799	16:36:15.282663 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17193151 2490370> (DF) (ttl 49, id 28648, len 1500)
  1800	16:36:15.293669 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2490377 17193147> (DF) (ttl 64, id 800, len 52)
  1801	16:36:15.300158 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17193151 2490370> (DF) (ttl 49, id 28649, len 1500)
  1802	16:36:15.314500 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17193155 2490374> (DF) (ttl 49, id 28650, len 1252)
  1803	16:36:15.331949 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17193155 2490374> (DF) (ttl 49, id 28651, len 1500)
  1804	16:36:15.332749 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2490381 17193151> (DF) (ttl 64, id 801, len 52)
  1805	16:36:15.348441 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28652, len 1500)
  1806	16:36:15.360844 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28653, len 1252)
  1807	16:36:15.361596 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2490384 17193158> (DF) (ttl 64, id 802, len 52)
  1808	16:36:15.376042 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28654, len 1500)
  1809	16:36:15.391318 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28655, len 1500)
  1810	16:36:15.392068 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2490386 17193158> (DF) (ttl 64, id 803, len 52)
  1811	16:36:15.396910 172.16.183.2.1055 > clustera.icq.com.http: P [bad tcp cksum f95a!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1812	16:36:15.396910 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2490387 17193158> (DF) (ttl 64, id 804, len 52)
  1813	16:36:15.403672 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28656, len 1252)
  1814	16:36:15.404415 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 805, len 40)
  1815	16:36:15.418927 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28657, len 1500)
  1816	16:36:15.419740 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 806, len 40)
  1817	16:36:15.433920 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28658, len 1500)
  1818	16:36:15.434922 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 807, len 40)
  1819	16:36:15.445304 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17193165 2490384> (DF) (ttl 49, id 28659, len 1252)
  1820	16:36:15.446026 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 808, len 40)
  1821	16:36:15.458816 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17193165 2490384> (DF) (ttl 49, id 28660, len 1500)
  1822	16:36:15.459525 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 809, len 40)
  1823	16:36:15.472365 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28661, len 1500)
  1824	16:36:15.473192 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 810, len 40)
  1825	16:36:15.483488 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28662, len 1252)
  1826	16:36:15.484289 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 811, len 40)
  1827	16:36:15.497004 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28663, len 1500)
  1828	16:36:15.497809 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 812, len 40)
  1829	16:36:15.510302 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28664, len 1500)
  1830	16:36:15.511119 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 813, len 40)
  1831	16:36:17.467309 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50753+ A? web.icq.com. [|domain] (ttl 64, id 814, len 57)
  1832	16:36:17.481996 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50753 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 40519, len 233)
  1833	16:36:17.483098 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2490589 0,nop,wscale 0> (DF) (ttl 64, id 815, len 60)
  1834	16:36:20.484984 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2490889 0,nop,wscale 0> (DF) (ttl 64, id 816, len 60)
  1835	16:36:26.485312 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2491489 0,nop,wscale 0> (DF) (ttl 64, id 817, len 60)
  1836	16:36:38.485248 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2492689 0,nop,wscale 0> (DF) (ttl 64, id 818, len 60)
  1837	16:37:02.555133 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2495089 0,nop,wscale 0> (DF) (ttl 64, id 819, len 60)
  1838	16:37:50.545420 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2499889 0,nop,wscale 0> (DF) (ttl 64, id 820, len 60)
  1839	16:39:26.535351 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2509489 0,nop,wscale 0> (DF) (ttl 64, id 821, len 60)
  1840	16:39:26.553343 clustera.icq.com.http > 172.16.183.2.1056: S [tcp sum ok] 4039897856:4039897856(0) ack 2691588671 win 65535 <nop,nop,timestamp 501670768 2509489,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 57953, len 64)
  1841	16:39:26.554018 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2509490 501670768> (DF) (ttl 64, id 822, len 52)
  1842	16:39:27.555517 172.16.183.2.1056 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2509590 501670768> (DF) (ttl 64, id 823, len 104)
  1843	16:39:27.576289 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501670871 2509590> (DF) (ttl 240, id 57954, len 52)
  1844	16:39:28.124412 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501670924 2509590> (DF) (ttl 240, id 57955, len 1500)
  1845	16:39:28.125376 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2509666 501670924> (DF) (ttl 64, id 824, len 52)
  1846	16:39:28.141889 clustera.icq.com.http > 172.16.183.2.1056: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501670924 2509590> (DF) (ttl 240, id 57956, len 1500)
  1847	16:39:28.160363 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501670928 2509666> (DF) (ttl 240, id 57957, len 1477)
  1848	16:39:28.162105 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2509670 501670924> (DF) (ttl 64, id 825, len 52)
  1849	16:39:28.175418 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501670928 2509666> (DF) (ttl 240, id 57958, len 1500)
  1850	16:39:28.195126 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57959, len 1500)
  1851	16:39:28.195836 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2509673 501670928> (DF) (ttl 64, id 826, len 52)
  1852	16:39:28.207730 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57960, len 1252)
  1853	16:39:28.221952 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2509676 501670931> (DF) (ttl 64, id 827, len 52)
  1854	16:39:28.222718 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57961, len 1500)
  1855	16:39:28.237988 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57962, len 1500)
  1856	16:39:28.238733 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2509677 501670931> (DF) (ttl 64, id 828, len 52)
  1857	16:39:28.249128 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57963, len 1252)
  1858	16:39:28.261963 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2509680 501670934> (DF) (ttl 64, id 829, len 52)
  1859	16:39:28.262370 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57964, len 1500)
  1860	16:39:28.275712 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501670938 2509676> (DF) (ttl 240, id 57965, len 1500)
  1861	16:39:28.276441 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2509681 501670934> (DF) (ttl 64, id 830, len 52)
  1862	16:39:28.279032 172.16.183.2.1056 > clustera.icq.com.http: P [bad tcp cksum 873a!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1863	16:39:28.279032 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2509681 501670934> (DF) (ttl 64, id 831, len 52)
  1864	16:39:28.287051 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501670938 2509676> (DF) (ttl 240, id 57966, len 1252)
  1865	16:39:28.287830 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 832, len 40)
  1866	16:39:28.300800 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57967, len 1500)
  1867	16:39:28.301534 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 833, len 40)
  1868	16:39:28.313849 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57968, len 1500)
  1869	16:39:28.314566 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 834, len 40)
  1870	16:39:28.325240 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57969, len 1252)
  1871	16:39:28.326003 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 835, len 40)
  1872	16:39:28.337749 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501670941 2509680> (DF) (ttl 240, id 57970, len 1500)
  1873	16:39:28.338503 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 836, len 40)
  1874	16:39:28.349579 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501670941 2509680> (DF) (ttl 240, id 57971, len 1500)
  1875	16:39:28.350413 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 837, len 40)
  1876	16:39:28.359483 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57972, len 1252)
  1877	16:39:28.360256 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 838, len 40)
  1878	16:39:28.371516 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57973, len 1500)
  1879	16:39:28.372273 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 839, len 40)
  1880	16:39:28.383576 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57974, len 1500)
  1881	16:39:28.384348 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 840, len 40)
  1882	16:39:30.297207 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50754+ A? web.icq.com. [|domain] (ttl 64, id 841, len 57)
  1883	16:39:30.328182 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50754 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 54613, len 244)
  1884	16:39:30.329378 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2509885 0,nop,wscale 0> (DF) (ttl 64, id 842, len 60)
  1885	16:39:33.325339 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2510185 0,nop,wscale 0> (DF) (ttl 64, id 843, len 60)
  1886	16:39:39.325384 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2510785 0,nop,wscale 0> (DF) (ttl 64, id 844, len 60)
  1887	16:39:51.315386 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2511985 0,nop,wscale 0> (DF) (ttl 64, id 845, len 60)
  1888	16:40:15.345240 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2514385 0,nop,wscale 0> (DF) (ttl 64, id 846, len 60)
  1889	16:41:03.405130 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2519185 0,nop,wscale 0> (DF) (ttl 64, id 847, len 60)
  1890	16:42:39.475192 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2528785 0,nop,wscale 0> (DF) (ttl 64, id 848, len 60)
  1891	16:42:39.494649 clusterb.icq.com.http > 172.16.183.2.1057: S [tcp sum ok] 668554081:668554081(0) ack 2885314197 win 33304 <nop,nop,timestamp 139005000 2528785,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 31441, len 64)
  1892	16:42:39.495660 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2528786 139005000> (DF) (ttl 64, id 849, len 52)
  1893	16:42:40.485686 172.16.183.2.1057 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2528886 139005000> (DF) (ttl 64, id 850, len 104)
  1894	16:42:40.505497 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 139005101 2528886> (DF) (ttl 49, id 31442, len 52)
  1895	16:42:41.002380 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31443, len 1500)
  1896	16:42:41.003160 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2528960 139005149> (DF) (ttl 64, id 851, len 52)
  1897	16:42:41.020357 clusterb.icq.com.http > 172.16.183.2.1057: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31444, len 1500)
  1898	16:42:41.037835 clusterb.icq.com.http > 172.16.183.2.1057: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31445, len 1477)
  1899	16:42:41.038632 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2528964 139005149> (DF) (ttl 64, id 852, len 52)
  1900	16:42:41.054837 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 139005152 2528960> (DF) (ttl 49, id 31446, len 1500)
  1901	16:42:41.070227 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2528967 139005149> (DF) (ttl 64, id 853, len 52)
  1902	16:42:41.072326 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 139005152 2528960> (DF) (ttl 49, id 31447, len 1500)
  1903	16:42:41.085935 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 139005156 2528964> (DF) (ttl 49, id 31448, len 1252)
  1904	16:42:41.100220 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2528970 139005152> (DF) (ttl 64, id 854, len 52)
  1905	16:42:41.101398 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 139005156 2528964> (DF) (ttl 49, id 31449, len 1500)
  1906	16:42:41.116701 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31450, len 1500)
  1907	16:42:41.117399 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2528971 139005156> (DF) (ttl 64, id 855, len 52)
  1908	16:42:41.129308 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31451, len 1252)
  1909	16:42:41.140217 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2528974 139005159> (DF) (ttl 64, id 856, len 52)
  1910	16:42:41.144531 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31452, len 1500)
  1911	16:42:41.160301 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31453, len 1500)
  1912	16:42:41.160989 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2528976 139005159> (DF) (ttl 64, id 857, len 52)
  1913	16:42:41.163685 172.16.183.2.1057 > clusterb.icq.com.http: P [bad tcp cksum 1593!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1914	16:42:41.163685 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2528976 139005159> (DF) (ttl 64, id 858, len 52)
  1915	16:42:41.172894 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31454, len 1252)
  1916	16:42:41.173708 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 859, len 40)
  1917	16:42:41.186894 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31455, len 1500)
  1918	16:42:41.187641 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 860, len 40)
  1919	16:42:41.200436 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31456, len 1500)
  1920	16:42:41.201202 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 861, len 40)
  1921	16:42:41.211819 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31457, len 1252)
  1922	16:42:41.212515 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 862, len 40)
  1923	16:42:41.225324 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31458, len 1500)
  1924	16:42:41.226096 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 863, len 40)
  1925	16:42:41.238627 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 139005166 2528974> (DF) (ttl 49, id 31459, len 1500)
  1926	16:42:41.239425 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 864, len 40)
  1927	16:42:41.250030 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 139005166 2528974> (DF) (ttl 49, id 31460, len 1252)
  1928	16:42:41.250769 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 865, len 40)
  1929	16:42:41.263278 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31461, len 1500)
  1930	16:42:41.264056 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 866, len 40)
  1931	16:42:41.276324 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31462, len 1500)
  1932	16:42:41.277056 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 867, len 40)
  1933	16:42:41.285979 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31463, len 1252)
  1934	16:42:41.286672 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 868, len 40)
  1935	16:42:43.166772 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50755+ A? web.icq.com. [|domain] (ttl 64, id 869, len 57)
  1936	16:42:43.179265 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50755 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (189) (ttl 61, id 3560, len 217)
  1937	16:42:43.180305 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2529177 0,nop,wscale 0> (DF) (ttl 64, id 870, len 60)
  1938	16:42:46.185006 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2529477 0,nop,wscale 0> (DF) (ttl 64, id 871, len 60)
  1939	16:42:52.205336 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2530077 0,nop,wscale 0> (DF) (ttl 64, id 872, len 60)
  1940	16:43:04.205152 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2531277 0,nop,wscale 0> (DF) (ttl 64, id 873, len 60)
  1941	16:43:28.245080 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2533677 0,nop,wscale 0> (DF) (ttl 64, id 874, len 60)
  1942	16:44:16.185231 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2538477 0,nop,wscale 0> (DF) (ttl 64, id 875, len 60)
  1943	16:45:52.165158 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2548077 0,nop,wscale 0> (DF) (ttl 64, id 876, len 60)
  1944	16:45:52.183604 clusterb.icq.com.http > 172.16.183.2.1058: S [tcp sum ok] 4136000670:4136000670(0) ack 3093563137 win 65535 <nop,nop,timestamp 500987902 2548077,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 45037, len 64)
  1945	16:45:52.183953 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2548078 500987902> (DF) (ttl 64, id 877, len 52)
  1946	16:45:53.185547 172.16.183.2.1058 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2548178 500987902> (DF) (ttl 64, id 878, len 104)
  1947	16:45:53.265439 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500988010 2548178> (DF) (ttl 240, id 45038, len 52)
  1948	16:45:54.074237 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500988089 2548178> (DF) (ttl 240, id 45039, len 1500)
  1949	16:45:54.075225 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2548273 500988089> (DF) (ttl 64, id 879, len 52)
  1950	16:45:54.094425 clusterb.icq.com.http > 172.16.183.2.1058: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500988089 2548178> (DF) (ttl 240, id 45040, len 1500)
  1951	16:45:54.108508 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2548277 500988089> (DF) (ttl 64, id 880, len 52)
  1952	16:45:54.113381 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500988093 2548273> (DF) (ttl 240, id 45041, len 1477)
  1953	16:45:54.130649 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500988093 2548273> (DF) (ttl 240, id 45042, len 1500)
  1954	16:45:54.138512 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2548280 500988093> (DF) (ttl 64, id 881, len 52)
  1955	16:45:54.150110 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500988096 2548277> (DF) (ttl 240, id 45043, len 1500)
  1956	16:45:54.164673 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500988096 2548277> (DF) (ttl 240, id 45044, len 1252)
  1957	16:45:54.178498 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2548284 500988096> (DF) (ttl 64, id 882, len 52)
  1958	16:45:54.181888 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45045, len 1500)
  1959	16:45:54.197912 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45046, len 1500)
  1960	16:45:54.198619 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2548285 500988099> (DF) (ttl 64, id 883, len 52)
  1961	16:45:54.210266 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45047, len 1252)
  1962	16:45:54.224948 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2548288 500988099> (DF) (ttl 64, id 884, len 52)
  1963	16:45:54.225732 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500988103 2548284> (DF) (ttl 240, id 45048, len 1500)
  1964	16:45:54.240788 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500988104 2548284> (DF) (ttl 240, id 45049, len 1500)
  1965	16:45:54.241539 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2548290 500988103> (DF) (ttl 64, id 885, len 52)
  1966	16:45:54.246330 172.16.183.2.1058 > clusterb.icq.com.http: P [bad tcp cksum 530e!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1967	16:45:54.246330 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2548290 500988103> (DF) (ttl 64, id 886, len 52)
  1968	16:45:54.253118 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500988104 2548284> (DF) (ttl 240, id 45050, len 1252)
  1969	16:45:54.253893 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 887, len 40)
  1970	16:45:54.268351 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45051, len 1500)
  1971	16:45:54.269150 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 888, len 40)
  1972	16:45:54.283143 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45052, len 1500)
  1973	16:45:54.283885 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 889, len 40)
  1974	16:45:54.294765 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45053, len 1252)
  1975	16:45:54.295522 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 890, len 40)
  1976	16:45:54.308262 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500988108 2548288> (DF) (ttl 240, id 45054, len 1500)
  1977	16:45:54.309024 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 891, len 40)
  1978	16:45:54.321561 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500988108 2548288> (DF) (ttl 240, id 45055, len 1500)
  1979	16:45:54.322360 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 892, len 40)
  1980	16:45:54.332707 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45056, len 1252)
  1981	16:45:54.333411 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 893, len 40)
  1982	16:45:54.346204 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45057, len 1500)
  1983	16:45:54.346951 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 894, len 40)
  1984	16:45:54.359515 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45058, len 1500)
  1985	16:45:54.360332 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 895, len 40)
  1986	16:45:56.257559 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50756+ A? web.icq.com. [|domain] (ttl 64, id 896, len 57)
  1987	16:45:56.277251 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50756* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 18958, len 233)
  1988	16:45:56.278246 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2548493 0,nop,wscale 0> (DF) (ttl 64, id 897, len 60)
  1989	16:45:59.284970 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2548793 0,nop,wscale 0> (DF) (ttl 64, id 898, len 60)
  1990	16:46:05.285212 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2549393 0,nop,wscale 0> (DF) (ttl 64, id 899, len 60)
  1991	16:46:17.295241 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2550593 0,nop,wscale 0> (DF) (ttl 64, id 900, len 60)
  1992	16:46:41.365183 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2552993 0,nop,wscale 0> (DF) (ttl 64, id 901, len 60)
  1993	16:47:29.395139 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2557793 0,nop,wscale 0> (DF) (ttl 64, id 902, len 60)
  1994	16:49:05.365112 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2567393 0,nop,wscale 0> (DF) (ttl 64, id 903, len 60)
  1995	16:49:05.381622 clusterb.icq.com.http > 172.16.183.2.1059: S [tcp sum ok] 3478682439:3478682439(0) ack 3295016957 win 65535 <nop,nop,timestamp 501007222 2567393,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 41629, len 64)
  1996	16:49:05.382093 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2567394 501007222> (DF) (ttl 64, id 904, len 52)
  1997	16:49:06.375397 172.16.183.2.1059 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2567494 501007222> (DF) (ttl 64, id 905, len 104)
  1998	16:49:06.462216 clusterb.icq.com.http > 172.16.183.2.1059: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501007330 2567494> (DF) (ttl 240, id 41630, len 52)
  1999	16:49:06.784247 clusterb.icq.com.http > 172.16.183.2.1059: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501007362 2567494> (DF) (ttl 240, id 41631, len 391)
  2000	16:49:06.785203 clusterb.icq.com.http > 172.16.183.2.1059: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501007362 2567494> (DF) (ttl 240, id 41632, len 52)
  2001	16:49:06.785686 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2567551 501007362> (DF) (ttl 64, id 906, len 52)
  2002	16:49:06.786067 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2567551 501007362> (DF) (ttl 64, id 907, len 52)
  2003	16:49:31.495041 172.16.183.2.1059 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2570022 501007362> (DF) (ttl 64, id 908, len 52)
  2004	16:49:31.511233 172.16.183.2.1059 > clusterb.icq.com.http: P [bad tcp cksum c4f!] 183665824:183665875(51) ack 4111301867 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2005	16:49:31.511233 clusterb.icq.com.http > 172.16.183.2.1059: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501009835 2570022> (DF) (ttl 240, id 41633, len 52)
  2006	16:49:32.497621 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50757+ A? web.icq.com. [|domain] (ttl 64, id 909, len 57)
  2007	16:49:32.537057 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50757 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 34910, len 244)
  2008	16:49:32.538424 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2570126 0,nop,wscale 0> (DF) (ttl 64, id 910, len 60)
  2009	16:49:35.534883 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2570426 0,nop,wscale 0> (DF) (ttl 64, id 911, len 60)
  2010	16:49:41.545256 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2571026 0,nop,wscale 0> (DF) (ttl 64, id 912, len 60)
  2011	16:49:53.535229 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2572226 0,nop,wscale 0> (DF) (ttl 64, id 913, len 60)
  2012	16:50:17.535035 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2574626 0,nop,wscale 0> (DF) (ttl 64, id 914, len 60)
  2013	16:51:05.545058 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2579426 0,nop,wscale 0> (DF) (ttl 64, id 915, len 60)
  2014	16:51:05.563386 clustera.icq.com.http > 172.16.183.2.1060: S [tcp sum ok] 2630780046:2630780046(0) ack 3545564271 win 65535 <nop,nop,timestamp 200621887 2579426,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 30839, len 64)
  2015	16:51:05.564077 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2579427 200621887> (DF) (ttl 64, id 916, len 52)
  2016	16:51:06.565440 172.16.183.2.1060 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2579527 200621887> (DF) (ttl 64, id 917, len 104)
  2017	16:51:06.604301 clustera.icq.com.http > 172.16.183.2.1060: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200621991 2579527> (DF) (ttl 240, id 30840, len 52)
  2018	16:51:07.013051 clustera.icq.com.http > 172.16.183.2.1060: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 200622032 2579527> (DF) (ttl 240, id 30841, len 391)
  2019	16:51:07.013499 clustera.icq.com.http > 172.16.183.2.1060: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 200622032 2579527> (DF) (ttl 240, id 30842, len 52)
  2020	16:51:07.014000 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2579576 200622032> (DF) (ttl 64, id 918, len 52)
  2021	16:51:07.014390 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2579576 200622032> (DF) (ttl 64, id 919, len 52)
  2022	16:51:32.455540 172.16.183.2.1060 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2582122 200622032> (DF) (ttl 64, id 920, len 52)
  2023	16:51:32.473260 172.16.183.2.1060 > clustera.icq.com.http: P [bad tcp cksum c5d!] 3380183413:3380183464(51) ack 914784278 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2024	16:51:32.473260 clustera.icq.com.http > 172.16.183.2.1060: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 200624578 2582122> (DF) (ttl 240, id 30843, len 52)
  2025	16:51:33.457169 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50758+ A? web.icq.com. [|domain] (ttl 64, id 921, len 57)
  2026	16:51:33.471216 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50758 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 43112, len 233)
  2027	16:51:33.472525 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2582223 0,nop,wscale 0> (DF) (ttl 64, id 922, len 60)
  2028	16:51:36.465289 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2582523 0,nop,wscale 0> (DF) (ttl 64, id 923, len 60)
  2029	16:51:42.465240 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2583123 0,nop,wscale 0> (DF) (ttl 64, id 924, len 60)
  2030	16:51:54.505164 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2584323 0,nop,wscale 0> (DF) (ttl 64, id 925, len 60)
  2031	16:52:18.505193 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2586723 0,nop,wscale 0> (DF) (ttl 64, id 926, len 60)
  2032	16:53:06.495174 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2591523 0,nop,wscale 0> (DF) (ttl 64, id 927, len 60)
  2033	16:54:42.435122 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2601123 0,nop,wscale 0> (DF) (ttl 64, id 928, len 60)
  2034	16:54:42.452647 clusterc.icq.com.http > 172.16.183.2.1061: S [tcp sum ok] 4069272869:4069272869(0) ack 3659230080 win 65535 <nop,nop,timestamp 78290753 2601123,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 14475, len 64)
  2035	16:54:42.453595 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2601124 78290753> (DF) (ttl 64, id 929, len 52)
  2036	16:54:43.445944 172.16.183.2.1061 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2601224 78290753> (DF) (ttl 64, id 930, len 104)
  2037	16:54:43.465971 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 78290855 2601224> (DF) (ttl 240, id 14476, len 52)
  2038	16:54:44.059678 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 78290912 2601224> (DF) (ttl 240, id 14477, len 1500)
  2039	16:54:44.060503 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2601289 78290912> (DF) (ttl 64, id 931, len 52)
  2040	16:54:44.077649 clusterc.icq.com.http > 172.16.183.2.1061: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 78290912 2601224> (DF) (ttl 240, id 14478, len 1500)
  2041	16:54:44.083787 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2601291 78290912> (DF) (ttl 64, id 932, len 52)
  2042	16:54:44.096117 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 78290916 2601289> (DF) (ttl 240, id 14479, len 1477)
  2043	16:54:44.113377 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 78290916 2601289> (DF) (ttl 240, id 14480, len 1500)
  2044	16:54:44.114211 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2601294 78290916> (DF) (ttl 64, id 933, len 52)
  2045	16:54:44.130874 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 78290918 2601291> (DF) (ttl 240, id 14481, len 1500)
  2046	16:54:44.131626 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2601295 78290916> (DF) (ttl 64, id 934, len 52)
  2047	16:54:44.144224 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 78290918 2601291> (DF) (ttl 240, id 14482, len 1252)
  2048	16:54:44.159213 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 78290921 2601294> (DF) (ttl 240, id 14483, len 1500)
  2049	16:54:44.173783 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2601300 78290918> (DF) (ttl 64, id 935, len 52)
  2050	16:54:44.174230 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 78290921 2601294> (DF) (ttl 240, id 14484, len 1500)
  2051	16:54:44.187343 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14485, len 1252)
  2052	16:54:44.193792 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2601302 78290921> (DF) (ttl 64, id 936, len 52)
  2053	16:54:44.202805 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14486, len 1500)
  2054	16:54:44.217597 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14487, len 1500)
  2055	16:54:44.218326 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2601304 78290923> (DF) (ttl 64, id 937, len 52)
  2056	16:54:44.222542 172.16.183.2.1061 > clusterc.icq.com.http: P [bad tcp cksum 69bb!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2057	16:54:44.222542 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2601304 78290923> (DF) (ttl 64, id 938, len 52)
  2058	16:54:44.230218 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14488, len 1252)
  2059	16:54:44.230962 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 939, len 40)
  2060	16:54:44.244198 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14489, len 1500)
  2061	16:54:44.245183 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 940, len 40)
  2062	16:54:44.257979 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14490, len 1500)
  2063	16:54:44.258733 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 941, len 40)
  2064	16:54:44.268872 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14491, len 1252)
  2065	16:54:44.269578 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 942, len 40)
  2066	16:54:44.282872 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14492, len 1500)
  2067	16:54:44.283619 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 943, len 40)
  2068	16:54:44.295929 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14493, len 1500)
  2069	16:54:44.296708 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 944, len 40)
  2070	16:54:44.307064 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14494, len 1252)
  2071	16:54:44.307770 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 945, len 40)
  2072	16:54:44.320577 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14495, len 1500)
  2073	16:54:44.321316 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 946, len 40)
  2074	16:54:44.333626 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14496, len 1500)
  2075	16:54:44.334402 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 947, len 40)
  2076	16:54:46.227633 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50759+ A? web.icq.com. [|domain] (ttl 64, id 948, len 57)
  2077	16:54:46.241250 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50759 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (189) (ttl 61, id 56498, len 217)
  2078	16:54:46.242335 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2601506 0,nop,wscale 0> (DF) (ttl 64, id 949, len 60)
  2079	16:54:49.235347 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2601806 0,nop,wscale 0> (DF) (ttl 64, id 950, len 60)
  2080	16:54:55.234926 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2602406 0,nop,wscale 0> (DF) (ttl 64, id 951, len 60)
  2081	16:55:07.235279 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2603606 0,nop,wscale 0> (DF) (ttl 64, id 952, len 60)
  2082	16:55:31.265174 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2606006 0,nop,wscale 0> (DF) (ttl 64, id 953, len 60)
  2083	16:56:19.325106 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2610806 0,nop,wscale 0> (DF) (ttl 64, id 954, len 60)
  2084	16:57:55.345193 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2620406 0,nop,wscale 0> (DF) (ttl 64, id 955, len 60)
  2085	16:57:55.362863 clustera.icq.com.http > 172.16.183.2.1062: S [tcp sum ok] 3921083661:3921083661(0) ack 3881865773 win 65535 <nop,nop,timestamp 501513917 2620406,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 62307, len 64)
  2086	16:57:55.363535 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2620407 501513917> (DF) (ttl 64, id 956, len 52)
  2087	16:57:56.355511 172.16.183.2.1062 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2620507 501513917> (DF) (ttl 64, id 957, len 104)
  2088	16:57:56.374476 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501514018 2620507> (DF) (ttl 240, id 62308, len 52)
  2089	16:57:57.057611 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501514084 2620507> (DF) (ttl 240, id 62309, len 1500)
  2090	16:57:57.058377 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2620594 501514084> (DF) (ttl 64, id 958, len 52)
  2091	16:57:57.075596 clustera.icq.com.http > 172.16.183.2.1062: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501514084 2620507> (DF) (ttl 240, id 62310, len 1500)
  2092	16:57:57.092051 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2620598 501514084> (DF) (ttl 64, id 959, len 52)
  2093	16:57:57.092820 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501514088 2620594> (DF) (ttl 240, id 62311, len 1477)
  2094	16:57:57.110092 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501514088 2620594> (DF) (ttl 240, id 62312, len 1500)
  2095	16:57:57.122063 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2620601 501514088> (DF) (ttl 64, id 960, len 52)
  2096	16:57:57.127836 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501514091 2620598> (DF) (ttl 240, id 62313, len 1500)
  2097	16:57:57.141175 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501514091 2620598> (DF) (ttl 240, id 62314, len 1252)
  2098	16:57:57.142064 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2620603 501514091> (DF) (ttl 64, id 961, len 52)
  2099	16:57:57.156164 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62315, len 1500)
  2100	16:57:57.171192 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62316, len 1500)
  2101	16:57:57.172020 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2620606 501514094> (DF) (ttl 64, id 962, len 52)
  2102	16:57:57.184288 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62317, len 1252)
  2103	16:57:57.199765 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62318, len 1500)
  2104	16:57:57.200593 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2620609 501514094> (DF) (ttl 64, id 963, len 52)
  2105	16:57:57.214551 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62319, len 1500)
  2106	16:57:57.215517 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2620610 501514096> (DF) (ttl 64, id 964, len 52)
  2107	16:57:57.219965 172.16.183.2.1062 > clustera.icq.com.http: P [bad tcp cksum a2c0!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2108	16:57:57.219965 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2620610 501514096> (DF) (ttl 64, id 965, len 52)
  2109	16:57:57.227150 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62320, len 1252)
  2110	16:57:57.227931 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 966, len 40)
  2111	16:57:57.240899 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62321, len 1500)
  2112	16:57:57.241727 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 967, len 40)
  2113	16:57:57.254227 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62322, len 1500)
  2114	16:57:57.255241 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 968, len 40)
  2115	16:57:57.265576 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62323, len 1252)
  2116	16:57:57.266329 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 969, len 40)
  2117	16:57:57.279324 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501514102 2620609> (DF) (ttl 240, id 62324, len 1500)
  2118	16:57:57.280155 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 970, len 40)
  2119	16:57:57.292632 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501514102 2620609> (DF) (ttl 240, id 62325, len 1500)
  2120	16:57:57.293430 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 971, len 40)
  2121	16:57:57.303782 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62326, len 1252)
  2122	16:57:57.304488 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 972, len 40)
  2123	16:57:57.317271 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62327, len 1500)
  2124	16:57:57.318053 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 973, len 40)
  2125	16:57:57.329830 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62328, len 1500)
  2126	16:57:57.330612 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 974, len 40)
  2127	16:57:59.226837 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50760+ A? web.icq.com. [|domain] (ttl 64, id 975, len 57)
  2128	16:57:59.247325 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50760* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 6120, len 233)
  2129	16:57:59.248251 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2620813 0,nop,wscale 0> (DF) (ttl 64, id 976, len 60)
  2130	16:58:02.255277 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2621113 0,nop,wscale 0> (DF) (ttl 64, id 977, len 60)
  2131	16:58:08.254944 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2621713 0,nop,wscale 0> (DF) (ttl 64, id 978, len 60)
  2132	16:58:20.255283 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2622913 0,nop,wscale 0> (DF) (ttl 64, id 979, len 60)
  2133	16:58:44.265239 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2625313 0,nop,wscale 0> (DF) (ttl 64, id 980, len 60)
  2134	16:59:32.265365 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2630113 0,nop,wscale 0> (DF) (ttl 64, id 981, len 60)
  2135	17:01:08.315091 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2639713 0,nop,wscale 0> (DF) (ttl 64, id 982, len 60)
  2136	17:01:11.693993 clustera.icq.com.http > 172.16.183.2.1063: S [tcp sum ok] 3446771727:3446771727(0) ack 4067163967 win 65535 <nop,nop,timestamp 17543038 2639713,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52676, len 64)
  2137	17:01:11.694340 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2640050 17543038> (DF) (ttl 64, id 983, len 52)
  2138	17:01:12.695367 172.16.183.2.1063 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2640150 17543038> (DF) (ttl 64, id 984, len 104)
  2139	17:01:12.793067 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17543147 2640150> (DF) (ttl 240, id 52677, len 52)
  2140	17:01:13.303744 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17543197 2640150> (DF) (ttl 240, id 52678, len 1500)
  2141	17:01:13.304549 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2640225 17543197> (DF) (ttl 64, id 985, len 52)
  2142	17:01:13.319260 clustera.icq.com.http > 172.16.183.2.1063: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17543197 2640150> (DF) (ttl 240, id 52679, len 1500)
  2143	17:01:13.336559 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2640229 17543197> (DF) (ttl 64, id 986, len 52)
  2144	17:01:13.339192 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17543200 2640225> (DF) (ttl 240, id 52680, len 1477)
  2145	17:01:13.353752 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17543200 2640225> (DF) (ttl 240, id 52681, len 1500)
  2146	17:01:13.369273 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17543203 2640229> (DF) (ttl 240, id 52682, len 1500)
  2147	17:01:13.370032 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2640231 17543200> (DF) (ttl 64, id 987, len 52)
  2148	17:01:13.381906 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17543203 2640229> (DF) (ttl 240, id 52683, len 1252)
  2149	17:01:13.401805 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52684, len 1500)
  2150	17:01:13.410331 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2640236 17543203> (DF) (ttl 64, id 988, len 52)
  2151	17:01:13.415108 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52685, len 1500)
  2152	17:01:13.426725 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52686, len 1252)
  2153	17:01:13.430316 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2640238 17543207> (DF) (ttl 64, id 989, len 52)
  2154	17:01:13.440242 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52687, len 1500)
  2155	17:01:13.453528 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52688, len 1500)
  2156	17:01:13.454226 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2640240 17543207> (DF) (ttl 64, id 990, len 52)
  2157	17:01:13.459099 172.16.183.2.1063 > clustera.icq.com.http: P [bad tcp cksum c6d1!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2158	17:01:13.459099 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2640240 17543207> (DF) (ttl 64, id 991, len 52)
  2159	17:01:13.464400 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52689, len 1252)
  2160	17:01:13.465348 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 992, len 40)
  2161	17:01:13.477907 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52690, len 1500)
  2162	17:01:13.478702 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 993, len 40)
  2163	17:01:13.490471 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52691, len 1500)
  2164	17:01:13.491247 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 994, len 40)
  2165	17:01:13.500616 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52692, len 1252)
  2166	17:01:13.501378 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 995, len 40)
  2167	17:01:13.512892 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52693, len 1500)
  2168	17:01:13.513692 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 996, len 40)
  2169	17:01:13.524970 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52694, len 1500)
  2170	17:01:13.525873 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 997, len 40)
  2171	17:01:13.535113 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52695, len 1252)
  2172	17:01:13.535805 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 998, len 40)
  2173	17:01:13.547134 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52696, len 1500)
  2174	17:01:13.547885 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 999, len 40)
  2175	17:01:15.457103 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50761+ A? web.icq.com. [|domain] (ttl 64, id 1000, len 57)
  2176	17:01:15.488288 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50761 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 20597, len 244)
  2177	17:01:15.489349 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2640443 0,nop,wscale 0> (DF) (ttl 64, id 1001, len 60)
  2178	17:01:18.545262 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2640743 0,nop,wscale 0> (DF) (ttl 64, id 1002, len 60)
  2179	17:01:24.535008 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2641343 0,nop,wscale 0> (DF) (ttl 64, id 1003, len 60)
  2180	17:01:36.547126 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2642543 0,nop,wscale 0> (DF) (ttl 64, id 1004, len 60)
  2181	17:02:00.615192 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2644943 0,nop,wscale 0> (DF) (ttl 64, id 1005, len 60)
  2182	17:02:48.605170 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2649743 0,nop,wscale 0> (DF) (ttl 64, id 1006, len 60)
  2183	17:04:24.505129 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2659343 0,nop,wscale 0> (DF) (ttl 64, id 1007, len 60)
  2184	17:04:24.523164 clustera.icq.com.http > 172.16.183.2.1064: S [tcp sum ok] 62751347:62751347(0) ack 4285902887 win 33304 <nop,nop,timestamp 17362118 2659343,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 16317, len 64)
  2185	17:04:24.523834 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2659344 17362118> (DF) (ttl 64, id 1008, len 52)
  2186	17:04:25.526198 172.16.183.2.1064 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2659444 17362118> (DF) (ttl 64, id 1009, len 104)
  2187	17:04:25.544646 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17362220 2659444> (DF) (ttl 49, id 16318, len 52)
  2188	17:04:26.227514 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16319, len 1500)
  2189	17:04:26.228294 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2659524 17362287> (DF) (ttl 64, id 1010, len 52)
  2190	17:04:26.239587 clustera.icq.com.http > 172.16.183.2.1064: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16320, len 1500)
  2191	17:04:26.248602 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2659526 17362287> (DF) (ttl 64, id 1011, len 52)
  2192	17:04:26.251636 clustera.icq.com.http > 172.16.183.2.1064: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16321, len 1477)
  2193	17:04:26.258605 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2659527 17362287> (DF) (ttl 64, id 1012, len 52)
  2194	17:04:26.263483 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17362290 2659524> (DF) (ttl 49, id 16322, len 1500)
  2195	17:04:26.268601 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2659528 17362290> (DF) (ttl 64, id 1013, len 52)
  2196	17:04:26.275801 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17362290 2659524> (DF) (ttl 49, id 16323, len 1500)
  2197	17:04:26.285707 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17362292 2659526> (DF) (ttl 49, id 16324, len 1252)
  2198	17:04:26.297737 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17362292 2659526> (DF) (ttl 49, id 16325, len 1500)
  2199	17:04:26.298635 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2659531 17362290> (DF) (ttl 64, id 1014, len 52)
  2200	17:04:26.310050 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17362293 2659527> (DF) (ttl 49, id 16326, len 1500)
  2201	17:04:26.310797 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2659532 17362292> (DF) (ttl 64, id 1015, len 52)
  2202	17:04:26.318719 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17362293 2659527> (DF) (ttl 49, id 16327, len 1252)
  2203	17:04:26.329757 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17362294 2659528> (DF) (ttl 49, id 16328, len 1500)
  2204	17:04:26.334984 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2659535 17362293> (DF) (ttl 64, id 1016, len 52)
  2205	17:04:26.340601 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17362294 2659528> (DF) (ttl 49, id 16329, len 1500)
  2206	17:04:26.348348 172.16.183.2.1064 > clustera.icq.com.http: P [bad tcp cksum 23eb!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2207	17:04:26.348348 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2659535 17362294> (DF) (ttl 64, id 1017, len 52)
  2208	17:04:26.350035 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16330, len 1252)
  2209	17:04:26.350806 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1018, len 40)
  2210	17:04:26.361030 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16331, len 1500)
  2211	17:04:26.361812 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1019, len 40)
  2212	17:04:26.372117 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16332, len 1500)
  2213	17:04:26.372858 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1020, len 40)
  2214	17:04:26.381275 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16333, len 1252)
  2215	17:04:26.381977 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1021, len 40)
  2216	17:04:26.392066 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16334, len 1500)
  2217	17:04:26.392808 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1022, len 40)
  2218	17:04:26.402922 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16335, len 1500)
  2219	17:04:26.403653 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1023, len 40)
  2220	17:04:26.411340 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16336, len 1252)
  2221	17:04:26.412036 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1024, len 40)
  2222	17:04:26.421637 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16337, len 1500)
  2223	17:04:26.422337 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1025, len 40)
  2224	17:04:26.431740 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16338, len 1500)
  2225	17:04:26.432482 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1026, len 40)
  2226	17:04:28.367335 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50762+ A? web.icq.com. [|domain] (ttl 64, id 1027, len 57)
  2227	17:04:28.381504 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50762 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 34094, len 233)
  2228	17:04:28.382736 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2659738 0,nop,wscale 0> (DF) (ttl 64, id 1028, len 60)
  2229	17:04:31.385374 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2660038 0,nop,wscale 0> (DF) (ttl 64, id 1029, len 60)
  2230	17:04:37.375165 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2660638 0,nop,wscale 0> (DF) (ttl 64, id 1030, len 60)
  2231	17:04:49.365355 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2661838 0,nop,wscale 0> (DF) (ttl 64, id 1031, len 60)
  2232	17:05:13.395035 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2664238 0,nop,wscale 0> (DF) (ttl 64, id 1032, len 60)
  2233	17:06:01.385212 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2669038 0,nop,wscale 0> (DF) (ttl 64, id 1033, len 60)
  2234	17:07:37.445196 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2678638 0,nop,wscale 0> (DF) (ttl 64, id 1034, len 60)
  2235	17:07:37.462970 clusterc.icq.com.http > 172.16.183.2.1065: S [tcp sum ok] 3555290910:3555290910(0) ack 173215838 win 65535 <nop,nop,timestamp 26197441 2678638,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 27019, len 64)
  2236	17:07:37.463886 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2678639 26197441> (DF) (ttl 64, id 1035, len 52)
  2237	17:07:38.455507 172.16.183.2.1065 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2678739 26197441> (DF) (ttl 64, id 1036, len 104)
  2238	17:07:38.492300 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 26197544 2678739> (DF) (ttl 240, id 27020, len 52)
  2239	17:07:39.268073 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 26197620 2678739> (DF) (ttl 240, id 27021, len 1500)
  2240	17:07:39.268841 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2678834 26197620> (DF) (ttl 64, id 1037, len 52)
  2241	17:07:39.279896 clusterc.icq.com.http > 172.16.183.2.1065: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 26197620 2678739> (DF) (ttl 240, id 27022, len 1500)
  2242	17:07:39.286873 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2678836 26197620> (DF) (ttl 64, id 1038, len 52)
  2243	17:07:39.300340 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 26197623 2678834> (DF) (ttl 240, id 27023, len 1477)
  2244	17:07:39.311189 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 26197623 2678834> (DF) (ttl 240, id 27024, len 1500)
  2245	17:07:39.316884 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2678839 26197623> (DF) (ttl 64, id 1039, len 52)
  2246	17:07:39.322030 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 26197625 2678836> (DF) (ttl 240, id 27025, len 1500)
  2247	17:07:39.331192 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 26197625 2678836> (DF) (ttl 240, id 27026, len 1252)
  2248	17:07:39.334983 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2678841 26197625> (DF) (ttl 64, id 1040, len 52)
  2249	17:07:39.344675 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27027, len 1500)
  2250	17:07:39.355549 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27028, len 1500)
  2251	17:07:39.356325 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2678843 26197628> (DF) (ttl 64, id 1041, len 52)
  2252	17:07:39.364944 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27029, len 1252)
  2253	17:07:39.374973 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2678845 26197628> (DF) (ttl 64, id 1042, len 52)
  2254	17:07:39.375748 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 26197629 2678841> (DF) (ttl 240, id 27030, len 1500)
  2255	17:07:39.386807 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 26197629 2678841> (DF) (ttl 240, id 27031, len 1500)
  2256	17:07:39.387584 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2678846 26197629> (DF) (ttl 64, id 1043, len 52)
  2257	17:07:39.391990 172.16.183.2.1065 > clusterc.icq.com.http: P [bad tcp cksum f6c2!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2258	17:07:39.391990 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2678846 26197629> (DF) (ttl 64, id 1044, len 52)
  2259	17:07:39.395487 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 26197630 2678841> (DF) (ttl 240, id 27032, len 1252)
  2260	17:07:39.396222 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1045, len 40)
  2261	17:07:39.406024 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27033, len 1500)
  2262	17:07:39.406814 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1046, len 40)
  2263	17:07:39.415887 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27034, len 1500)
  2264	17:07:39.416649 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1047, len 40)
  2265	17:07:39.424050 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27035, len 1252)
  2266	17:07:39.424971 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1048, len 40)
  2267	17:07:39.434344 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 26197634 2678845> (DF) (ttl 240, id 27036, len 1500)
  2268	17:07:39.435322 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1049, len 40)
  2269	17:07:39.444446 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 26197634 2678845> (DF) (ttl 240, id 27037, len 1500)
  2270	17:07:39.445403 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1050, len 40)
  2271	17:07:39.452623 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27038, len 1252)
  2272	17:07:39.453343 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1051, len 40)
  2273	17:07:39.462450 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27039, len 1500)
  2274	17:07:39.463166 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1052, len 40)
  2275	17:07:39.472793 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27040, len 1500)
  2276	17:07:39.473574 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1053, len 40)
  2277	17:07:41.396916 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50763+ A? web.icq.com. [|domain] (ttl 64, id 1054, len 57)
  2278	17:07:41.412194 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50763 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (189) (ttl 61, id 49471, len 217)
  2279	17:07:41.413246 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679048 0,nop,wscale 0> (DF) (ttl 64, id 1055, len 60)
  2280	17:07:44.415006 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679348 0,nop,wscale 0> (DF) (ttl 64, id 1056, len 60)
  2281	17:07:50.415399 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679948 0,nop,wscale 0> (DF) (ttl 64, id 1057, len 60)
  2282	17:08:02.416041 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2681148 0,nop,wscale 0> (DF) (ttl 64, id 1058, len 60)
  2283	17:08:26.435202 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2683548 0,nop,wscale 0> (DF) (ttl 64, id 1059, len 60)
  2284	17:09:14.425074 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2688348 0,nop,wscale 0> (DF) (ttl 64, id 1060, len 60)
  2285	17:10:50.405215 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2697948 0,nop,wscale 0> (DF) (ttl 64, id 1061, len 60)
  2286	17:10:50.422706 clustera.icq.com.http > 172.16.183.2.1066: S [tcp sum ok] 2691367641:2691367641(0) ack 384122369 win 65535 <nop,nop,timestamp 501008152 2697948,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 50929, len 64)
  2287	17:10:50.423596 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2697949 501008152> (DF) (ttl 64, id 1062, len 52)
  2288	17:10:51.415805 172.16.183.2.1066 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2698049 501008152> (DF) (ttl 64, id 1063, len 104)
  2289	17:10:51.435797 clustera.icq.com.http > 172.16.183.2.1066: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501008254 2698049> (DF) (ttl 240, id 50930, len 52)
  2290	17:10:51.699439 clustera.icq.com.http > 172.16.183.2.1066: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501008280 2698049> (DF) (ttl 240, id 50931, len 391)
  2291	17:10:51.700086 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2698077 501008280> (DF) (ttl 64, id 1064, len 52)
  2292	17:10:51.700626 clustera.icq.com.http > 172.16.183.2.1066: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501008280 2698049> (DF) (ttl 240, id 50932, len 52)
  2293	17:10:51.701046 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2698077 501008280> (DF) (ttl 64, id 1065, len 52)
  2294	17:11:17.284945 172.16.183.2.1066 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2700622 501008280> (DF) (ttl 64, id 1066, len 52)
  2295	17:11:17.302030 172.16.183.2.1066 > clustera.icq.com.http: P [bad tcp cksum 15d!] 2307245614:2307245665(51) ack 1987722077 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2296	17:11:17.302030 clustera.icq.com.http > 172.16.183.2.1066: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501010840 2700622> (DF) (ttl 240, id 50933, len 52)
  2297	17:11:18.337243 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50764+ A? web.icq.com. [|domain] (ttl 64, id 1067, len 57)
  2298	17:11:18.368748 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50764 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 63844, len 244)
  2299	17:11:18.369837 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2700726 0,nop,wscale 0> (DF) (ttl 64, id 1068, len 60)
  2300	17:11:21.365349 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2701026 0,nop,wscale 0> (DF) (ttl 64, id 1069, len 60)
  2301	17:11:27.375181 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2701626 0,nop,wscale 0> (DF) (ttl 64, id 1070, len 60)
  2302	17:11:39.375305 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2702826 0,nop,wscale 0> (DF) (ttl 64, id 1071, len 60)
  2303	17:12:03.415209 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2705226 0,nop,wscale 0> (DF) (ttl 64, id 1072, len 60)
  2304	17:12:51.405204 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2710026 0,nop,wscale 0> (DF) (ttl 64, id 1073, len 60)
  2305	17:14:27.355371 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2719626 0,nop,wscale 0> (DF) (ttl 64, id 1074, len 60)
  2306	17:14:27.373814 clusterc.icq.com.http > 172.16.183.2.1067: S [tcp sum ok] 769227074:769227074(0) ack 607573271 win 33304 <nop,nop,timestamp 215125235 2719626,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 33151, len 64)
  2307	17:14:27.374994 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2719627 215125235> (DF) (ttl 64, id 1075, len 52)
  2308	17:14:28.375728 172.16.183.2.1067 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2719727 215125235> (DF) (ttl 64, id 1076, len 104)
  2309	17:14:28.396764 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215125338 2719727> (DF) (ttl 49, id 33152, len 52)
  2310	17:14:28.965332 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33153, len 1500)
  2311	17:14:28.966105 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2719816 215125393> (DF) (ttl 64, id 1077, len 52)
  2312	17:14:28.983057 clusterc.icq.com.http > 172.16.183.2.1067: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33154, len 1500)
  2313	17:14:28.994954 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2719820 215125393> (DF) (ttl 64, id 1078, len 52)
  2314	17:14:28.997826 clusterc.icq.com.http > 172.16.183.2.1067: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33155, len 1477)
  2315	17:14:29.012870 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215125396 2719816> (DF) (ttl 49, id 33156, len 1500)
  2316	17:14:29.023227 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2719823 215125393> (DF) (ttl 64, id 1079, len 52)
  2317	17:14:29.028143 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215125396 2719816> (DF) (ttl 49, id 33157, len 1500)
  2318	17:14:29.040516 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215125399 2719820> (DF) (ttl 49, id 33158, len 1252)
  2319	17:14:29.043223 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2719825 215125396> (DF) (ttl 64, id 1080, len 52)
  2320	17:14:29.055740 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215125399 2719820> (DF) (ttl 49, id 33159, len 1500)
  2321	17:14:29.071021 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33160, len 1500)
  2322	17:14:29.071732 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2719827 215125399> (DF) (ttl 64, id 1081, len 52)
  2323	17:14:29.082649 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33161, len 1252)
  2324	17:14:29.094958 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2719830 215125402> (DF) (ttl 64, id 1082, len 52)
  2325	17:14:29.096155 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33162, len 1500)
  2326	17:14:29.109458 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33163, len 1500)
  2327	17:14:29.110244 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2719832 215125402> (DF) (ttl 64, id 1083, len 52)
  2328	17:14:29.112614 172.16.183.2.1067 > clusterc.icq.com.http: P [bad tcp cksum 4c7f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2329	17:14:29.112614 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2719832 215125402> (DF) (ttl 64, id 1084, len 52)
  2330	17:14:29.120813 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33164, len 1252)
  2331	17:14:29.121610 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1085, len 40)
  2332	17:14:29.134309 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33165, len 1500)
  2333	17:14:29.135348 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1086, len 40)
  2334	17:14:29.147615 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33166, len 1500)
  2335	17:14:29.148426 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1087, len 40)
  2336	17:14:29.158517 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33167, len 1252)
  2337	17:14:29.159295 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1088, len 40)
  2338	17:14:29.172006 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33168, len 1500)
  2339	17:14:29.172790 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1089, len 40)
  2340	17:14:29.184829 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215125409 2719830> (DF) (ttl 49, id 33169, len 1500)
  2341	17:14:29.185660 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1090, len 40)
  2342	17:14:29.194234 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215125409 2719830> (DF) (ttl 49, id 33170, len 1252)
  2343	17:14:29.195243 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1091, len 40)
  2344	17:14:29.206506 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33171, len 1500)
  2345	17:14:29.207292 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1092, len 40)
  2346	17:14:29.218584 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33172, len 1500)
  2347	17:14:29.219425 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1093, len 40)
  2348	17:14:29.228485 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33173, len 1252)
  2349	17:14:29.229278 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1094, len 40)
  2350	17:14:31.137570 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50765+ A? web.icq.com. [|domain] (ttl 64, id 1095, len 57)
  2351	17:14:31.150112 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50765 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 10467, len 233)
  2352	17:14:31.151470 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720034 0,nop,wscale 0> (DF) (ttl 64, id 1096, len 60)
  2353	17:14:34.154948 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720335 0,nop,wscale 0> (DF) (ttl 64, id 1097, len 60)
  2354	17:14:40.155293 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720935 0,nop,wscale 0> (DF) (ttl 64, id 1098, len 60)
  2355	17:14:52.145357 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2722135 0,nop,wscale 0> (DF) (ttl 64, id 1099, len 60)
  2356	17:15:16.175180 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2724535 0,nop,wscale 0> (DF) (ttl 64, id 1100, len 60)
  2357	17:16:04.225104 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2729335 0,nop,wscale 0> (DF) (ttl 64, id 1101, len 60)
  2358	17:17:40.295244 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2738935 0,nop,wscale 0> (DF) (ttl 64, id 1102, len 60)
  2359	17:17:40.312619 clusterb.icq.com.http > 172.16.183.2.1068: S [tcp sum ok] 1861741510:1861741510(0) ack 830779110 win 65535 <nop,nop,timestamp 501178718 2738935,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52653, len 64)
  2360	17:17:40.313548 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2738936 501178718> (DF) (ttl 64, id 1103, len 52)
  2361	17:17:41.295391 172.16.183.2.1068 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2739036 501178718> (DF) (ttl 64, id 1104, len 104)
  2362	17:17:41.315859 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501178818 2739036> (DF) (ttl 240, id 52654, len 52)
  2363	17:17:41.806811 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501178865 2739036> (DF) (ttl 240, id 52655, len 1500)
  2364	17:17:41.807637 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2739108 501178865> (DF) (ttl 64, id 1105, len 52)
  2365	17:17:41.827007 clusterb.icq.com.http > 172.16.183.2.1068: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501178865 2739036> (DF) (ttl 240, id 52656, len 1500)
  2366	17:17:41.831502 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2739110 501178865> (DF) (ttl 64, id 1106, len 52)
  2367	17:17:41.844488 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501178869 2739108> (DF) (ttl 240, id 52657, len 1477)
  2368	17:17:41.861495 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2739113 501178869> (DF) (ttl 64, id 1107, len 52)
  2369	17:17:41.861712 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501178869 2739108> (DF) (ttl 240, id 52658, len 1500)
  2370	17:17:41.879003 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501178871 2739110> (DF) (ttl 240, id 52659, len 1500)
  2371	17:17:41.879759 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2739114 501178869> (DF) (ttl 64, id 1108, len 52)
  2372	17:17:41.893575 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501178871 2739110> (DF) (ttl 240, id 52660, len 1252)
  2373	17:17:41.911270 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501178874 2739113> (DF) (ttl 240, id 52661, len 1500)
  2374	17:17:41.921504 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2739119 501178871> (DF) (ttl 64, id 1109, len 52)
  2375	17:17:41.927274 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501178874 2739113> (DF) (ttl 240, id 52662, len 1500)
  2376	17:17:41.940136 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52663, len 1252)
  2377	17:17:41.951496 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2739122 501178874> (DF) (ttl 64, id 1110, len 52)
  2378	17:17:41.955152 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52664, len 1500)
  2379	17:17:41.970151 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52665, len 1500)
  2380	17:17:41.970849 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2739123 501178876> (DF) (ttl 64, id 1111, len 52)
  2381	17:17:41.975798 172.16.183.2.1068 > clusterb.icq.com.http: P [bad tcp cksum aae4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2382	17:17:41.975798 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2739124 501178876> (DF) (ttl 64, id 1112, len 52)
  2383	17:17:41.982748 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52666, len 1252)
  2384	17:17:41.983502 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1113, len 40)
  2385	17:17:41.997980 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52667, len 1500)
  2386	17:17:41.998797 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1114, len 40)
  2387	17:17:42.013006 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52668, len 1500)
  2388	17:17:42.013809 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1115, len 40)
  2389	17:17:42.023901 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52669, len 1252)
  2390	17:17:42.024784 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1116, len 40)
  2391	17:17:42.037890 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52670, len 1500)
  2392	17:17:42.038662 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1117, len 40)
  2393	17:17:42.051200 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52671, len 1500)
  2394	17:17:42.051945 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1118, len 40)
  2395	17:17:42.062595 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52672, len 1252)
  2396	17:17:42.063269 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1119, len 40)
  2397	17:17:42.075846 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52673, len 1500)
  2398	17:17:42.076567 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1120, len 40)
  2399	17:17:42.089380 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52674, len 1500)
  2400	17:17:42.090106 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1121, len 40)
  2401	17:17:43.987075 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50766+ A? web.icq.com. [|domain] (ttl 64, id 1122, len 57)
  2402	17:17:44.000460 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50766 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 22831, len 217)
  2403	17:17:44.001551 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2739326 0,nop,wscale 0> (DF) (ttl 64, id 1123, len 60)
  2404	17:17:47.005288 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2739626 0,nop,wscale 0> (DF) (ttl 64, id 1124, len 60)
  2405	17:17:52.995286 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2740226 0,nop,wscale 0> (DF) (ttl 64, id 1125, len 60)
  2406	17:18:04.995220 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2741426 0,nop,wscale 0> (DF) (ttl 64, id 1126, len 60)
  2407	17:18:29.015301 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2743826 0,nop,wscale 0> (DF) (ttl 64, id 1127, len 60)
  2408	17:19:17.005285 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2748626 0,nop,wscale 0> (DF) (ttl 64, id 1128, len 60)
  2409	17:20:53.035219 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2758226 0,nop,wscale 0> (DF) (ttl 64, id 1129, len 60)
  2410	17:20:53.052343 clusterc.icq.com.http > 172.16.183.2.1069: S [tcp sum ok] 767520358:767520358(0) ack 1017454137 win 65535 <nop,nop,timestamp 201053288 2758226,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 19473, len 64)
  2411	17:20:53.052724 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2758227 201053288> (DF) (ttl 64, id 1130, len 52)
  2412	17:20:54.045442 172.16.183.2.1069 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2758327 201053288> (DF) (ttl 64, id 1131, len 104)
  2413	17:20:54.167925 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 201053399 2758327> (DF) (ttl 240, id 19474, len 52)
  2414	17:20:54.944441 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 201053476 2758327> (DF) (ttl 240, id 19475, len 1500)
  2415	17:20:54.945532 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2758427 201053476> (DF) (ttl 64, id 1132, len 52)
  2416	17:20:54.956502 clusterc.icq.com.http > 172.16.183.2.1069: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 201053476 2758327> (DF) (ttl 240, id 19476, len 1500)
  2417	17:20:54.974484 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 201053479 2758427> (DF) (ttl 240, id 19477, len 1477)
  2418	17:20:54.979771 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2758431 201053476> (DF) (ttl 64, id 1133, len 52)
  2419	17:20:54.986562 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 201053479 2758427> (DF) (ttl 240, id 19478, len 1500)
  2420	17:20:55.008733 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19479, len 1500)
  2421	17:20:55.009473 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2758433 201053479> (DF) (ttl 64, id 1134, len 52)
  2422	17:20:55.018402 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19480, len 1252)
  2423	17:20:55.030425 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19481, len 1500)
  2424	17:20:55.039779 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2758436 201053482> (DF) (ttl 64, id 1135, len 52)
  2425	17:20:55.041318 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19482, len 1500)
  2426	17:20:55.050183 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19483, len 1252)
  2427	17:20:55.050987 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2758438 201053485> (DF) (ttl 64, id 1136, len 52)
  2428	17:20:55.061477 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19484, len 1500)
  2429	17:20:55.073043 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19485, len 1500)
  2430	17:20:55.073770 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2758440 201053485> (DF) (ttl 64, id 1137, len 52)
  2431	17:20:55.077128 172.16.183.2.1069 > clusterc.icq.com.http: P [bad tcp cksum ae28!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2432	17:20:55.077128 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2758440 201053485> (DF) (ttl 64, id 1138, len 52)
  2433	17:20:55.081696 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19486, len 1252)
  2434	17:20:55.082471 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1139, len 40)
  2435	17:20:55.093467 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19487, len 1500)
  2436	17:20:55.094195 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1140, len 40)
  2437	17:20:55.104310 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 201053489 2758438> (DF) (ttl 240, id 19488, len 1500)
  2438	17:20:55.105370 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1141, len 40)
  2439	17:20:55.113227 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 201053489 2758438> (DF) (ttl 240, id 19489, len 1252)
  2440	17:20:55.113893 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1142, len 40)
  2441	17:20:55.123782 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19490, len 1500)
  2442	17:20:55.124568 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1143, len 40)
  2443	17:20:55.133876 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19491, len 1500)
  2444	17:20:55.134832 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1144, len 40)
  2445	17:20:55.142048 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19492, len 1252)
  2446	17:20:55.142705 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1145, len 40)
  2447	17:20:55.152357 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19493, len 1500)
  2448	17:20:55.153074 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1146, len 40)
  2449	17:20:57.097232 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50767+ A? web.icq.com. [|domain] (ttl 64, id 1147, len 57)
  2450	17:20:57.117162 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50767* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36092, len 233)
  2451	17:20:57.118595 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2758643 0,nop,wscale 0> (DF) (ttl 64, id 1148, len 60)
  2452	17:21:00.125148 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2758944 0,nop,wscale 0> (DF) (ttl 64, id 1149, len 60)
  2453	17:21:06.125416 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2759544 0,nop,wscale 0> (DF) (ttl 64, id 1150, len 60)
  2454	17:21:18.185092 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2760744 0,nop,wscale 0> (DF) (ttl 64, id 1151, len 60)
  2455	17:21:42.195272 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2763144 0,nop,wscale 0> (DF) (ttl 64, id 1152, len 60)
  2456	17:22:30.245216 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2767944 0,nop,wscale 0> (DF) (ttl 64, id 1153, len 60)
  2457	17:24:06.155091 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2777544 0,nop,wscale 0> (DF) (ttl 64, id 1154, len 60)
  2458	17:24:06.172495 clustera.icq.com.http > 172.16.183.2.1070: S [tcp sum ok] 3136039760:3136039760(0) ack 1237496391 win 24616 <nop,nop,timestamp 252887867 2777544,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 41039, len 64)
  2459	17:24:06.173408 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2777545 252887867> (DF) (ttl 64, id 1155, len 52)
  2460	17:24:07.165618 172.16.183.2.1070 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2777645 252887867> (DF) (ttl 64, id 1156, len 104)
  2461	17:24:07.185810 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252887968 2777645> (DF) (ttl 49, id 41040, len 52)
  2462	17:24:07.667913 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41041, len 1500)
  2463	17:24:07.668739 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2777706 252888015> (DF) (ttl 64, id 1157, len 52)
  2464	17:24:07.685646 clustera.icq.com.http > 172.16.183.2.1070: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41042, len 1500)
  2465	17:24:07.700419 clustera.icq.com.http > 172.16.183.2.1070: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41043, len 1477)
  2466	17:24:07.708064 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2777710 252888015> (DF) (ttl 64, id 1158, len 52)
  2467	17:24:07.715458 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252888018 2777706> (DF) (ttl 49, id 41044, len 1500)
  2468	17:24:07.730490 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252888018 2777706> (DF) (ttl 49, id 41045, len 1500)
  2469	17:24:07.731664 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2777712 252888018> (DF) (ttl 64, id 1159, len 52)
  2470	17:24:07.743089 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41046, len 1252)
  2471	17:24:07.754910 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2777715 252888022> (DF) (ttl 64, id 1160, len 52)
  2472	17:24:07.758075 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41047, len 1500)
  2473	17:24:07.773355 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41048, len 1500)
  2474	17:24:07.774117 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2777716 252888022> (DF) (ttl 64, id 1161, len 52)
  2475	17:24:07.784989 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41049, len 1252)
  2476	17:24:07.798489 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41050, len 1500)
  2477	17:24:07.812285 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41051, len 1500)
  2478	17:24:07.812980 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2777720 252888025> (DF) (ttl 64, id 1162, len 52)
  2479	17:24:07.817712 172.16.183.2.1070 > clustera.icq.com.http: P [bad tcp cksum a93d!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2480	17:24:07.817712 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2777720 252888025> (DF) (ttl 64, id 1163, len 52)
  2481	17:24:07.823171 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252888027 2777715> (DF) (ttl 49, id 41052, len 1252)
  2482	17:24:07.823905 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1164, len 40)
  2483	17:24:07.836656 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252888027 2777715> (DF) (ttl 49, id 41053, len 1500)
  2484	17:24:07.837401 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1165, len 40)
  2485	17:24:07.849957 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41054, len 1500)
  2486	17:24:07.850665 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1166, len 40)
  2487	17:24:07.860847 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41055, len 1252)
  2488	17:24:07.861544 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1167, len 40)
  2489	17:24:07.874102 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41056, len 1500)
  2490	17:24:07.875131 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1168, len 40)
  2491	17:24:07.886678 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41057, len 1500)
  2492	17:24:07.887481 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1169, len 40)
  2493	17:24:07.896332 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41058, len 1252)
  2494	17:24:07.897083 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1170, len 40)
  2495	17:24:07.908601 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41059, len 1500)
  2496	17:24:07.909326 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1171, len 40)
  2497	17:24:07.920661 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41060, len 1500)
  2498	17:24:07.921381 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1172, len 40)
  2499	17:24:09.817316 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50768+ A? web.icq.com. [|domain] (ttl 64, id 1173, len 57)
  2500	17:24:09.848274 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50768 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 47523, len 244)
  2501	17:24:09.849319 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2777923 0,nop,wscale 0> (DF) (ttl 64, id 1174, len 60)
  2502	17:24:12.855262 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2778223 0,nop,wscale 0> (DF) (ttl 64, id 1175, len 60)
  2503	17:24:18.845352 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2778823 0,nop,wscale 0> (DF) (ttl 64, id 1176, len 60)
  2504	17:24:30.855089 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2780023 0,nop,wscale 0> (DF) (ttl 64, id 1177, len 60)
  2505	17:24:54.855238 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2782423 0,nop,wscale 0> (DF) (ttl 64, id 1178, len 60)
  2506	17:25:42.835169 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2787223 0,nop,wscale 0> (DF) (ttl 64, id 1179, len 60)
  2507	17:26:50.245950 dom11-246.menta.net.4114 > 172.16.183.2.ftp: S [tcp sum ok] 1242601389:1242601389(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19349, len 52)
  2508	17:26:50.251280 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1180, len 48)
  2509	17:26:51.679854 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19402, len 52)
  2510	17:26:51.684207 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1243238826 win 0 (DF) (ttl 255, id 0, len 40)
  2511	17:26:52.523413 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19451, len 52)
  2512	17:26:52.526631 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
  2513	17:26:53.227056 dom11-246.menta.net.4134 > 172.16.183.2.ftp: S [tcp sum ok] 1244301180:1244301180(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19474, len 52)
  2514	17:26:53.230260 172.16.183.2.ftp > dom11-246.menta.net.4134: S [tcp sum ok] 1612149285:1612149285(0) ack 1244301181 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1181, len 48)
  2515	17:26:53.320432 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19475, len 52)
  2516	17:26:53.323723 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
  2517	17:26:53.534983 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1182, len 48)
  2518	17:26:53.622205 dom11-246.menta.net.4134 > 172.16.183.2.ftp: . [tcp sum ok] ack 1 win 64240 (DF) (ttl 47, id 19479, len 40)
  2519	17:26:53.657044 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52442+ PTR? 246.114.57.62.in-addr.arpa. [|domain] (ttl 64, id 1183, len 72)
  2520	17:26:53.669874 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52442 1/2/2 246.114.57.62.in-addr.arpa. PTR dom11-246.menta.net. (161) (ttl 61, id 57851, len 189)
  2521	17:26:53.670989 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52443+ A? dom11-246.menta.net. [|domain] (ttl 64, id 1184, len 65)
  2522	17:26:54.098063 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52443* 1/2/2 dom11-246.menta.net. A dom11-246.menta.net (146) (ttl 61, id 57895, len 174)
  2523	17:26:54.103828 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52444+ PTR? 246.114.57.62.in-addr.arpa. [|domain] (ttl 64, id 1185, len 72)
  2524	17:26:54.116049 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52444 1/2/2 246.114.57.62.in-addr.arpa. PTR dom11-246.menta.net. (161) (ttl 61, id 57896, len 189)
  2525	17:26:54.117897 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52445+ PTR? 2.183.16.172.in-addr.arpa. [|domain] (ttl 64, id 1186, len 71)
  2526	17:26:54.148067 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52445 NXDomain* 0/1/0 (120) (ttl 61, id 57901, len 148)
  2527	17:26:54.149705 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1187, len 120)
  2528	17:26:57.154958 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1188, len 120)
  2529	17:26:59.995028 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1189, len 48)
  2530	17:27:03.125066 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1190, len 120)
  2531	17:27:12.465078 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1191, len 48)
  2532	17:27:15.124890 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1192, len 120)
  2533	17:27:18.845061 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2796823 0,nop,wscale 0> (DF) (ttl 64, id 1193, len 60)
  2534	17:27:18.862206 clustera.icq.com.http > 172.16.183.2.1071: S [tcp sum ok] 2572299246:2572299246(0) ack 1433092378 win 65535 <nop,nop,timestamp 17699757 2796823,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 50371, len 64)
  2535	17:27:18.862870 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2796824 17699757> (DF) (ttl 64, id 1194, len 52)
  2536	17:27:19.855625 172.16.183.2.1071 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2796924 17699757> (DF) (ttl 64, id 1195, len 104)
  2537	17:27:19.894743 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17699861 2796924> (DF) (ttl 240, id 50372, len 52)
  2538	17:27:20.415780 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17699911 2796924> (DF) (ttl 240, id 50373, len 1500)
  2539	17:27:20.416586 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2796987 17699911> (DF) (ttl 64, id 1196, len 52)
  2540	17:27:20.431293 clustera.icq.com.http > 172.16.183.2.1071: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17699911 2796924> (DF) (ttl 240, id 50374, len 1500)
  2541	17:27:20.436349 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2796989 17699911> (DF) (ttl 64, id 1197, len 52)
  2542	17:27:20.450266 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17699915 2796987> (DF) (ttl 240, id 50375, len 1477)
  2543	17:27:20.465290 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17699915 2796987> (DF) (ttl 240, id 50376, len 1500)
  2544	17:27:20.466063 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2796992 17699915> (DF) (ttl 64, id 1198, len 52)
  2545	17:27:20.480813 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17699916 2796989> (DF) (ttl 240, id 50377, len 1500)
  2546	17:27:20.481558 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2796993 17699915> (DF) (ttl 64, id 1199, len 52)
  2547	17:27:20.492684 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17699917 2796989> (DF) (ttl 240, id 50378, len 1252)
  2548	17:27:20.507181 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17699919 2796992> (DF) (ttl 240, id 50379, len 1500)
  2549	17:27:20.520480 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17699919 2796992> (DF) (ttl 240, id 50380, len 1500)
  2550	17:27:20.521235 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2796997 17699917> (DF) (ttl 64, id 1200, len 52)
  2551	17:27:20.531866 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50381, len 1252)
  2552	17:27:20.545143 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50382, len 1500)
  2553	17:27:20.558425 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50383, len 1500)
  2554	17:27:20.559149 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2797001 17699921> (DF) (ttl 64, id 1201, len 52)
  2555	17:27:20.563613 172.16.183.2.1071 > clustera.icq.com.http: P [bad tcp cksum 27c4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2556	17:27:20.563613 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2797001 17699921> (DF) (ttl 64, id 1202, len 52)
  2557	17:27:20.569550 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50384, len 1252)
  2558	17:27:20.570301 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1203, len 40)
  2559	17:27:20.583293 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50385, len 1500)
  2560	17:27:20.584070 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1204, len 40)
  2561	17:27:20.596107 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50386, len 1500)
  2562	17:27:20.596853 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1205, len 40)
  2563	17:27:20.606006 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50387, len 1252)
  2564	17:27:20.606743 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1206, len 40)
  2565	17:27:20.618034 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50388, len 1500)
  2566	17:27:20.618763 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1207, len 40)
  2567	17:27:20.630595 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50389, len 1500)
  2568	17:27:20.631341 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1208, len 40)
  2569	17:27:20.640492 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50390, len 1252)
  2570	17:27:20.641214 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1209, len 40)
  2571	17:27:20.652759 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50391, len 1500)
  2572	17:27:20.653503 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1210, len 40)
  2573	17:27:22.567159 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50769+ A? web.icq.com. [|domain] (ttl 64, id 1211, len 57)
  2574	17:27:22.579376 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50769 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 59569, len 233)
  2575	17:27:22.580555 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2797203 0,nop,wscale 0> (DF) (ttl 64, id 1212, len 60)
  2576	17:27:25.584887 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2797503 0,nop,wscale 0> (DF) (ttl 64, id 1213, len 60)
  2577	17:27:31.595054 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2798103 0,nop,wscale 0> (DF) (ttl 64, id 1214, len 60)
  2578	17:27:36.914961 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1215, len 48)
  2579	17:27:39.075098 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1216, len 120)
  2580	17:27:43.585238 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2799303 0,nop,wscale 0> (DF) (ttl 64, id 1217, len 60)
  2581	17:28:07.605057 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2801703 0,nop,wscale 0> (DF) (ttl 64, id 1218, len 60)
  2582	17:28:25.425120 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1219, len 48)
  2583	17:28:27.084811 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1220, len 120)
  2584	17:28:55.595210 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2806503 0,nop,wscale 0> (DF) (ttl 64, id 1221, len 60)
  2585	17:28:55.613584 clusterc.icq.com.http > 172.16.183.2.1072: S [tcp sum ok] 2772861095:2772861095(0) ack 1636950757 win 33304 <nop,nop,timestamp 215212080 2806503,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 49633, len 64)
  2586	17:28:55.614541 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2806504 215212080> (DF) (ttl 64, id 1222, len 52)
  2587	17:28:56.605829 172.16.183.2.1072 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2806604 215212080> (DF) (ttl 64, id 1223, len 104)
  2588	17:28:56.625421 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215212181 2806604> (DF) (ttl 49, id 49634, len 52)
  2589	17:28:57.360800 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49635, len 1500)
  2590	17:28:57.361572 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2806684 215212253> (DF) (ttl 64, id 1224, len 52)
  2591	17:28:57.377806 clusterc.icq.com.http > 172.16.183.2.1072: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49636, len 1500)
  2592	17:28:57.394988 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2806688 215212253> (DF) (ttl 64, id 1225, len 52)
  2593	17:28:57.395234 clusterc.icq.com.http > 172.16.183.2.1072: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49637, len 1477)
  2594	17:28:57.412297 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215212256 2806684> (DF) (ttl 49, id 49638, len 1500)
  2595	17:28:57.424855 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2806691 215212253> (DF) (ttl 64, id 1226, len 52)
  2596	17:28:57.430025 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215212256 2806684> (DF) (ttl 49, id 49639, len 1500)
  2597	17:28:57.443629 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215212260 2806688> (DF) (ttl 49, id 49640, len 1252)
  2598	17:28:57.445475 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2806693 215212256> (DF) (ttl 64, id 1227, len 52)
  2599	17:28:57.459112 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215212260 2806688> (DF) (ttl 49, id 49641, len 1500)
  2600	17:28:57.473900 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49642, len 1500)
  2601	17:28:57.475025 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2806696 215212260> (DF) (ttl 64, id 1228, len 52)
  2602	17:28:57.486497 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49643, len 1252)
  2603	17:28:57.501727 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49644, len 1500)
  2604	17:28:57.505474 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2806699 215212263> (DF) (ttl 64, id 1229, len 52)
  2605	17:28:57.516996 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49645, len 1500)
  2606	17:28:57.519976 172.16.183.2.1072 > clusterc.icq.com.http: P [bad tcp cksum 46b5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2607	17:28:57.519976 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2806700 215212265> (DF) (ttl 64, id 1230, len 52)
  2608	17:28:57.530087 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49646, len 1252)
  2609	17:28:57.530838 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1231, len 40)
  2610	17:28:57.543832 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49647, len 1500)
  2611	17:28:57.544570 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1232, len 40)
  2612	17:28:57.557145 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49648, len 1500)
  2613	17:28:57.557900 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1233, len 40)
  2614	17:28:57.567777 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49649, len 1252)
  2615	17:28:57.568507 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1234, len 40)
  2616	17:28:57.581530 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49650, len 1500)
  2617	17:28:57.582259 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1235, len 40)
  2618	17:28:57.594859 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49651, len 1500)
  2619	17:28:57.595699 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1236, len 40)
  2620	17:28:57.605723 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49652, len 1252)
  2621	17:28:57.606451 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1237, len 40)
  2622	17:28:57.619237 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49653, len 1500)
  2623	17:28:57.619953 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1238, len 40)
  2624	17:28:59.536790 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50770+ A? web.icq.com. [|domain] (ttl 64, id 1239, len 57)
  2625	17:28:59.549517 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50770 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 65379, len 217)
  2626	17:28:59.550442 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2806902 0,nop,wscale 0> (DF) (ttl 64, id 1240, len 60)
  2627	17:29:02.555426 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2807202 0,nop,wscale 0> (DF) (ttl 64, id 1241, len 60)
  2628	17:29:08.545325 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2807802 0,nop,wscale 0> (DF) (ttl 64, id 1242, len 60)
  2629	17:29:20.545238 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2809002 0,nop,wscale 0> (DF) (ttl 64, id 1243, len 60)
  2630	17:29:44.545243 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2811402 0,nop,wscale 0> (DF) (ttl 64, id 1244, len 60)
  2631	17:30:01.875082 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1245, len 48)
  2632	17:30:03.035010 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1246, len 120)
  2633	17:30:32.545132 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2816202 0,nop,wscale 0> (DF) (ttl 64, id 1247, len 60)
  2634	17:32:02.475240 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1248, len 48)
  2635	17:32:03.134914 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1249, len 120)
  2636	17:32:08.644898 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2825802 0,nop,wscale 0> (DF) (ttl 64, id 1250, len 60)
  2637	17:34:03.095175 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1251, len 120)
  2638	17:34:08.605097 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2837802 0,nop,wscale 0> (DF) (ttl 64, id 1252, len 60)
  2639	17:36:03.115069 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1253, len 120)
  2640	17:36:08.624774 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2849802 0,nop,wscale 0> (DF) (ttl 64, id 1254, len 60)
  2641	17:36:08.641412 clusterc.icq.com.http > 172.16.183.2.1073: S [tcp sum ok] 4244920612:4244920612(0) ack 1732361295 win 65535 <nop,nop,timestamp 501116800 2849802,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 23297, len 64)
  2642	17:36:08.642023 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2849803 501116800> (DF) (ttl 64, id 1255, len 52)
  2643	17:36:09.635363 172.16.183.2.1073 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2849903 501116800> (DF) (ttl 64, id 1256, len 104)
  2644	17:36:09.750861 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] ack 53 win 33278 <nop,nop,timestamp 501116911 2849903> (DF) (ttl 240, id 23298, len 52)
  2645	17:36:16.354334 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23299, len 1500)
  2646	17:36:16.355326 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2850598 501117570> (DF) (ttl 64, id 1257, len 52)
  2647	17:36:16.366653 clusterc.icq.com.http > 172.16.183.2.1073: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23300, len 1500)
  2648	17:36:16.378453 clusterc.icq.com.http > 172.16.183.2.1073: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23301, len 1477)
  2649	17:36:16.381560 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2850601 501117570> (DF) (ttl 64, id 1258, len 52)
  2650	17:36:16.390776 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501117573 2850598> (DF) (ttl 240, id 23302, len 1500)
  2651	17:36:16.402610 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501117573 2850598> (DF) (ttl 240, id 23303, len 1500)
  2652	17:36:16.403336 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2850603 501117573> (DF) (ttl 64, id 1259, len 52)
  2653	17:36:16.412519 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23304, len 1252)
  2654	17:36:16.424549 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23305, len 1500)
  2655	17:36:16.431558 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2850606 501117576> (DF) (ttl 64, id 1260, len 52)
  2656	17:36:16.436607 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23306, len 1500)
  2657	17:36:16.445532 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23307, len 1252)
  2658	17:36:16.451577 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2850608 501117576> (DF) (ttl 64, id 1261, len 52)
  2659	17:36:16.456573 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23308, len 1500)
  2660	17:36:16.468148 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23309, len 1500)
  2661	17:36:16.468893 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2850609 501117578> (DF) (ttl 64, id 1262, len 52)
  2662	17:36:16.473197 172.16.183.2.1073 > clusterc.icq.com.http: P [bad tcp cksum efa5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2663	17:36:16.473197 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2850610 501117578> (DF) (ttl 64, id 1263, len 52)
  2664	17:36:16.476806 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23310, len 1252)
  2665	17:36:16.477578 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1264, len 40)
  2666	17:36:16.487842 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23311, len 1500)
  2667	17:36:16.488619 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1265, len 40)
  2668	17:36:16.498688 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23312, len 1500)
  2669	17:36:16.499515 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1266, len 40)
  2670	17:36:16.507854 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23313, len 1252)
  2671	17:36:16.508579 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1267, len 40)
  2672	17:36:16.518877 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23314, len 1500)
  2673	17:36:16.519662 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1268, len 40)
  2674	17:36:16.529723 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23315, len 1500)
  2675	17:36:16.530506 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1269, len 40)
  2676	17:36:16.537901 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23316, len 1252)
  2677	17:36:16.538584 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1270, len 40)
  2678	17:36:16.548199 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23317, len 1500)
  2679	17:36:16.549003 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1271, len 40)
  2680	17:36:16.558569 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23318, len 1500)
  2681	17:36:16.567752 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1272, len 40)
  2682	17:36:18.537288 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50771+ A? web.icq.com. [|domain] (ttl 64, id 1273, len 57)
  2683	17:36:18.566243 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50771 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 30915, len 244)
  2684	17:36:18.567533 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2850814 0,nop,wscale 0> (DF) (ttl 64, id 1274, len 60)
  2685	17:36:21.565072 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2851115 0,nop,wscale 0> (DF) (ttl 64, id 1275, len 60)
  2686	17:36:27.565114 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2851715 0,nop,wscale 0> (DF) (ttl 64, id 1276, len 60)
  2687	17:36:39.565311 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2852915 0,nop,wscale 0> (DF) (ttl 64, id 1277, len 60)
  2688	17:37:03.635195 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2855315 0,nop,wscale 0> (DF) (ttl 64, id 1278, len 60)
  2689	17:37:51.625268 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2860115 0,nop,wscale 0> (DF) (ttl 64, id 1279, len 60)
  2690	17:38:02.985089 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1280, len 120)
  2691	17:39:27.615218 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2869715 0,nop,wscale 0> (DF) (ttl 64, id 1281, len 60)
  2692	17:39:27.635612 clusterc.icq.com.http > 172.16.183.2.1074: S [tcp sum ok] 1993303337:1993303337(0) ack 2203503750 win 65535 <nop,nop,timestamp 17831032 2869715,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52401, len 64)
  2693	17:39:27.636290 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2869717 17831032> (DF) (ttl 64, id 1282, len 52)
  2694	17:39:28.635479 172.16.183.2.1074 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2869817 17831032> (DF) (ttl 64, id 1283, len 104)
  2695	17:39:28.653614 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17831133 2869817> (DF) (ttl 240, id 52402, len 52)
  2696	17:39:29.167974 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17831183 2869817> (DF) (ttl 240, id 52403, len 1500)
  2697	17:39:29.168780 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2869885 17831183> (DF) (ttl 64, id 1284, len 52)
  2698	17:39:29.181775 clusterc.icq.com.http > 172.16.183.2.1074: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17831183 2869817> (DF) (ttl 240, id 52404, len 1500)
  2699	17:39:29.199245 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17831187 2869885> (DF) (ttl 240, id 52405, len 1477)
  2700	17:39:29.209860 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2869889 17831183> (DF) (ttl 64, id 1285, len 52)
  2701	17:39:29.213044 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17831187 2869885> (DF) (ttl 240, id 52406, len 1500)
  2702	17:39:29.224912 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2869891 17831187> (DF) (ttl 64, id 1286, len 52)
  2703	17:39:29.240662 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52407, len 1500)
  2704	17:39:29.251541 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52408, len 1252)
  2705	17:39:29.263808 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52409, len 1500)
  2706	17:39:29.264816 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2869895 17831191> (DF) (ttl 64, id 1287, len 52)
  2707	17:39:29.276375 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17831192 2869891> (DF) (ttl 240, id 52410, len 1500)
  2708	17:39:29.286033 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17831192 2869891> (DF) (ttl 240, id 52411, len 1252)
  2709	17:39:29.289839 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2869898 17831192> (DF) (ttl 64, id 1288, len 52)
  2710	17:39:29.298299 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52412, len 1500)
  2711	17:39:29.309836 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2869900 17831196> (DF) (ttl 64, id 1289, len 52)
  2712	17:39:29.310099 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52413, len 1500)
  2713	17:39:29.318366 172.16.183.2.1074 > clusterc.icq.com.http: P [bad tcp cksum d1f3!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2714	17:39:29.318366 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2869900 17831196> (DF) (ttl 64, id 1290, len 52)
  2715	17:39:29.320016 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52414, len 1252)
  2716	17:39:29.320765 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1291, len 40)
  2717	17:39:29.332529 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52415, len 1500)
  2718	17:39:29.333259 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1292, len 40)
  2719	17:39:29.344111 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52416, len 1500)
  2720	17:39:29.345054 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1293, len 40)
  2721	17:39:29.353508 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52417, len 1252)
  2722	17:39:29.354195 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1294, len 40)
  2723	17:39:29.364560 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52418, len 1500)
  2724	17:39:29.365486 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1295, len 40)
  2725	17:39:29.375405 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17831201 2869900> (DF) (ttl 240, id 52419, len 1500)
  2726	17:39:29.376162 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1296, len 40)
  2727	17:39:29.384557 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17831201 2869900> (DF) (ttl 240, id 52420, len 1252)
  2728	17:39:29.385445 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1297, len 40)
  2729	17:39:31.347462 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50772+ A? web.icq.com. [|domain] (ttl 64, id 1298, len 57)
  2730	17:39:31.362364 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50772 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 43497, len 233)
  2731	17:39:31.363402 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2870102 0,nop,wscale 0> (DF) (ttl 64, id 1299, len 60)
  2732	17:39:34.374993 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2870402 0,nop,wscale 0> (DF) (ttl 64, id 1300, len 60)
  2733	17:39:40.365202 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2871002 0,nop,wscale 0> (DF) (ttl 64, id 1301, len 60)
  2734	17:39:52.355360 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2872202 0,nop,wscale 0> (DF) (ttl 64, id 1302, len 60)
  2735	17:40:02.875314 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1303, len 120)
  2736	17:40:16.385268 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2874602 0,nop,wscale 0> (DF) (ttl 64, id 1304, len 60)
  2737	17:41:04.395140 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2879402 0,nop,wscale 0> (DF) (ttl 64, id 1305, len 60)
  2738	17:41:54.005412 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 81:137(56) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1306, len 96)
  2739	17:42:02.965287 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1307, len 176)
  2740	17:42:40.485187 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2889002 0,nop,wscale 0> (DF) (ttl 64, id 1308, len 60)
  2741	17:42:40.502196 clusterc.icq.com.http > 172.16.183.2.1075: S [tcp sum ok] 2720615512:2720615512(0) ack 2406909329 win 65535 <nop,nop,timestamp 501155987 2889002,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 21951, len 64)
  2742	17:42:40.502909 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2889003 501155987> (DF) (ttl 64, id 1309, len 52)
  2743	17:42:41.485450 172.16.183.2.1075 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2889103 501155987> (DF) (ttl 64, id 1310, len 104)
  2744	17:42:41.504680 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501156087 2889103> (DF) (ttl 240, id 21952, len 52)
  2745	17:42:42.047665 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501156139 2889103> (DF) (ttl 240, id 21953, len 1500)
  2746	17:42:42.048496 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2889179 501156139> (DF) (ttl 64, id 1311, len 52)
  2747	17:42:42.067851 clusterc.icq.com.http > 172.16.183.2.1075: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501156139 2889103> (DF) (ttl 240, id 21954, len 1500)
  2748	17:42:42.085565 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501156143 2889179> (DF) (ttl 240, id 21955, len 1477)
  2749	17:42:42.086325 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2889183 501156139> (DF) (ttl 64, id 1312, len 52)
  2750	17:42:42.102582 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501156143 2889179> (DF) (ttl 240, id 21956, len 1500)
  2751	17:42:42.114905 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2889186 501156143> (DF) (ttl 64, id 1313, len 52)
  2752	17:42:42.120313 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501156147 2889183> (DF) (ttl 240, id 21957, len 1500)
  2753	17:42:42.134668 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501156147 2889183> (DF) (ttl 240, id 21958, len 1252)
  2754	17:42:42.135666 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2889188 501156147> (DF) (ttl 64, id 1314, len 52)
  2755	17:42:42.152099 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21959, len 1500)
  2756	17:42:42.168118 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21960, len 1500)
  2757	17:42:42.168884 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2889191 501156147> (DF) (ttl 64, id 1315, len 52)
  2758	17:42:42.180977 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21961, len 1252)
  2759	17:42:42.194935 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2889194 501156150> (DF) (ttl 64, id 1316, len 52)
  2760	17:42:42.196200 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501156152 2889188> (DF) (ttl 240, id 21962, len 1500)
  2761	17:42:42.211235 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501156152 2889188> (DF) (ttl 240, id 21963, len 1500)
  2762	17:42:42.212036 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2889196 501156152> (DF) (ttl 64, id 1317, len 52)
  2763	17:42:42.217125 172.16.183.2.1075 > clusterc.icq.com.http: P [bad tcp cksum 1c1c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2764	17:42:42.217125 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2889196 501156152> (DF) (ttl 64, id 1318, len 52)
  2765	17:42:42.223832 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21964, len 1252)
  2766	17:42:42.224828 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1319, len 40)
  2767	17:42:42.239305 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21965, len 1500)
  2768	17:42:42.240089 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1320, len 40)
  2769	17:42:42.254108 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21966, len 1500)
  2770	17:42:42.255128 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1321, len 40)
  2771	17:42:42.265237 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21967, len 1252)
  2772	17:42:42.265921 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1322, len 40)
  2773	17:42:42.279225 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501156158 2889194> (DF) (ttl 240, id 21968, len 1500)
  2774	17:42:42.279995 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1323, len 40)
  2775	17:42:42.292762 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501156158 2889194> (DF) (ttl 240, id 21969, len 1500)
  2776	17:42:42.293564 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1324, len 40)
  2777	17:42:42.303404 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21970, len 1252)
  2778	17:42:42.304129 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1325, len 40)
  2779	17:42:42.316913 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21971, len 1500)
  2780	17:42:42.317722 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1326, len 40)
  2781	17:42:42.330217 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21972, len 1500)
  2782	17:42:42.331033 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1327, len 40)
  2783	17:42:44.226807 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50773+ A? web.icq.com. [|domain] (ttl 64, id 1328, len 57)
  2784	17:42:44.239329 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50773 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 56238, len 233)
  2785	17:42:44.240359 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2889398 0,nop,wscale 0> (DF) (ttl 64, id 1329, len 60)
  2786	17:42:47.234928 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2889698 0,nop,wscale 0> (DF) (ttl 64, id 1330, len 60)
  2787	17:42:53.275330 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2890298 0,nop,wscale 0> (DF) (ttl 64, id 1331, len 60)
  2788	17:43:05.275221 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2891498 0,nop,wscale 0> (DF) (ttl 64, id 1332, len 60)
  2789	17:43:29.305144 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2893898 0,nop,wscale 0> (DF) (ttl 64, id 1333, len 60)
  2790	17:44:02.755107 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1334, len 176)
  2791	17:44:17.225168 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2898698 0,nop,wscale 0> (DF) (ttl 64, id 1335, len 60)
  2792	17:45:53.225260 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2908298 0,nop,wscale 0> (DF) (ttl 64, id 1336, len 60)
  2793	17:45:53.242663 clusterc.icq.com.http > 172.16.183.2.1076: S [tcp sum ok] 1990489637:1990489637(0) ack 2606150863 win 65535 <nop,nop,timestamp 501175261 2908298,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 18083, len 64)
  2794	17:45:53.243018 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2908299 501175261> (DF) (ttl 64, id 1337, len 52)
  2795	17:45:54.235539 172.16.183.2.1076 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2908399 501175261> (DF) (ttl 64, id 1338, len 104)
  2796	17:45:54.356289 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501175373 2908399> (DF) (ttl 240, id 18084, len 52)
  2797	17:45:54.955403 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501175431 2908399> (DF) (ttl 240, id 18085, len 1500)
  2798	17:45:54.956144 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2908476 501175431> (DF) (ttl 64, id 1339, len 52)
  2799	17:45:54.972896 clusterc.icq.com.http > 172.16.183.2.1076: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501175431 2908399> (DF) (ttl 240, id 18086, len 1500)
  2800	17:45:54.976406 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2908478 501175431> (DF) (ttl 64, id 1340, len 52)
  2801	17:45:54.991355 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501175435 2908476> (DF) (ttl 240, id 18087, len 1477)
  2802	17:45:55.006397 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501175435 2908476> (DF) (ttl 240, id 18088, len 1500)
  2803	17:45:55.021664 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501175437 2908478> (DF) (ttl 240, id 18089, len 1500)
  2804	17:45:55.022408 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2908482 501175435> (DF) (ttl 64, id 1341, len 52)
  2805	17:45:55.033825 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501175437 2908478> (DF) (ttl 240, id 18090, len 1252)
  2806	17:45:55.044957 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2908485 501175437> (DF) (ttl 64, id 1342, len 52)
  2807	17:45:55.054679 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18091, len 1500)
  2808	17:45:55.069227 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18092, len 1500)
  2809	17:45:55.070036 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2908488 501175441> (DF) (ttl 64, id 1343, len 52)
  2810	17:45:55.080600 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18093, len 1252)
  2811	17:45:55.094115 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18094, len 1500)
  2812	17:45:55.106399 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2908492 501175441> (DF) (ttl 64, id 1344, len 52)
  2813	17:45:55.107412 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501175443 2908485> (DF) (ttl 240, id 18095, len 1500)
  2814	17:45:55.112316 172.16.183.2.1076 > clusterc.icq.com.http: P [bad tcp cksum bde1!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2815	17:45:55.112316 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2908492 501175443> (DF) (ttl 64, id 1345, len 52)
  2816	17:45:55.118538 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501175443 2908485> (DF) (ttl 240, id 18096, len 1252)
  2817	17:45:55.119297 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1346, len 40)
  2818	17:45:55.132038 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18097, len 1500)
  2819	17:45:55.132776 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1347, len 40)
  2820	17:45:55.145339 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18098, len 1500)
  2821	17:45:55.146144 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1348, len 40)
  2822	17:45:55.156716 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18099, len 1252)
  2823	17:45:55.157454 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1349, len 40)
  2824	17:45:55.168996 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18100, len 1500)
  2825	17:45:55.169714 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1350, len 40)
  2826	17:45:55.181311 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18101, len 1500)
  2827	17:45:55.182081 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1351, len 40)
  2828	17:45:55.191453 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18102, len 1252)
  2829	17:45:55.192134 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1352, len 40)
  2830	17:45:57.117518 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50774+ A? web.icq.com. [|domain] (ttl 64, id 1353, len 57)
  2831	17:45:57.137969 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50774* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 3088, len 233)
  2832	17:45:57.139019 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2908694 0,nop,wscale 0> (DF) (ttl 64, id 1354, len 60)
  2833	17:46:00.144995 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2908994 0,nop,wscale 0> (DF) (ttl 64, id 1355, len 60)
  2834	17:46:02.715207 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1356, len 176)
  2835	17:46:06.145040 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2909594 0,nop,wscale 0> (DF) (ttl 64, id 1357, len 60)
  2836	17:46:18.195131 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2910794 0,nop,wscale 0> (DF) (ttl 64, id 1358, len 60)
  2837	17:46:42.205282 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2913194 0,nop,wscale 0> (DF) (ttl 64, id 1359, len 60)
  2838	17:47:30.235200 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2917994 0,nop,wscale 0> (DF) (ttl 64, id 1360, len 60)
  2839	17:48:02.795069 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1361, len 176)
  2840	17:49:06.225267 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2927594 0,nop,wscale 0> (DF) (ttl 64, id 1362, len 60)
  2841	17:50:02.785394 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1363, len 176)
  2842	17:51:06.235156 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2939594 0,nop,wscale 0> (DF) (ttl 64, id 1364, len 60)
  2843	17:51:06.252361 clusterc.icq.com.http > 172.16.183.2.1077: S [tcp sum ok] 644265659:644265659(0) ack 2799686874 win 65535 <nop,nop,timestamp 26458326 2939594,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 14429, len 64)
  2844	17:51:06.252735 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2939595 26458326> (DF) (ttl 64, id 1365, len 52)
  2845	17:51:07.245427 172.16.183.2.1077 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2939695 26458326> (DF) (ttl 64, id 1366, len 104)
  2846	17:51:07.343293 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 26458435 2939695> (DF) (ttl 240, id 14430, len 52)
  2847	17:51:07.932059 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 26458492 2939695> (DF) (ttl 240, id 14431, len 1500)
  2848	17:51:07.932813 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2939783 26458492> (DF) (ttl 64, id 1367, len 52)
  2849	17:51:07.947574 clusterc.icq.com.http > 172.16.183.2.1077: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 26458492 2939695> (DF) (ttl 240, id 14432, len 1500)
  2850	17:51:07.963614 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2939787 26458492> (DF) (ttl 64, id 1368, len 52)
  2851	17:51:07.966029 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 26458495 2939783> (DF) (ttl 240, id 14433, len 1477)
  2852	17:51:07.979368 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 26458495 2939783> (DF) (ttl 240, id 14434, len 1500)
  2853	17:51:07.993611 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2939790 26458495> (DF) (ttl 64, id 1369, len 52)
  2854	17:51:07.994648 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 26458498 2939787> (DF) (ttl 240, id 14435, len 1500)
  2855	17:51:08.005769 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 26458498 2939787> (DF) (ttl 240, id 14436, len 1252)
  2856	17:51:08.023617 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2939793 26458498> (DF) (ttl 64, id 1370, len 52)
  2857	17:51:08.030363 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14437, len 1500)
  2858	17:51:08.043420 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14438, len 1500)
  2859	17:51:08.044140 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2939794 26458502> (DF) (ttl 64, id 1371, len 52)
  2860	17:51:08.054055 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14439, len 1252)
  2861	17:51:08.065842 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14440, len 1500)
  2862	17:51:08.077915 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14441, len 1500)
  2863	17:51:08.078661 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2939798 26458502> (DF) (ttl 64, id 1372, len 52)
  2864	17:51:08.083061 172.16.183.2.1077 > clusterc.icq.com.http: P [bad tcp cksum cfc5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2865	17:51:08.083061 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2939798 26458502> (DF) (ttl 64, id 1373, len 52)
  2866	17:51:08.088288 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14442, len 1252)
  2867	17:51:08.089096 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1374, len 40)
  2868	17:51:08.099821 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14443, len 1500)
  2869	17:51:08.100613 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1375, len 40)
  2870	17:51:08.112148 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14444, len 1500)
  2871	17:51:08.112923 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1376, len 40)
  2872	17:51:08.122291 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14445, len 1252)
  2873	17:51:08.123022 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1377, len 40)
  2874	17:51:08.134066 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14446, len 1500)
  2875	17:51:08.135031 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1378, len 40)
  2876	17:51:08.145167 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14447, len 1500)
  2877	17:51:08.146035 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1379, len 40)
  2878	17:51:08.154803 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14448, len 1252)
  2879	17:51:08.155523 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1380, len 40)
  2880	17:51:08.165597 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14449, len 1500)
  2881	17:51:08.166310 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1381, len 40)
  2882	17:51:10.097264 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50775+ A? web.icq.com. [|domain] (ttl 64, id 1382, len 57)
  2883	17:51:10.109707 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50775 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 20522, len 233)
  2884	17:51:10.111031 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940000 0,nop,wscale 0> (DF) (ttl 64, id 1383, len 60)
  2885	17:51:13.125215 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940301 0,nop,wscale 0> (DF) (ttl 64, id 1384, len 60)
  2886	17:51:19.185144 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940901 0,nop,wscale 0> (DF) (ttl 64, id 1385, len 60)
  2887	17:51:31.185203 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2942101 0,nop,wscale 0> (DF) (ttl 64, id 1386, len 60)
  2888	17:51:55.236139 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2944501 0,nop,wscale 0> (DF) (ttl 64, id 1387, len 60)
  2889	17:52:43.225298 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2949301 0,nop,wscale 0> (DF) (ttl 64, id 1388, len 60)
  2890	17:54:19.165346 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2958901 0,nop,wscale 0> (DF) (ttl 64, id 1389, len 60)
  2891	17:54:19.182776 clusterb.icq.com.http > 172.16.183.2.1078: S [tcp sum ok] 348233785:348233785(0) ack 3150680823 win 65535 <nop,nop,timestamp 201244130 2958901,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 27349, len 64)
  2892	17:54:19.183666 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2958902 201244130> (DF) (ttl 64, id 1390, len 52)
  2893	17:54:20.185730 172.16.183.2.1078 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2959002 201244130> (DF) (ttl 64, id 1391, len 104)
  2894	17:54:20.205712 clusterb.icq.com.http > 172.16.183.2.1078: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 201244233 2959002> (DF) (ttl 240, id 27350, len 52)
  2895	17:54:20.480933 clusterb.icq.com.http > 172.16.183.2.1078: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 201244259 2959002> (DF) (ttl 240, id 27351, len 391)
  2896	17:54:20.481645 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2959045 201244259> (DF) (ttl 64, id 1392, len 52)
  2897	17:54:20.482123 clusterb.icq.com.http > 172.16.183.2.1078: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 201244260 2959002> (DF) (ttl 240, id 27352, len 52)
  2898	17:54:20.482547 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2959045 201244260> (DF) (ttl 64, id 1393, len 52)
  2899	17:54:45.241731 172.16.183.2.1078 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2961522 201244260> (DF) (ttl 64, id 1394, len 52)
  2900	17:54:45.258426 172.16.183.2.1078 > clusterb.icq.com.http: P [bad tcp cksum 4050!] 1492520600:1492520651(51) ack 2802447091 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2901	17:54:45.258426 clusterb.icq.com.http > 172.16.183.2.1078: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 201246738 2961522> (DF) (ttl 240, id 27353, len 52)
  2902	17:54:46.247095 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50776+ A? web.icq.com. [|domain] (ttl 64, id 1395, len 57)
  2903	17:54:46.261560 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50776 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 31560, len 233)
  2904	17:54:46.262557 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2961623 0,nop,wscale 0> (DF) (ttl 64, id 1396, len 60)
  2905	17:54:49.255349 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2961923 0,nop,wscale 0> (DF) (ttl 64, id 1397, len 60)
  2906	17:54:55.265009 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2962523 0,nop,wscale 0> (DF) (ttl 64, id 1398, len 60)
  2907	17:55:07.255220 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2963723 0,nop,wscale 0> (DF) (ttl 64, id 1399, len 60)
  2908	17:55:31.265246 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2966123 0,nop,wscale 0> (DF) (ttl 64, id 1400, len 60)
  2909	17:56:19.355034 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2970923 0,nop,wscale 0> (DF) (ttl 64, id 1401, len 60)
  2910	17:57:55.405318 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2980523 0,nop,wscale 0> (DF) (ttl 64, id 1402, len 60)
  2911	17:57:55.422333 clusterb.icq.com.http > 172.16.183.2.1079: S [tcp sum ok] 3173761707:3173761707(0) ack 3361641696 win 65535 <nop,nop,timestamp 502026126 2980523,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 7053, len 64)
  2912	17:57:55.423002 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2980524 502026126> (DF) (ttl 64, id 1403, len 52)
  2913	17:57:56.415705 172.16.183.2.1079 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2980624 502026126> (DF) (ttl 64, id 1404, len 104)
  2914	17:57:56.436155 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502026228 2980624> (DF) (ttl 240, id 7054, len 52)
  2915	17:57:57.071747 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502026289 2980624> (DF) (ttl 240, id 7055, len 1500)
  2916	17:57:57.072474 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2980710 502026289> (DF) (ttl 64, id 1405, len 52)
  2917	17:57:57.091945 clusterb.icq.com.http > 172.16.183.2.1079: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502026289 2980624> (DF) (ttl 240, id 7056, len 1500)
  2918	17:57:57.108931 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502026293 2980710> (DF) (ttl 240, id 7057, len 1477)
  2919	17:57:57.119957 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2980716 502026289> (DF) (ttl 64, id 1406, len 52)
  2920	17:57:57.126431 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502026293 2980710> (DF) (ttl 240, id 7058, len 1500)
  2921	17:57:57.149958 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2980719 502026293> (DF) (ttl 64, id 1407, len 52)
  2922	17:57:57.156738 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502026298 2980716> (DF) (ttl 240, id 7059, len 1500)
  2923	17:57:57.171327 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502026298 2980716> (DF) (ttl 240, id 7060, len 1252)
  2924	17:57:57.187786 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502026298 2980716> (DF) (ttl 240, id 7061, len 1500)
  2925	17:57:57.188532 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2980722 502026298> (DF) (ttl 64, id 1408, len 52)
  2926	17:57:57.203548 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502026301 2980719> (DF) (ttl 240, id 7062, len 1500)
  2927	17:57:57.215914 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502026301 2980719> (DF) (ttl 240, id 7063, len 1252)
  2928	17:57:57.229957 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2980727 502026301> (DF) (ttl 64, id 1409, len 52)
  2929	17:57:57.230893 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502026305 2980722> (DF) (ttl 240, id 7064, len 1500)
  2930	17:57:57.245926 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502026305 2980722> (DF) (ttl 240, id 7065, len 1500)
  2931	17:57:57.246664 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2980728 502026305> (DF) (ttl 64, id 1410, len 52)
  2932	17:57:57.251566 172.16.183.2.1079 > clusterb.icq.com.http: P [bad tcp cksum b141!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2933	17:57:57.251566 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2980729 502026305> (DF) (ttl 64, id 1411, len 52)
  2934	17:57:57.258762 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502026305 2980722> (DF) (ttl 240, id 7066, len 1252)
  2935	17:57:57.259529 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1412, len 40)
  2936	17:57:57.273755 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502026305 2980722> (DF) (ttl 240, id 7067, len 1500)
  2937	17:57:57.274534 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1413, len 40)
  2938	17:57:57.287542 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502026309 2980727> (DF) (ttl 240, id 7068, len 1500)
  2939	17:57:57.288312 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1414, len 40)
  2940	17:57:57.298675 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502026309 2980727> (DF) (ttl 240, id 7069, len 1252)
  2941	17:57:57.299373 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1415, len 40)
  2942	17:57:57.312189 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502026309 2980727> (DF) (ttl 240, id 7070, len 1500)
  2943	17:57:57.312914 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1416, len 40)
  2944	17:57:57.325747 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502026311 2980728> (DF) (ttl 240, id 7071, len 1500)
  2945	17:57:57.326477 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1417, len 40)
  2946	17:57:57.336631 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502026311 2980728> (DF) (ttl 240, id 7072, len 1252)
  2947	17:57:57.337313 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1418, len 40)
  2948	17:57:57.350130 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502026311 2980728> (DF) (ttl 240, id 7073, len 1500)
  2949	17:57:57.350888 172.16.183.2.1079 > clusterb.icq.com.http: R [tcp sum ok] 3361641748:3361641748(0) win 0 (ttl 255, id 1419, len 40)
  2950	17:57:59.257133 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50777+ A? web.icq.com. [|domain] (ttl 64, id 1420, len 57)
  2951	17:57:59.270078 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50777 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 41161, len 233)
  2952	17:57:59.271338 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2980930 0,nop,wscale 0> (DF) (ttl 64, id 1421, len 60)
  2953	17:58:02.285278 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2981231 0,nop,wscale 0> (DF) (ttl 64, id 1422, len 60)
  2954	17:58:08.274917 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2981831 0,nop,wscale 0> (DF) (ttl 64, id 1423, len 60)
  2955	17:58:20.275338 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2983031 0,nop,wscale 0> (DF) (ttl 64, id 1424, len 60)
  2956	17:58:44.285388 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2985431 0,nop,wscale 0> (DF) (ttl 64, id 1425, len 60)
  2957	17:59:32.285158 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2990231 0,nop,wscale 0> (DF) (ttl 64, id 1426, len 60)
  2958	18:01:08.265070 172.16.183.2.socks > clustera.icq.com.http: S [tcp sum ok] 3578497619:3578497619(0) win 32120 <mss 1460,sackOK,timestamp 2999831 0,nop,wscale 0> (DF) (ttl 64, id 1427, len 60)
  2959	18:01:08.283037 clustera.icq.com.http > 172.16.183.2.socks: S [tcp sum ok] 3559884760:3559884760(0) ack 3578497620 win 65535 <nop,nop,timestamp 502160943 2999831,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 44503, len 64)
  2960	18:01:08.283685 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2999832 502160943> (DF) (ttl 64, id 1428, len 52)
  2961	18:01:09.275372 172.16.183.2.socks > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2999932 502160943> (DF) (ttl 64, id 1429, len 104)
  2962	18:01:09.345136 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502161049 2999932> (DF) (ttl 240, id 44504, len 52)
  2963	18:01:09.995748 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502161112 2999932> (DF) (ttl 240, id 44505, len 1500)
  2964	18:01:09.996570 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3000010 502161112> (DF) (ttl 64, id 1430, len 52)
  2965	18:01:10.013501 clustera.icq.com.http > 172.16.183.2.socks: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502161112 2999932> (DF) (ttl 240, id 44506, len 1500)
  2966	18:01:10.018259 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3000012 502161112> (DF) (ttl 64, id 1431, len 52)
  2967	18:01:10.031456 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502161116 3000010> (DF) (ttl 240, id 44507, len 1477)
  2968	18:01:10.044960 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3000015 502161116> (DF) (ttl 64, id 1432, len 52)
  2969	18:01:10.049202 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502161116 3000010> (DF) (ttl 240, id 44508, len 1500)
  2970	18:01:10.066211 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502161118 3000012> (DF) (ttl 240, id 44509, len 1500)
  2971	18:01:10.067029 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3000017 502161116> (DF) (ttl 64, id 1433, len 52)
  2972	18:01:10.079320 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502161118 3000012> (DF) (ttl 240, id 44510, len 1252)
  2973	18:01:10.094546 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502161121 3000015> (DF) (ttl 240, id 44511, len 1500)
  2974	18:01:10.095590 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3000020 502161118> (DF) (ttl 64, id 1434, len 52)
  2975	18:01:10.110074 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502161121 3000015> (DF) (ttl 240, id 44512, len 1500)
  2976	18:01:10.110815 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3000021 502161121> (DF) (ttl 64, id 1435, len 52)
  2977	18:01:10.122925 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502161123 3000017> (DF) (ttl 240, id 44513, len 1252)
  2978	18:01:10.134952 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3000024 502161123> (DF) (ttl 64, id 1436, len 52)
  2979	18:01:10.137913 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502161123 3000017> (DF) (ttl 240, id 44514, len 1500)
  2980	18:01:10.152965 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502161123 3000017> (DF) (ttl 240, id 44515, len 1500)
  2981	18:01:10.153638 172.16.183.2.socks > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3000025 502161123> (DF) (ttl 64, id 1437, len 52)
  2982	18:01:10.158822 172.16.183.2.socks > clustera.icq.com.http: P [bad tcp cksum 3d63!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2983	18:01:10.158822 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3000026 502161123> (DF) (ttl 64, id 1438, len 52)
  2984	18:01:10.165535 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502161126 3000020> (DF) (ttl 240, id 44516, len 1252)
  2985	18:01:10.166315 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1439, len 40)
  2986	18:01:10.179288 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502161126 3000020> (DF) (ttl 240, id 44517, len 1500)
  2987	18:01:10.180025 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1440, len 40)
  2988	18:01:10.192582 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502161127 3000021> (DF) (ttl 240, id 44518, len 1500)
  2989	18:01:10.193329 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1441, len 40)
  2990	18:01:10.204210 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502161127 3000021> (DF) (ttl 240, id 44519, len 1252)
  2991	18:01:10.205241 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1442, len 40)
  2992	18:01:10.217726 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502161127 3000021> (DF) (ttl 240, id 44520, len 1500)
  2993	18:01:10.218472 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1443, len 40)
  2994	18:01:10.231028 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502161130 3000024> (DF) (ttl 240, id 44521, len 1500)
  2995	18:01:10.231831 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1444, len 40)
  2996	18:01:10.242399 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502161130 3000024> (DF) (ttl 240, id 44522, len 1252)
  2997	18:01:10.243138 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1445, len 40)
  2998	18:01:10.255901 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502161132 3000025> (DF) (ttl 240, id 44523, len 1500)
  2999	18:01:10.256653 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1446, len 40)
  3000	18:01:10.268466 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 502161132 3000025> (DF) (ttl 240, id 44524, len 1500)
  3001	18:01:10.269244 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1447, len 40)
  3002	18:01:10.278126 clustera.icq.com.http > 172.16.183.2.socks: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 502161132 3000025> (DF) (ttl 240, id 44525, len 1252)
  3003	18:01:10.278915 172.16.183.2.socks > clustera.icq.com.http: R [tcp sum ok] 3578497672:3578497672(0) win 0 (ttl 255, id 1448, len 40)
  3004	18:01:12.167243 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50778+ A? web.icq.com. [|domain] (ttl 64, id 1449, len 57)
  3005	18:01:15.872716 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50778 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 51615, len 244)
  3006	18:01:15.875646 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3000595 0,nop,wscale 0> (DF) (ttl 64, id 1450, len 60)
  3007	18:01:18.925210 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3000895 0,nop,wscale 0> (DF) (ttl 64, id 1451, len 60)
  3008	18:01:24.915216 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3001495 0,nop,wscale 0> (DF) (ttl 64, id 1452, len 60)
  3009	18:01:36.925134 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3002695 0,nop,wscale 0> (DF) (ttl 64, id 1453, len 60)
  3010	18:02:01.005107 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3005095 0,nop,wscale 0> (DF) (ttl 64, id 1454, len 60)
  3011	18:02:48.995221 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3009895 0,nop,wscale 0> (DF) (ttl 64, id 1455, len 60)
  3012	18:04:24.915137 172.16.183.2.1081 > clustera.icq.com.http: S [tcp sum ok] 3777841576:3777841576(0) win 32120 <mss 1460,sackOK,timestamp 3019495 0,nop,wscale 0> (DF) (ttl 64, id 1456, len 60)
  3013	18:04:24.932694 clustera.icq.com.http > 172.16.183.2.1081: S [tcp sum ok] 1558905220:1558905220(0) ack 3777841577 win 33304 <nop,nop,timestamp 17722242 3019495,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 13077, len 64)
  3014	18:04:24.933198 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3019496 17722242> (DF) (ttl 64, id 1457, len 52)
  3015	18:04:25.925561 172.16.183.2.1081 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3019596 17722242> (DF) (ttl 64, id 1458, len 104)
  3016	18:04:25.953420 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17722344 3019596> (DF) (ttl 49, id 13078, len 52)
  3017	18:04:26.746428 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17722421 3019596> (DF) (ttl 49, id 13079, len 1500)
  3018	18:04:26.747307 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3019691 17722421> (DF) (ttl 64, id 1459, len 52)
  3019	18:04:26.766639 clustera.icq.com.http > 172.16.183.2.1081: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17722421 3019596> (DF) (ttl 49, id 13080, len 1500)
  3020	18:04:26.783868 clustera.icq.com.http > 172.16.183.2.1081: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17722421 3019596> (DF) (ttl 49, id 13081, len 1477)
  3021	18:04:26.786494 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3019695 17722421> (DF) (ttl 64, id 1460, len 52)
  3022	18:04:26.801132 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17722425 3019691> (DF) (ttl 49, id 13082, len 1500)
  3023	18:04:26.818379 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17722425 3019691> (DF) (ttl 49, id 13083, len 1500)
  3024	18:04:26.819124 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3019698 17722425> (DF) (ttl 64, id 1461, len 52)
  3025	18:04:26.832704 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17722429 3019695> (DF) (ttl 49, id 13084, len 1252)
  3026	18:04:26.850165 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17722429 3019695> (DF) (ttl 49, id 13085, len 1500)
  3027	18:04:26.865924 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17722429 3019695> (DF) (ttl 49, id 13086, len 1500)
  3028	18:04:26.866719 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3019703 17722429> (DF) (ttl 64, id 1462, len 52)
  3029	18:04:26.878787 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17722432 3019698> (DF) (ttl 49, id 13087, len 1252)
  3030	18:04:26.894014 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17722432 3019698> (DF) (ttl 49, id 13088, len 1500)
  3031	18:04:26.895893 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3019706 17722429> (DF) (ttl 64, id 1463, len 52)
  3032	18:04:26.909288 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17722432 3019698> (DF) (ttl 49, id 13089, len 1500)
  3033	18:04:26.910017 172.16.183.2.1081 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3019707 17722432> (DF) (ttl 64, id 1464, len 52)
  3034	18:04:26.912671 172.16.183.2.1081 > clustera.icq.com.http: P [bad tcp cksum 9d95!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3035	18:04:26.912671 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3019707 17722432> (DF) (ttl 64, id 1465, len 52)
  3036	18:04:26.921640 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17722437 3019703> (DF) (ttl 49, id 13090, len 1252)
  3037	18:04:26.922449 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1466, len 40)
  3038	18:04:26.936867 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17722437 3019703> (DF) (ttl 49, id 13091, len 1500)
  3039	18:04:26.937679 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1467, len 40)
  3040	18:04:26.951888 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17722437 3019703> (DF) (ttl 49, id 13092, len 1500)
  3041	18:04:26.952618 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1468, len 40)
  3042	18:04:26.962781 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17722440 3019706> (DF) (ttl 49, id 13093, len 1252)
  3043	18:04:26.963540 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1469, len 40)
  3044	18:04:26.976773 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17722440 3019706> (DF) (ttl 49, id 13094, len 1500)
  3045	18:04:26.977568 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1470, len 40)
  3046	18:04:26.990077 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17722440 3019706> (DF) (ttl 49, id 13095, len 1500)
  3047	18:04:26.990925 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1471, len 40)
  3048	18:04:27.001224 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17722441 3019707> (DF) (ttl 49, id 13096, len 1252)
  3049	18:04:27.001940 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1472, len 40)
  3050	18:04:27.014736 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17722441 3019707> (DF) (ttl 49, id 13097, len 1500)
  3051	18:04:27.015668 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1473, len 40)
  3052	18:04:27.028024 clustera.icq.com.http > 172.16.183.2.1081: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17722441 3019707> (DF) (ttl 49, id 13098, len 1500)
  3053	18:04:27.028773 172.16.183.2.1081 > clustera.icq.com.http: R [tcp sum ok] 3777841629:3777841629(0) win 0 (ttl 255, id 1474, len 40)
  3054	18:04:28.927010 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50779+ A? web.icq.com. [|domain] (ttl 64, id 1475, len 57)
  3055	18:04:28.941070 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50779 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 62281, len 233)
  3056	18:04:28.942361 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3019909 0,nop,wscale 0> (DF) (ttl 64, id 1476, len 60)
  3057	18:04:31.955254 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3020210 0,nop,wscale 0> (DF) (ttl 64, id 1477, len 60)
  3058	18:04:37.945000 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3020810 0,nop,wscale 0> (DF) (ttl 64, id 1478, len 60)
  3059	18:04:49.935206 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3022010 0,nop,wscale 0> (DF) (ttl 64, id 1479, len 60)
  3060	18:05:13.965008 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3024410 0,nop,wscale 0> (DF) (ttl 64, id 1480, len 60)
  3061	18:06:01.975063 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3029210 0,nop,wscale 0> (DF) (ttl 64, id 1481, len 60)
  3062	18:07:38.045155 172.16.183.2.1082 > clusterc.icq.com.http: S [tcp sum ok] 4003452226:4003452226(0) win 32120 <mss 1460,sackOK,timestamp 3038810 0,nop,wscale 0> (DF) (ttl 64, id 1482, len 60)
  3063	18:07:38.063420 clusterc.icq.com.http > 172.16.183.2.1082: S [tcp sum ok] 3476451554:3476451554(0) ack 4003452227 win 33304 <nop,nop,timestamp 200240824 3038810,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 21297, len 64)
  3064	18:07:38.064343 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3038811 200240824> (DF) (ttl 64, id 1483, len 52)
  3065	18:07:39.065566 172.16.183.2.1082 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3038911 200240824> (DF) (ttl 64, id 1484, len 104)
  3066	18:07:39.083878 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200240926 3038911> (DF) (ttl 49, id 21298, len 52)
  3067	18:07:39.906471 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200241006 3038911> (DF) (ttl 49, id 21299, len 1500)
  3068	18:07:39.907312 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3038978 200241006> (DF) (ttl 64, id 1485, len 52)
  3069	18:07:39.926423 clusterc.icq.com.http > 172.16.183.2.1082: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200241006 3038911> (DF) (ttl 49, id 21300, len 1500)
  3070	18:07:39.935024 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3038980 200241006> (DF) (ttl 64, id 1486, len 52)
  3071	18:07:39.943646 clusterc.icq.com.http > 172.16.183.2.1082: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200241006 3038911> (DF) (ttl 49, id 21301, len 1477)
  3072	18:07:39.954964 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3038981 200241006> (DF) (ttl 64, id 1487, len 52)
  3073	18:07:39.960912 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200241010 3038978> (DF) (ttl 49, id 21302, len 1500)
  3074	18:07:39.964980 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3038982 200241010> (DF) (ttl 64, id 1488, len 52)
  3075	18:07:39.978164 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200241010 3038978> (DF) (ttl 49, id 21303, len 1500)
  3076	18:07:39.992748 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200241013 3038980> (DF) (ttl 49, id 21304, len 1252)
  3077	18:07:40.004889 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3038985 200241010> (DF) (ttl 64, id 1489, len 52)
  3078	18:07:40.010181 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200241013 3038980> (DF) (ttl 49, id 21305, len 1500)
  3079	18:07:40.026452 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200241015 3038981> (DF) (ttl 49, id 21306, len 1500)
  3080	18:07:40.027254 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3038987 200241013> (DF) (ttl 64, id 1490, len 52)
  3081	18:07:40.039056 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200241015 3038981> (DF) (ttl 49, id 21307, len 1252)
  3082	18:07:40.054529 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200241016 3038982> (DF) (ttl 49, id 21308, len 1500)
  3083	18:07:40.055635 172.16.183.2.1082 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3038989 200241015> (DF) (ttl 64, id 1491, len 52)
  3084	18:07:40.069327 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200241016 3038982> (DF) (ttl 49, id 21309, len 1500)
  3085	18:07:40.073673 172.16.183.2.1082 > clusterc.icq.com.http: P [bad tcp cksum a51a!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3086	18:07:40.073673 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3038990 200241016> (DF) (ttl 64, id 1492, len 52)
  3087	18:07:40.081685 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200241020 3038985> (DF) (ttl 49, id 21310, len 1252)
  3088	18:07:40.082536 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1493, len 40)
  3089	18:07:40.097386 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200241020 3038985> (DF) (ttl 49, id 21311, len 1500)
  3090	18:07:40.098221 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1494, len 40)
  3091	18:07:40.112425 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200241020 3038985> (DF) (ttl 49, id 21312, len 1500)
  3092	18:07:40.113163 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1495, len 40)
  3093	18:07:40.123552 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200241022 3038987> (DF) (ttl 49, id 21313, len 1252)
  3094	18:07:40.124292 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1496, len 40)
  3095	18:07:40.137055 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200241022 3038987> (DF) (ttl 49, id 21314, len 1500)
  3096	18:07:40.137809 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1497, len 40)
  3097	18:07:40.150354 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200241025 3038989> (DF) (ttl 49, id 21315, len 1500)
  3098	18:07:40.151088 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1498, len 40)
  3099	18:07:40.161501 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200241025 3038989> (DF) (ttl 49, id 21316, len 1252)
  3100	18:07:40.162195 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1499, len 40)
  3101	18:07:40.175006 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 200241025 3038989> (DF) (ttl 49, id 21317, len 1500)
  3102	18:07:40.175751 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1500, len 40)
  3103	18:07:40.188317 clusterc.icq.com.http > 172.16.183.2.1082: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 200241025 3038989> (DF) (ttl 49, id 21318, len 1500)
  3104	18:07:40.189093 172.16.183.2.1082 > clusterc.icq.com.http: R [tcp sum ok] 4003452279:4003452279(0) win 0 (ttl 255, id 1501, len 40)
  3105	18:07:42.058366 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50780+ A? web.icq.com. [|domain] (ttl 64, id 1502, len 57)
  3106	18:07:42.079684 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50780* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 19685, len 233)
  3107	18:07:42.081144 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3039193 0,nop,wscale 0> (DF) (ttl 64, id 1503, len 60)
  3108	18:07:45.074973 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3039493 0,nop,wscale 0> (DF) (ttl 64, id 1504, len 60)
  3109	18:07:51.075318 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3040093 0,nop,wscale 0> (DF) (ttl 64, id 1505, len 60)
  3110	18:08:03.065187 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3041293 0,nop,wscale 0> (DF) (ttl 64, id 1506, len 60)
  3111	18:08:27.095126 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3043693 0,nop,wscale 0> (DF) (ttl 64, id 1507, len 60)
  3112	18:09:15.085157 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3048493 0,nop,wscale 0> (DF) (ttl 64, id 1508, len 60)
  3113	18:10:51.085213 172.16.183.2.1083 > clusterb.icq.com.http: S [tcp sum ok] 4194476494:4194476494(0) win 32120 <mss 1460,sackOK,timestamp 3058093 0,nop,wscale 0> (DF) (ttl 64, id 1509, len 60)
  3114	18:10:51.102978 clusterb.icq.com.http > 172.16.183.2.1083: S [tcp sum ok] 3184317861:3184317861(0) ack 4194476495 win 65535 <nop,nop,timestamp 503374810 3058093,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 59013, len 64)
  3115	18:10:51.103617 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3058094 503374810> (DF) (ttl 64, id 1510, len 52)
  3116	18:10:52.095420 172.16.183.2.1083 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3058194 503374810> (DF) (ttl 64, id 1511, len 104)
  3117	18:10:52.163857 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 503374916 3058194> (DF) (ttl 240, id 59014, len 52)
  3118	18:10:52.694731 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 503374967 3058194> (DF) (ttl 240, id 59015, len 1500)
  3119	18:10:52.695699 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3058288 503374967> (DF) (ttl 64, id 1512, len 52)
  3120	18:10:52.710242 clusterb.icq.com.http > 172.16.183.2.1083: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 503374967 3058194> (DF) (ttl 240, id 59016, len 1500)
  3121	18:10:52.723043 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3058292 503374967> (DF) (ttl 64, id 1513, len 52)
  3122	18:10:52.728953 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 503374971 3058288> (DF) (ttl 240, id 59017, len 1477)
  3123	18:10:52.743046 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3058295 503374971> (DF) (ttl 64, id 1514, len 52)
  3124	18:10:52.744241 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 503374971 3058288> (DF) (ttl 240, id 59018, len 1500)
  3125	18:10:52.759030 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 503374974 3058292> (DF) (ttl 240, id 59019, len 1500)
  3126	18:10:52.759795 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3058297 503374971> (DF) (ttl 64, id 1515, len 52)
  3127	18:10:52.771643 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 503374974 3058292> (DF) (ttl 240, id 59020, len 1252)
  3128	18:10:52.785643 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 503374976 3058295> (DF) (ttl 240, id 59021, len 1500)
  3129	18:10:52.793056 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3058303 503374974> (DF) (ttl 64, id 1516, len 52)
  3130	18:10:52.798956 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 503374976 3058295> (DF) (ttl 240, id 59022, len 1500)
  3131	18:10:52.810574 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 503374977 3058297> (DF) (ttl 240, id 59023, len 1252)
  3132	18:10:52.823042 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3058308 503374976> (DF) (ttl 64, id 1517, len 52)
  3133	18:10:52.824058 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 503374977 3058297> (DF) (ttl 240, id 59024, len 1500)
  3134	18:10:52.837376 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 503374977 3058297> (DF) (ttl 240, id 59025, len 1500)
  3135	18:10:52.838101 172.16.183.2.1083 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3058310 503374977> (DF) (ttl 64, id 1518, len 52)
  3136	18:10:52.842666 172.16.183.2.1083 > clusterb.icq.com.http: P [bad tcp cksum 7aef!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3137	18:10:52.842666 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3058310 503374977> (DF) (ttl 64, id 1519, len 52)
  3138	18:10:52.848243 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 503374980 3058303> (DF) (ttl 240, id 59026, len 1252)
  3139	18:10:52.848972 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1520, len 40)
  3140	18:10:52.861746 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 503374980 3058303> (DF) (ttl 240, id 59027, len 1500)
  3141	18:10:52.862555 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1521, len 40)
  3142	18:10:52.874560 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 503374980 3058303> (DF) (ttl 240, id 59028, len 1500)
  3143	18:10:52.875549 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1522, len 40)
  3144	18:10:52.884718 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 503374983 3058308> (DF) (ttl 240, id 59029, len 1252)
  3145	18:10:52.885715 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1523, len 40)
  3146	18:10:52.896750 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 503374983 3058308> (DF) (ttl 240, id 59030, len 1500)
  3147	18:10:52.897533 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1524, len 40)
  3148	18:10:52.909055 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 503374983 3058308> (DF) (ttl 240, id 59031, len 1500)
  3149	18:10:52.909838 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1525, len 40)
  3150	18:10:52.918954 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 503374985 3058310> (DF) (ttl 240, id 59032, len 1252)
  3151	18:10:52.919653 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1526, len 40)
  3152	18:10:52.930980 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 503374985 3058310> (DF) (ttl 240, id 59033, len 1500)
  3153	18:10:52.931719 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1527, len 40)
  3154	18:10:52.943304 clusterb.icq.com.http > 172.16.183.2.1083: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 503374985 3058310> (DF) (ttl 240, id 59034, len 1500)
  3155	18:10:52.944061 172.16.183.2.1083 > clusterb.icq.com.http: R [tcp sum ok] 4194476547:4194476547(0) win 0 (ttl 255, id 1528, len 40)
  3156	18:10:54.847340 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50781+ A? web.icq.com. [|domain] (ttl 64, id 1529, len 57)
  3157	18:10:54.861773 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50781 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 29953, len 233)
  3158	18:10:54.863085 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3058512 0,nop,wscale 0> (DF) (ttl 64, id 1530, len 60)
  3159	18:10:57.864956 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3058812 0,nop,wscale 0> (DF) (ttl 64, id 1531, len 60)
  3160	18:11:03.865291 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3059412 0,nop,wscale 0> (DF) (ttl 64, id 1532, len 60)
  3161	18:11:15.865280 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3060612 0,nop,wscale 0> (DF) (ttl 64, id 1533, len 60)
  3162	18:11:39.955349 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3063012 0,nop,wscale 0> (DF) (ttl 64, id 1534, len 60)
  3163	18:12:28.015222 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3067812 0,nop,wscale 0> (DF) (ttl 64, id 1535, len 60)
  3164	18:14:03.935247 172.16.183.2.1084 > clusterb.icq.com.http: S [tcp sum ok] 102176929:102176929(0) win 32120 <mss 1460,sackOK,timestamp 3077412 0,nop,wscale 0> (DF) (ttl 64, id 1536, len 60)
  3165	18:14:03.952319 clusterb.icq.com.http > 172.16.183.2.1084: S [tcp sum ok] 394368216:394368216(0) ack 102176930 win 33304 <nop,nop,timestamp 78784357 3077412,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 35315, len 64)
  3166	18:14:03.952980 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3077413 78784357> (DF) (ttl 64, id 1537, len 52)
  3167	18:14:04.945816 172.16.183.2.1084 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3077513 78784357> (DF) (ttl 64, id 1538, len 104)
  3168	18:14:04.964671 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 78784458 3077513> (DF) (ttl 49, id 35316, len 52)
  3169	18:14:05.623913 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 78784523 3077513> (DF) (ttl 49, id 35317, len 1500)
  3170	18:14:05.624975 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3077597 78784523> (DF) (ttl 64, id 1539, len 52)
  3171	18:14:05.637697 clusterb.icq.com.http > 172.16.183.2.1084: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 78784523 3077513> (DF) (ttl 49, id 35318, len 1500)
  3172	18:14:05.641350 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3077599 78784523> (DF) (ttl 64, id 1540, len 52)
  3173	18:14:05.649759 clusterb.icq.com.http > 172.16.183.2.1084: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 78784523 3077513> (DF) (ttl 49, id 35319, len 1477)
  3174	18:14:05.651329 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3077600 78784523> (DF) (ttl 64, id 1541, len 52)
  3175	18:14:05.661841 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 78784526 3077597> (DF) (ttl 49, id 35320, len 1500)
  3176	18:14:05.673923 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 78784526 3077597> (DF) (ttl 49, id 35321, len 1500)
  3177	18:14:05.674891 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3077602 78784526> (DF) (ttl 64, id 1542, len 52)
  3178	18:14:05.683822 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 78784528 3077599> (DF) (ttl 49, id 35322, len 1252)
  3179	18:14:05.696093 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 78784528 3077599> (DF) (ttl 49, id 35323, len 1500)
  3180	18:14:05.701354 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3077605 78784528> (DF) (ttl 64, id 1543, len 52)
  3181	18:14:05.707920 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 78784529 3077600> (DF) (ttl 49, id 35324, len 1500)
  3182	18:14:05.717825 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 78784529 3077600> (DF) (ttl 49, id 35325, len 1252)
  3183	18:14:05.730341 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 78784531 3077602> (DF) (ttl 49, id 35326, len 1500)
  3184	18:14:05.731096 172.16.183.2.1084 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3077607 78784529> (DF) (ttl 64, id 1544, len 52)
  3185	18:14:05.741679 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 78784531 3077602> (DF) (ttl 49, id 35327, len 1500)
  3186	18:14:05.746648 172.16.183.2.1084 > clusterb.icq.com.http: P [bad tcp cksum ab53!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3187	18:14:05.746648 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3077608 78784531> (DF) (ttl 64, id 1545, len 52)
  3188	18:14:05.750579 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 78784531 3077602> (DF) (ttl 49, id 35328, len 1252)
  3189	18:14:05.751817 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1546, len 40)
  3190	18:14:05.761615 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 78784534 3077605> (DF) (ttl 49, id 35329, len 1500)
  3191	18:14:05.762360 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1547, len 40)
  3192	18:14:05.772940 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 78784534 3077605> (DF) (ttl 49, id 35330, len 1500)
  3193	18:14:05.773731 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1548, len 40)
  3194	18:14:05.781612 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 78784534 3077605> (DF) (ttl 49, id 35331, len 1252)
  3195	18:14:05.782318 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1549, len 40)
  3196	18:14:05.792653 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 78784537 3077607> (DF) (ttl 49, id 35332, len 1500)
  3197	18:14:05.793430 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1550, len 40)
  3198	18:14:05.803594 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 78784537 3077607> (DF) (ttl 49, id 35333, len 1500)
  3199	18:14:05.804395 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1551, len 40)
  3200	18:14:05.812648 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 78784537 3077607> (DF) (ttl 49, id 35334, len 1252)
  3201	18:14:05.813371 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1552, len 40)
  3202	18:14:05.823693 clusterb.icq.com.http > 172.16.183.2.1084: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 78784537 3077607> (DF) (ttl 49, id 35335, len 1500)
  3203	18:14:05.824413 172.16.183.2.1084 > clusterb.icq.com.http: R [tcp sum ok] 102176982:102176982(0) win 0 (ttl 255, id 1553, len 40)
  3204	18:14:07.767023 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50782+ A? web.icq.com. [|domain] (ttl 64, id 1554, len 57)
  3205	18:14:10.841065 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50782 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 40726, len 244)
  3206	18:14:10.843934 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3078116 0,nop,wscale 0> (DF) (ttl 64, id 1555, len 60)
  3207	18:14:13.845147 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3078417 0,nop,wscale 0> (DF) (ttl 64, id 1556, len 60)
  3208	18:14:19.835204 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3079017 0,nop,wscale 0> (DF) (ttl 64, id 1557, len 60)
  3209	18:14:31.846928 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3080217 0,nop,wscale 0> (DF) (ttl 64, id 1558, len 60)
  3210	18:14:43.798123 169.254.129.1.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3211	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3212	TrnID=0x3706
  3213	OpCode=0
  3214	NmFlags=0x1
  3215	Rcode=0
  3216	QueryCount=1
  3217	AnswerCount=0
  3218	AuthorityCount=0
  3219	AddressRecCount=0
  3220	QuestionRecords:
  3221	Name=*               NameType=0x00 (Workstation)
  3222	QuestionType=0x21
  3223	QuestionClass=0x1
       

  3224	 (ttl 109, id 53137, len 78)
  3225	18:14:43.802059 172.16.183.8 > 169.254.129.1: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 33023, len 106)
  3226	18:14:43.839753 bc16997.bendcable.com.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3227	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3228	TrnID=0x3708
  3229	OpCode=0
  3230	NmFlags=0x1
  3231	Rcode=0
  3232	QueryCount=1
  3233	AnswerCount=0
  3234	AuthorityCount=0
  3235	AddressRecCount=0
  3236	QuestionRecords:
  3237	Name=*               NameType=0x00 (Workstation)
  3238	QuestionType=0x21
  3239	QuestionClass=0x1
       

  3240	 (ttl 109, id 53393, len 78)
  3241	18:14:43.840194 172.16.183.8 > bc16997.bendcable.com: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 36914, len 106)
  3242	18:14:45.357121 169.254.129.1.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3243	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3244	TrnID=0x370A
  3245	OpCode=0
  3246	NmFlags=0x1
  3247	Rcode=0
  3248	QueryCount=1
  3249	AnswerCount=0
  3250	AuthorityCount=0
  3251	AddressRecCount=0
  3252	QuestionRecords:
  3253	Name=*               NameType=0x00 (Workstation)
  3254	QuestionType=0x21
  3255	QuestionClass=0x1
       

  3256	 (ttl 109, id 53649, len 78)
  3257	18:14:45.357749 172.16.183.8 > 169.254.129.1: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 33024, len 106)
  3258	18:14:45.362040 bc16997.bendcable.com.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3259	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3260	TrnID=0x370C
  3261	OpCode=0
  3262	NmFlags=0x1
  3263	Rcode=0
  3264	QueryCount=1
  3265	AnswerCount=0
  3266	AuthorityCount=0
  3267	AddressRecCount=0
  3268	QuestionRecords:
  3269	Name=*               NameType=0x00 (Workstation)
  3270	QuestionType=0x21
  3271	QuestionClass=0x1
       

  3272	 (ttl 109, id 53905, len 78)
  3273	18:14:45.362475 172.16.183.8 > bc16997.bendcable.com: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 36915, len 106)
  3274	18:14:46.802370 169.254.129.1.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3275	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3276	TrnID=0x370E
  3277	OpCode=0
  3278	NmFlags=0x1
  3279	Rcode=0
  3280	QueryCount=1
  3281	AnswerCount=0
  3282	AuthorityCount=0
  3283	AddressRecCount=0
  3284	QuestionRecords:
  3285	Name=*               NameType=0x00 (Workstation)
  3286	QuestionType=0x21
  3287	QuestionClass=0x1
       

  3288	 (ttl 109, id 54161, len 78)
  3289	18:14:46.803439 172.16.183.8 > 169.254.129.1: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 33025, len 106)
  3290	18:14:46.805063 bc16997.bendcable.com.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
  3291	>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
  3292	TrnID=0x3710
  3293	OpCode=0
  3294	NmFlags=0x1
  3295	Rcode=0
  3296	QueryCount=1
  3297	AnswerCount=0
  3298	AuthorityCount=0
  3299	AddressRecCount=0
  3300	QuestionRecords:
  3301	Name=*               NameType=0x00 (Workstation)
  3302	QuestionType=0x21
  3303	QuestionClass=0x1
       

  3304	 (ttl 109, id 54417, len 78)
  3305	18:14:46.805522 172.16.183.8 > bc16997.bendcable.com: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 36916, len 106)
  3306	18:14:55.845503 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3082617 0,nop,wscale 0> (DF) (ttl 64, id 1559, len 60)
  3307	18:15:43.855399 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3087417 0,nop,wscale 0> (DF) (ttl 64, id 1560, len 60)
  3308	18:17:19.965143 172.16.183.2.1085 > clusterc.icq.com.http: S [tcp sum ok] 307487118:307487118(0) win 32120 <mss 1460,sackOK,timestamp 3097017 0,nop,wscale 0> (DF) (ttl 64, id 1561, len 60)
  3309	18:17:19.982147 clusterc.icq.com.http > 172.16.183.2.1085: S [tcp sum ok] 146018086:146018086(0) ack 307487119 win 65535 <nop,nop,timestamp 26615702 3097017,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 15325, len 64)
  3310	18:17:19.983036 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3097018 26615702> (DF) (ttl 64, id 1562, len 52)
  3311	18:17:20.975499 172.16.183.2.1085 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3097118 26615702> (DF) (ttl 64, id 1563, len 104)
  3312	18:17:20.992252 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 26615803 3097118> (DF) (ttl 240, id 15326, len 52)
  3313	18:17:21.629541 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 26615866 3097118> (DF) (ttl 240, id 15327, len 1500)
  3314	18:17:21.635005 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3097204 26615866> (DF) (ttl 64, id 1564, len 52)
  3315	18:17:21.639650 clusterc.icq.com.http > 172.16.183.2.1085: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 26615866 3097118> (DF) (ttl 240, id 15328, len 1500)
  3316	18:17:21.649586 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3097206 26615866> (DF) (ttl 64, id 1565, len 52)
  3317	18:17:21.661565 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 26615869 3097204> (DF) (ttl 240, id 15329, len 1477)
  3318	18:17:21.671933 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 26615869 3097204> (DF) (ttl 240, id 15330, len 1500)
  3319	18:17:21.679585 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3097209 26615869> (DF) (ttl 64, id 1566, len 52)
  3320	18:17:21.681307 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 26615871 3097206> (DF) (ttl 240, id 15331, len 1500)
  3321	18:17:21.689485 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 26615871 3097206> (DF) (ttl 240, id 15332, len 1252)
  3322	18:17:21.704978 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3097211 26615871> (DF) (ttl 64, id 1567, len 52)
  3323	18:17:21.708878 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 26615874 3097209> (DF) (ttl 240, id 15333, len 1500)
  3324	18:17:21.718498 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 26615874 3097209> (DF) (ttl 240, id 15334, len 1500)
  3325	18:17:21.719324 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3097212 26615874> (DF) (ttl 64, id 1568, len 52)
  3326	18:17:21.725947 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 26615874 3097209> (DF) (ttl 240, id 15335, len 1252)
  3327	18:17:21.735479 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 26615876 3097211> (DF) (ttl 240, id 15336, len 1500)
  3328	18:17:21.736597 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3097214 26615874> (DF) (ttl 64, id 1569, len 52)
  3329	18:17:21.744629 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 26615876 3097211> (DF) (ttl 240, id 15337, len 1500)
  3330	18:17:21.745646 172.16.183.2.1085 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3097215 26615876> (DF) (ttl 64, id 1570, len 52)
  3331	18:17:21.750291 172.16.183.2.1085 > clusterc.icq.com.http: P [bad tcp cksum df12!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3332	18:17:21.750291 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3097216 26615876> (DF) (ttl 64, id 1571, len 52)
  3333	18:17:21.752320 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 26615876 3097211> (DF) (ttl 240, id 15338, len 1252)
  3334	18:17:21.753098 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1572, len 40)
  3335	18:17:21.761832 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 26615878 3097212> (DF) (ttl 240, id 15339, len 1500)
  3336	18:17:21.762565 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1573, len 40)
  3337	18:17:21.770955 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 26615878 3097212> (DF) (ttl 240, id 15340, len 1500)
  3338	18:17:21.771721 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1574, len 40)
  3339	18:17:21.778398 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 26615878 3097212> (DF) (ttl 240, id 15341, len 1252)
  3340	18:17:21.779184 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1575, len 40)
  3341	18:17:21.787949 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 26615879 3097214> (DF) (ttl 240, id 15342, len 1500)
  3342	18:17:21.788721 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1576, len 40)
  3343	18:17:21.797091 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 26615879 3097214> (DF) (ttl 240, id 15343, len 1500)
  3344	18:17:21.797851 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1577, len 40)
  3345	18:17:21.804783 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 26615880 3097215> (DF) (ttl 240, id 15344, len 1252)
  3346	18:17:21.805682 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1578, len 40)
  3347	18:17:21.813819 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 26615880 3097215> (DF) (ttl 240, id 15345, len 1500)
  3348	18:17:21.814529 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1579, len 40)
  3349	18:17:21.822687 clusterc.icq.com.http > 172.16.183.2.1085: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 26615880 3097215> (DF) (ttl 240, id 15346, len 1500)
  3350	18:17:21.823449 172.16.183.2.1085 > clusterc.icq.com.http: R [tcp sum ok] 307487171:307487171(0) win 0 (ttl 255, id 1580, len 40)
  3351	18:17:23.757764 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50783+ A? web.icq.com. [|domain] (ttl 64, id 1581, len 57)
  3352	18:17:23.772951 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50783 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 50909, len 233)
  3353	18:17:23.774027 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3097417 0,nop,wscale 0> (DF) (ttl 64, id 1582, len 60)
  3354	18:17:26.785296 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3097718 0,nop,wscale 0> (DF) (ttl 64, id 1583, len 60)
  3355	18:17:32.785092 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3098318 0,nop,wscale 0> (DF) (ttl 64, id 1584, len 60)
  3356	18:17:44.775313 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3099518 0,nop,wscale 0> (DF) (ttl 64, id 1585, len 60)
  3357	18:18:08.805099 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3101918 0,nop,wscale 0> (DF) (ttl 64, id 1586, len 60)
  3358	18:18:56.795168 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3106718 0,nop,wscale 0> (DF) (ttl 64, id 1587, len 60)
  3359	18:20:32.785201 172.16.183.2.1086 > clusterb.icq.com.http: S [tcp sum ok] 510585672:510585672(0) win 32120 <mss 1460,sackOK,timestamp 3116318 0,nop,wscale 0> (DF) (ttl 64, id 1588, len 60)
  3360	18:20:32.803388 clusterb.icq.com.http > 172.16.183.2.1086: S [tcp sum ok] 4288862245:4288862245(0) ack 510585673 win 65535 <nop,nop,timestamp 503432981 3116318,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 50899, len 64)
  3361	18:20:32.803774 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3116319 503432981> (DF) (ttl 64, id 1589, len 52)
  3362	18:20:33.795424 172.16.183.2.1086 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3116419 503432981> (DF) (ttl 64, id 1590, len 104)
  3363	18:20:33.861812 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 503433087 3116419> (DF) (ttl 240, id 50900, len 52)
  3364	18:20:34.459697 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 503433146 3116419> (DF) (ttl 240, id 50901, len 1500)
  3365	18:20:34.460466 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3116493 503433146> (DF) (ttl 64, id 1591, len 52)
  3366	18:20:34.470537 clusterb.icq.com.http > 172.16.183.2.1086: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 503433146 3116419> (DF) (ttl 240, id 50902, len 1500)
  3367	18:20:34.477865 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3116495 503433146> (DF) (ttl 64, id 1592, len 52)
  3368	18:20:34.490237 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 503433149 3116493> (DF) (ttl 240, id 50903, len 1477)
  3369	18:20:34.500605 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 503433149 3116493> (DF) (ttl 240, id 50904, len 1500)
  3370	18:20:34.507874 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3116498 503433149> (DF) (ttl 64, id 1593, len 52)
  3371	18:20:34.510205 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 503433150 3116495> (DF) (ttl 240, id 50905, len 1500)
  3372	18:20:34.518627 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 503433150 3116495> (DF) (ttl 240, id 50906, len 1252)
  3373	18:20:34.525036 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3116500 503433150> (DF) (ttl 64, id 1594, len 52)
  3374	18:20:34.536570 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 503433153 3116498> (DF) (ttl 240, id 50907, len 1500)
  3375	18:20:34.546418 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 503433153 3116498> (DF) (ttl 240, id 50908, len 1500)
  3376	18:20:34.547141 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3116501 503433153> (DF) (ttl 64, id 1595, len 52)
  3377	18:20:34.554607 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 503433153 3116498> (DF) (ttl 240, id 50909, len 1252)
  3378	18:20:34.564878 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 503433155 3116500> (DF) (ttl 240, id 50910, len 1500)
  3379	18:20:34.565744 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3116504 503433153> (DF) (ttl 64, id 1596, len 52)
  3380	18:20:34.574013 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 503433155 3116500> (DF) (ttl 240, id 50911, len 1500)
  3381	18:20:34.574983 172.16.183.2.1086 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3116504 503433155> (DF) (ttl 64, id 1597, len 52)
  3382	18:20:34.579532 172.16.183.2.1086 > clusterb.icq.com.http: P [bad tcp cksum 433c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3383	18:20:34.579532 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3116505 503433155> (DF) (ttl 64, id 1598, len 52)
  3384	18:20:34.582018 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 503433155 3116500> (DF) (ttl 240, id 50912, len 1252)
  3385	18:20:34.582737 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1599, len 40)
  3386	18:20:34.591489 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 503433157 3116501> (DF) (ttl 240, id 50913, len 1500)
  3387	18:20:34.592264 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1600, len 40)
  3388	18:20:34.600606 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 503433157 3116501> (DF) (ttl 240, id 50914, len 1500)
  3389	18:20:34.601404 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1601, len 40)
  3390	18:20:34.608040 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 503433157 3116501> (DF) (ttl 240, id 50915, len 1252)
  3391	18:20:34.608812 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1602, len 40)
  3392	18:20:34.617367 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 503433159 3116504> (DF) (ttl 240, id 50916, len 1500)
  3393	18:20:34.618149 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1603, len 40)
  3394	18:20:34.626719 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 503433159 3116504> (DF) (ttl 240, id 50917, len 1500)
  3395	18:20:34.627456 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1604, len 40)
  3396	18:20:34.634154 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 503433160 3116504> (DF) (ttl 240, id 50918, len 1252)
  3397	18:20:34.635113 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1605, len 40)
  3398	18:20:34.643468 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 503433160 3116504> (DF) (ttl 240, id 50919, len 1500)
  3399	18:20:34.644230 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1606, len 40)
  3400	18:20:34.653079 clusterb.icq.com.http > 172.16.183.2.1086: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 503433160 3116504> (DF) (ttl 240, id 50920, len 1500)
  3401	18:20:34.653888 172.16.183.2.1086 > clusterb.icq.com.http: R [tcp sum ok] 510585725:510585725(0) win 0 (ttl 255, id 1607, len 40)
  3402	18:20:36.587290 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50784+ A? web.icq.com. [|domain] (ttl 64, id 1608, len 57)
  3403	18:20:36.599150 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50784 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 60455, len 233)
  3404	18:20:36.600349 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3116706 0,nop,wscale 0> (DF) (ttl 64, id 1609, len 60)
  3405	18:20:39.605138 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3117007 0,nop,wscale 0> (DF) (ttl 64, id 1610, len 60)
  3406	18:20:45.675130 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3117607 0,nop,wscale 0> (DF) (ttl 64, id 1611, len 60)
  3407	18:20:57.675097 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3118807 0,nop,wscale 0> (DF) (ttl 64, id 1612, len 60)
  3408	18:21:21.746814 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3121207 0,nop,wscale 0> (DF) (ttl 64, id 1613, len 60)
  3409	18:22:09.785108 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3126007 0,nop,wscale 0> (DF) (ttl 64, id 1614, len 60)
  3410	18:23:45.765227 172.16.183.2.1087 > clustera.icq.com.http: S [tcp sum ok] 697738333:697738333(0) win 32120 <mss 1460,sackOK,timestamp 3135607 0,nop,wscale 0> (DF) (ttl 64, id 1615, len 60)
  3411	18:23:45.781616 clustera.icq.com.http > 172.16.183.2.1087: S [tcp sum ok] 547274107:547274107(0) ack 697738334 win 24616 <nop,nop,timestamp 253245837 3135607,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 16259, len 64)
  3412	18:23:45.782539 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3135608 253245837> (DF) (ttl 64, id 1616, len 52)
  3413	18:23:46.775583 172.16.183.2.1087 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3135708 253245837> (DF) (ttl 64, id 1617, len 104)
  3414	18:23:46.852097 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 253245944 3135708> (DF) (ttl 49, id 16260, len 52)
  3415	18:23:47.439873 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 253246002 3135708> (DF) (ttl 49, id 16261, len 1500)
  3416	18:23:47.440608 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3135797 253246002> (DF) (ttl 64, id 1618, len 52)
  3417	18:23:47.450959 clustera.icq.com.http > 172.16.183.2.1087: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 253246002 3135708> (DF) (ttl 49, id 16262, len 1500)
  3418	18:23:47.454989 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3135799 253246002> (DF) (ttl 64, id 1619, len 52)
  3419	18:23:47.461532 clustera.icq.com.http > 172.16.183.2.1087: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 253246002 3135708> (DF) (ttl 49, id 16263, len 1477)
  3420	18:23:47.466145 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3135800 253246002> (DF) (ttl 64, id 1620, len 52)
  3421	18:23:47.471168 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 253246005 3135797> (DF) (ttl 49, id 16264, len 1500)
  3422	18:23:47.476156 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3135801 253246005> (DF) (ttl 64, id 1621, len 52)
  3423	18:23:47.481513 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 253246005 3135797> (DF) (ttl 49, id 16265, len 1500)
  3424	18:23:47.486142 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3135802 253246005> (DF) (ttl 64, id 1622, len 52)
  3425	18:23:47.489444 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 253246006 3135799> (DF) (ttl 49, id 16266, len 1252)
  3426	18:23:47.496145 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3135803 253246006> (DF) (ttl 64, id 1623, len 52)
  3427	18:23:47.499745 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 253246006 3135799> (DF) (ttl 49, id 16267, len 1500)
  3428	18:23:47.506156 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3135804 253246006> (DF) (ttl 64, id 1624, len 52)
  3429	18:23:47.509604 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 253246007 3135800> (DF) (ttl 49, id 16268, len 1500)
  3430	18:23:47.514986 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3135805 253246007> (DF) (ttl 64, id 1625, len 52)
  3431	18:23:47.517770 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 253246007 3135800> (DF) (ttl 49, id 16269, len 1252)
  3432	18:23:47.528079 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 253246008 3135801> (DF) (ttl 49, id 16270, len 1500)
  3433	18:23:47.536161 172.16.183.2.1087 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3135807 253246007> (DF) (ttl 64, id 1626, len 52)
  3434	18:23:47.538776 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 253246008 3135801> (DF) (ttl 49, id 16271, len 1500)
  3435	18:23:47.542738 172.16.183.2.1087 > clustera.icq.com.http: P [bad tcp cksum d371!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3436	18:23:47.542738 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3135807 253246008> (DF) (ttl 64, id 1627, len 52)
  3437	18:23:47.546338 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 253246009 3135802> (DF) (ttl 49, id 16272, len 1252)
  3438	18:23:47.547129 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1628, len 40)
  3439	18:23:47.555925 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 253246009 3135802> (DF) (ttl 49, id 16273, len 1500)
  3440	18:23:47.556710 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1629, len 40)
  3441	18:23:47.565262 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 253246010 3135803> (DF) (ttl 49, id 16274, len 1500)
  3442	18:23:47.566016 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1630, len 40)
  3443	18:23:47.572944 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 253246010 3135803> (DF) (ttl 49, id 16275, len 1252)
  3444	18:23:47.573613 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1631, len 40)
  3445	18:23:47.582022 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 253246011 3135804> (DF) (ttl 49, id 16276, len 1500)
  3446	18:23:47.582725 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1632, len 40)
  3447	18:23:47.591378 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 253246011 3135804> (DF) (ttl 49, id 16277, len 1500)
  3448	18:23:47.592183 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1633, len 40)
  3449	18:23:47.599066 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 253246012 3135805> (DF) (ttl 49, id 16278, len 1252)
  3450	18:23:47.599747 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1634, len 40)
  3451	18:23:47.608405 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 253246012 3135805> (DF) (ttl 49, id 16279, len 1500)
  3452	18:23:47.610718 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1635, len 40)
  3453	18:23:47.617991 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 253246015 3135807> (DF) (ttl 49, id 16280, len 1500)
  3454	18:23:47.618770 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1636, len 40)
  3455	18:23:47.625179 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 27698:28898(1200) ack 53 win 24616 <nop,nop,timestamp 253246015 3135807> (DF) (ttl 49, id 16281, len 1252)
  3456	18:23:47.625904 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1637, len 40)
  3457	18:23:47.634774 clustera.icq.com.http > 172.16.183.2.1087: . [tcp sum ok] 28898:30346(1448) ack 53 win 24616 <nop,nop,timestamp 253246015 3135807> (DF) (ttl 49, id 16282, len 1500)
  3458	18:23:47.635648 172.16.183.2.1087 > clustera.icq.com.http: R [tcp sum ok] 697738386:697738386(0) win 0 (ttl 255, id 1638, len 40)
  3459	18:23:49.556830 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50785+ A? web.icq.com. [|domain] (ttl 64, id 1639, len 57)
  3460	18:23:49.571452 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50785 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 5289, len 233)
  3461	18:23:49.572640 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3136009 0,nop,wscale 0> (DF) (ttl 64, id 1640, len 60)
  3462	18:23:52.584867 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3136310 0,nop,wscale 0> (DF) (ttl 64, id 1641, len 60)
  3463	18:23:58.565331 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3136910 0,nop,wscale 0> (DF) (ttl 64, id 1642, len 60)
  3464	18:24:10.565208 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3138110 0,nop,wscale 0> (DF) (ttl 64, id 1643, len 60)
  3465	18:24:34.595158 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3140510 0,nop,wscale 0> (DF) (ttl 64, id 1644, len 60)
  3466	18:25:22.585070 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3145310 0,nop,wscale 0> (DF) (ttl 64, id 1645, len 60)
  3467	18:26:58.695399 172.16.183.2.1088 > clusterc.icq.com.http: S [tcp sum ok] 932405570:932405570(0) win 32120 <mss 1460,sackOK,timestamp 3154910 0,nop,wscale 0> (DF) (ttl 64, id 1646, len 60)
  3468	18:26:58.712523 clusterc.icq.com.http > 172.16.183.2.1088: S [tcp sum ok] 59201742:59201742(0) ack 932405571 win 33304 <nop,nop,timestamp 215560472 3154910,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 60145, len 64)
  3469	18:26:58.713437 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3154911 215560472> (DF) (ttl 64, id 1647, len 52)
  3470	18:26:59.705546 172.16.183.2.1088 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3155011 215560472> (DF) (ttl 64, id 1648, len 104)
  3471	18:26:59.725842 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215560573 3155011> (DF) (ttl 49, id 60146, len 52)
  3472	18:27:00.888673 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215560688 3155011> (DF) (ttl 49, id 60147, len 1500)
  3473	18:27:00.889491 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3155130 215560688> (DF) (ttl 64, id 1649, len 52)
  3474	18:27:00.909112 clusterc.icq.com.http > 172.16.183.2.1088: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215560688 3155011> (DF) (ttl 49, id 60148, len 1500)
  3475	18:27:00.924435 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3155134 215560688> (DF) (ttl 64, id 1650, len 52)
  3476	18:27:00.926100 clusterc.icq.com.http > 172.16.183.2.1088: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215560688 3155011> (DF) (ttl 49, id 60149, len 1477)
  3477	18:27:00.943607 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215560692 3155130> (DF) (ttl 49, id 60150, len 1500)
  3478	18:27:00.954402 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3155137 215560688> (DF) (ttl 64, id 1651, len 52)
  3479	18:27:00.960605 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215560692 3155130> (DF) (ttl 49, id 60151, len 1500)
  3480	18:27:00.974415 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3155139 215560692> (DF) (ttl 64, id 1652, len 52)
  3481	18:27:00.975207 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215560695 3155134> (DF) (ttl 49, id 60152, len 1252)
  3482	18:27:00.992640 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215560695 3155134> (DF) (ttl 49, id 60153, len 1500)
  3483	18:27:00.994416 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3155142 215560695> (DF) (ttl 64, id 1653, len 52)
  3484	18:27:01.008896 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215560698 3155137> (DF) (ttl 49, id 60154, len 1500)
  3485	18:27:01.021508 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215560698 3155137> (DF) (ttl 49, id 60155, len 1252)
  3486	18:27:01.034422 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3155146 215560698> (DF) (ttl 64, id 1654, len 52)
  3487	18:27:01.036744 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215560698 3155137> (DF) (ttl 49, id 60156, len 1500)
  3488	18:27:01.052011 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215560700 3155139> (DF) (ttl 49, id 60157, len 1500)
  3489	18:27:01.052808 172.16.183.2.1088 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3155148 215560698> (DF) (ttl 64, id 1655, len 52)
  3490	18:27:01.055546 172.16.183.2.1088 > clusterc.icq.com.http: P [bad tcp cksum 7428!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3491	18:27:01.055546 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3155149 215560698> (DF) (ttl 64, id 1656, len 52)
  3492	18:27:01.064366 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215560700 3155139> (DF) (ttl 49, id 60158, len 1252)
  3493	18:27:01.065371 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1657, len 40)
  3494	18:27:01.079584 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215560702 3155142> (DF) (ttl 49, id 60159, len 1500)
  3495	18:27:01.080374 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1658, len 40)
  3496	18:27:01.094627 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215560702 3155142> (DF) (ttl 49, id 60160, len 1500)
  3497	18:27:01.095590 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1659, len 40)
  3498	18:27:01.106246 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215560702 3155142> (DF) (ttl 49, id 60161, len 1252)
  3499	18:27:01.106971 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1660, len 40)
  3500	18:27:01.119750 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215560706 3155146> (DF) (ttl 49, id 60162, len 1500)
  3501	18:27:01.120471 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1661, len 40)
  3502	18:27:01.133048 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215560706 3155146> (DF) (ttl 49, id 60163, len 1500)
  3503	18:27:01.133828 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1662, len 40)
  3504	18:27:01.144425 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215560706 3155146> (DF) (ttl 49, id 60164, len 1252)
  3505	18:27:01.145361 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1663, len 40)
  3506	18:27:01.157953 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215560708 3155148> (DF) (ttl 49, id 60165, len 1500)
  3507	18:27:01.158661 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1664, len 40)
  3508	18:27:01.171230 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 215560708 3155148> (DF) (ttl 49, id 60166, len 1500)
  3509	18:27:01.171952 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1665, len 40)
  3510	18:27:01.182129 clusterc.icq.com.http > 172.16.183.2.1088: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 215560708 3155148> (DF) (ttl 49, id 60167, len 1252)
  3511	18:27:01.182831 172.16.183.2.1088 > clusterc.icq.com.http: R [tcp sum ok] 932405623:932405623(0) win 0 (ttl 255, id 1666, len 40)
  3512	18:27:03.076942 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50786+ A? web.icq.com. [|domain] (ttl 64, id 1667, len 57)
  3513	18:27:06.812917 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50786 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 15849, len 244)
  3514	18:27:06.816225 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3155722 0,nop,wscale 0> (DF) (ttl 64, id 1668, len 60)
  3515	18:27:09.805294 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3156022 0,nop,wscale 0> (DF) (ttl 64, id 1669, len 60)
  3516	18:27:15.795420 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3156622 0,nop,wscale 0> (DF) (ttl 64, id 1670, len 60)
  3517	18:27:27.795282 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3157822 0,nop,wscale 0> (DF) (ttl 64, id 1671, len 60)
  3518	18:27:51.815274 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3160222 0,nop,wscale 0> (DF) (ttl 64, id 1672, len 60)
  3519	18:28:39.815244 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3165022 0,nop,wscale 0> (DF) (ttl 64, id 1673, len 60)
  3520	18:30:15.795148 172.16.183.2.1089 > clusterb.icq.com.http: S [tcp sum ok] 1131872951:1131872951(0) win 32120 <mss 1460,sackOK,timestamp 3174622 0,nop,wscale 0> (DF) (ttl 64, id 1674, len 60)
  3521	18:30:15.812821 clusterb.icq.com.http > 172.16.183.2.1089: S [tcp sum ok] 2079836530:2079836530(0) ack 1131872952 win 65535 <nop,nop,timestamp 502062069 3174622,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 38803, len 64)
  3522	18:30:15.813669 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3174623 502062069> (DF) (ttl 64, id 1675, len 52)
  3523	18:30:16.805648 172.16.183.2.1089 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3174723 502062069> (DF) (ttl 64, id 1676, len 104)
  3524	18:30:16.824889 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502062170 3174723> (DF) (ttl 240, id 38804, len 52)
  3525	18:30:17.720407 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502062258 3174723> (DF) (ttl 240, id 38805, len 1500)
  3526	18:30:17.721274 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3174838 502062258> (DF) (ttl 64, id 1677, len 52)
  3527	18:30:17.738391 clusterb.icq.com.http > 172.16.183.2.1089: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502062258 3174723> (DF) (ttl 240, id 38806, len 1500)
  3528	18:30:17.742683 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3174840 502062258> (DF) (ttl 64, id 1678, len 52)
  3529	18:30:17.755852 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502062262 3174838> (DF) (ttl 240, id 38807, len 1477)
  3530	18:30:17.772659 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3174843 502062262> (DF) (ttl 64, id 1679, len 52)
  3531	18:30:17.772853 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502062262 3174838> (DF) (ttl 240, id 38808, len 1500)
  3532	18:30:17.790373 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502062264 3174840> (DF) (ttl 240, id 38809, len 1500)
  3533	18:30:17.791117 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3174844 502062262> (DF) (ttl 64, id 1680, len 52)
  3534	18:30:17.803722 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502062264 3174840> (DF) (ttl 240, id 38810, len 1252)
  3535	18:30:17.818960 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502062267 3174843> (DF) (ttl 240, id 38811, len 1500)
  3536	18:30:17.832658 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3174849 502062264> (DF) (ttl 64, id 1681, len 52)
  3537	18:30:17.833974 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502062267 3174843> (DF) (ttl 240, id 38812, len 1500)
  3538	18:30:17.847340 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502062269 3174844> (DF) (ttl 240, id 38813, len 1252)
  3539	18:30:17.862311 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502062269 3174844> (DF) (ttl 240, id 38814, len 1500)
  3540	18:30:17.863104 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3174852 502062267> (DF) (ttl 64, id 1682, len 52)
  3541	18:30:17.877377 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502062269 3174844> (DF) (ttl 240, id 38815, len 1500)
  3542	18:30:17.878096 172.16.183.2.1089 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3174853 502062269> (DF) (ttl 64, id 1683, len 52)
  3543	18:30:17.880508 172.16.183.2.1089 > clusterb.icq.com.http: P [bad tcp cksum 2492!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3544	18:30:17.880508 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3174853 502062269> (DF) (ttl 64, id 1684, len 52)
  3545	18:30:17.889934 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502062273 3174849> (DF) (ttl 240, id 38816, len 1252)
  3546	18:30:17.890695 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1685, len 40)
  3547	18:30:17.904416 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502062273 3174849> (DF) (ttl 240, id 38817, len 1500)
  3548	18:30:17.905422 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1686, len 40)
  3549	18:30:17.917729 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502062273 3174849> (DF) (ttl 240, id 38818, len 1500)
  3550	18:30:17.918432 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1687, len 40)
  3551	18:30:17.928620 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502062276 3174852> (DF) (ttl 240, id 38819, len 1252)
  3552	18:30:17.929431 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1688, len 40)
  3553	18:30:17.942365 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502062276 3174852> (DF) (ttl 240, id 38820, len 1500)
  3554	18:30:17.943115 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1689, len 40)
  3555	18:30:17.955670 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502062276 3174852> (DF) (ttl 240, id 38821, len 1500)
  3556	18:30:17.956513 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1690, len 40)
  3557	18:30:17.966827 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502062277 3174853> (DF) (ttl 240, id 38822, len 1252)
  3558	18:30:17.967593 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1691, len 40)
  3559	18:30:17.980309 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502062277 3174853> (DF) (ttl 240, id 38823, len 1500)
  3560	18:30:17.981062 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1692, len 40)
  3561	18:30:17.993377 clusterb.icq.com.http > 172.16.183.2.1089: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 502062277 3174853> (DF) (ttl 240, id 38824, len 1500)
  3562	18:30:17.994233 172.16.183.2.1089 > clusterb.icq.com.http: R [tcp sum ok] 1131873004:1131873004(0) win 0 (ttl 255, id 1693, len 40)
  3563	18:30:19.887312 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50787+ A? web.icq.com. [|domain] (ttl 64, id 1694, len 57)
  3564	18:30:19.899522 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50787 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 25884, len 233)
  3565	18:30:19.900602 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3175055 0,nop,wscale 0> (DF) (ttl 64, id 1695, len 60)
  3566	18:30:22.904970 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3175355 0,nop,wscale 0> (DF) (ttl 64, id 1696, len 60)
  3567	18:30:28.895217 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3175955 0,nop,wscale 0> (DF) (ttl 64, id 1697, len 60)
  3568	18:30:40.885270 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3177155 0,nop,wscale 0> (DF) (ttl 64, id 1698, len 60)
  3569	18:31:04.975079 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3179555 0,nop,wscale 0> (DF) (ttl 64, id 1699, len 60)
  3570	18:31:53.105296 172.16.183.2.1090 > clusterb.icq.com.http: S [tcp sum ok] 1336733435:1336733435(0) win 32120 <mss 1460,sackOK,timestamp 3184355 0,nop,wscale 0> (DF) (ttl 64, id 1700, len 60)
  3571	18:31:53.125651 clusterb.icq.com.http > 172.16.183.2.1090: S [tcp sum ok] 682378409:682378409(0) ack 1336733436 win 33304 <nop,nop,timestamp 139660513 3184355,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 32971, len 64)
  3572	18:31:53.126325 172.16.183.2.1090 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3184357 139660513> (DF) (ttl 64, id 1701, len 52)
  3573	18:31:54.125679 172.16.183.2.1090 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3184457 139660513> (DF) (ttl 64, id 1702, len 104)
  3574	18:31:54.144876 clusterb.icq.com.http > 172.16.183.2.1090: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 139660615 3184457> (DF) (ttl 49, id 32972, len 52)
  3575	18:31:54.408542 clusterb.icq.com.http > 172.16.183.2.1090: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 139660641 3184457> (DF) (ttl 49, id 32973, len 391)
  3576	18:31:54.409265 172.16.183.2.1090 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 3184501 139660641> (DF) (ttl 64, id 1703, len 52)
  3577	18:31:54.409740 clusterb.icq.com.http > 172.16.183.2.1090: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 139660641 3184457> (DF) (ttl 49, id 32974, len 52)
  3578	18:31:54.410166 172.16.183.2.1090 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 3184501 139660641> (DF) (ttl 64, id 1704, len 52)
  3579	18:32:19.521626 172.16.183.2.1090 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 3187022 139660641> (DF) (ttl 64, id 1705, len 52)
  3580	18:32:19.539089 172.16.183.2.1090 > clusterb.icq.com.http: P [bad tcp cksum f1a6!] 3640612611:3640612662(51) ack 654355080 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3581	18:32:19.539089 clusterb.icq.com.http > 172.16.183.2.1090: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 139663155 3187022> (DF) (ttl 49, id 32975, len 52)
  3582	18:32:20.527294 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50788+ A? web.icq.com. [|domain] (ttl 64, id 1706, len 57)
  3583	18:32:20.540501 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50788 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 32535, len 233)
  3584	18:32:20.541836 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3187123 0,nop,wscale 0> (DF) (ttl 64, id 1707, len 60)
  3585	18:32:23.535001 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3187423 0,nop,wscale 0> (DF) (ttl 64, id 1708, len 60)
  3586	18:32:29.545267 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3188023 0,nop,wscale 0> (DF) (ttl 64, id 1709, len 60)
  3587	18:32:41.535342 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3189223 0,nop,wscale 0> (DF) (ttl 64, id 1710, len 60)
  3588	18:33:05.535221 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3191623 0,nop,wscale 0> (DF) (ttl 64, id 1711, len 60)
  3589	18:33:53.505353 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3196423 0,nop,wscale 0> (DF) (ttl 64, id 1712, len 60)
  3590	18:35:29.505368 172.16.183.2.1091 > clustera.icq.com.http: S [tcp sum ok] 1454586290:1454586290(0) win 32120 <mss 1460,sackOK,timestamp 3206023 0,nop,wscale 0> (DF) (ttl 64, id 1713, len 60)
  3591	18:35:29.522664 clustera.icq.com.http > 172.16.183.2.1091: S [tcp sum ok] 2124947939:2124947939(0) ack 1454586291 win 65535 <nop,nop,timestamp 201248290 3206023,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 3413, len 64)
  3592	18:35:29.523587 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3206024 201248290> (DF) (ttl 64, id 1714, len 52)
  3593	18:35:30.515610 172.16.183.2.1091 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3206124 201248290> (DF) (ttl 64, id 1715, len 104)
  3594	18:35:30.535982 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 201248392 3206124> (DF) (ttl 240, id 3414, len 52)
  3595	18:35:31.109723 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 201248447 3206124> (DF) (ttl 240, id 3415, len 1500)
  3596	18:35:31.110490 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3206186 201248447> (DF) (ttl 64, id 1716, len 52)
  3597	18:35:31.127703 clustera.icq.com.http > 172.16.183.2.1091: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 201248447 3206124> (DF) (ttl 240, id 3416, len 1500)
  3598	18:35:31.144940 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3206190 201248447> (DF) (ttl 64, id 1717, len 52)
  3599	18:35:31.145428 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 201248451 3206186> (DF) (ttl 240, id 3417, len 1477)
  3600	18:35:31.162699 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 201248451 3206186> (DF) (ttl 240, id 3418, len 1500)
  3601	18:35:31.169870 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3206193 201248451> (DF) (ttl 64, id 1718, len 52)
  3602	18:35:31.179947 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 201248454 3206190> (DF) (ttl 240, id 3419, len 1500)
  3603	18:35:31.193052 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 201248454 3206190> (DF) (ttl 240, id 3420, len 1252)
  3604	18:35:31.208272 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 201248457 3206193> (DF) (ttl 240, id 3421, len 1500)
  3605	18:35:31.209061 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3206196 201248454> (DF) (ttl 64, id 1719, len 52)
  3606	18:35:31.224045 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 201248457 3206193> (DF) (ttl 240, id 3422, len 1500)
  3607	18:35:31.236401 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 201248457 3206193> (DF) (ttl 240, id 3423, len 1252)
  3608	18:35:31.249872 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3206201 201248457> (DF) (ttl 64, id 1720, len 52)
  3609	18:35:31.251874 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 201248461 3206196> (DF) (ttl 240, id 3424, len 1500)
  3610	18:35:31.266669 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 201248461 3206196> (DF) (ttl 240, id 3425, len 1500)
  3611	18:35:31.267381 172.16.183.2.1091 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3206202 201248461> (DF) (ttl 64, id 1721, len 52)
  3612	18:35:31.272013 172.16.183.2.1091 > clustera.icq.com.http: P [bad tcp cksum e7ec!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3613	18:35:31.272013 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3206203 201248461> (DF) (ttl 64, id 1722, len 52)
  3614	18:35:31.279253 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 201248461 3206196> (DF) (ttl 240, id 3426, len 1252)
  3615	18:35:31.280021 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1723, len 40)
  3616	18:35:31.293014 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 201248461 3206196> (DF) (ttl 240, id 3427, len 1500)
  3617	18:35:31.294016 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1724, len 40)
  3618	18:35:31.306567 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 201248465 3206201> (DF) (ttl 240, id 3428, len 1500)
  3619	18:35:31.307293 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1725, len 40)
  3620	18:35:31.318178 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 201248465 3206201> (DF) (ttl 240, id 3429, len 1252)
  3621	18:35:31.318882 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1726, len 40)
  3622	18:35:31.331691 clustera.icq.com.http > 172.16.183.2.1091: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 201248465 3206201> (DF) (ttl 240, id 3430, len 1500)
  3623	18:35:31.332448 172.16.183.2.1091 > clustera.icq.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1727, len 40)
  3624	18:35:31.345049 icq-web-ds06a.websys.aol.com.http > 172.16.183.2.1091: . [tcp sum ok] 2124970093:2124971541(1448) ack 1454586343 win 33304 <nop,nop,timestamp 201248470 3206202> (DF) (ttl 240, id 3431, len 1500)
  3625	18:35:31.348260 172.16.183.2.1091 > icq-web-ds06a.websys.aol.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1728, len 40)
  3626	18:35:31.356162 icq-web-ds06a.websys.aol.com.http > 172.16.183.2.1091: . [tcp sum ok] 1448:2648(1200) ack 1 win 33304 <nop,nop,timestamp 201248470 3206202> (DF) (ttl 240, id 3432, len 1252)
  3627	18:35:31.359215 172.16.183.2.1091 > icq-web-ds06a.websys.aol.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1729, len 40)
  3628	18:35:31.369418 icq-web-ds06a.websys.aol.com.http > 172.16.183.2.1091: . [tcp sum ok] 2648:4096(1448) ack 1 win 33304 <nop,nop,timestamp 201248470 3206202> (DF) (ttl 240, id 3433, len 1500)
  3629	18:35:31.372539 172.16.183.2.1091 > icq-web-ds06a.websys.aol.com.http: R [tcp sum ok] 1454586343:1454586343(0) win 0 (ttl 255, id 1730, len 40)
  3630	18:35:33.277110 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50789+ A? web.icq.com. [|domain] (ttl 64, id 1731, len 57)
  3631	18:35:33.289579 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50789 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 42025, len 233)
  3632	18:35:33.290918 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3206404 0,nop,wscale 0> (DF) (ttl 64, id 1732, len 60)
  3633	18:35:36.305285 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3206705 0,nop,wscale 0> (DF) (ttl 64, id 1733, len 60)
  3634	18:35:42.295368 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3207305 0,nop,wscale 0> (DF) (ttl 64, id 1734, len 60)
  3635	18:35:54.375194 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3208505 0,nop,wscale 0> (DF) (ttl 64, id 1735, len 60)
  3636	18:36:18.445360 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3210905 0,nop,wscale 0> (DF) (ttl 64, id 1736, len 60)
  3637	18:37:06.505106 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3215705 0,nop,wscale 0> (DF) (ttl 64, id 1737, len 60)
  3638	18:38:42.485313 172.16.183.2.1092 > clusterc.icq.com.http: S [tcp sum ok] 1672552114:1672552114(0) win 32120 <mss 1460,sackOK,timestamp 3225305 0,nop,wscale 0> (DF) (ttl 64, id 1738, len 60)
  3639	18:38:42.502841 clusterc.icq.com.http > 172.16.183.2.1092: S [tcp sum ok] 73814487:73814487(0) ack 1672552115 win 65535 <nop,nop,timestamp 502267714 3225305,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 63637, len 64)
  3640	18:38:42.503522 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3225306 502267714> (DF) (ttl 64, id 1739, len 52)
  3641	18:38:43.495442 172.16.183.2.1092 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3225406 502267714> (DF) (ttl 64, id 1740, len 104)
  3642	18:38:43.615704 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502267826 3225406> (DF) (ttl 240, id 63638, len 52)
  3643	18:38:44.139919 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502267876 3225406> (DF) (ttl 240, id 63639, len 1500)
  3644	18:38:44.140674 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3225496 502267876> (DF) (ttl 64, id 1741, len 52)
  3645	18:38:44.160364 clusterc.icq.com.http > 172.16.183.2.1092: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502267876 3225406> (DF) (ttl 240, id 63640, len 1500)
  3646	18:38:44.175002 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3225500 502267876> (DF) (ttl 64, id 1742, len 52)
  3647	18:38:44.177842 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502267880 3225496> (DF) (ttl 240, id 63641, len 1477)
  3648	18:38:44.194850 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502267880 3225496> (DF) (ttl 240, id 63642, len 1500)
  3649	18:38:44.208152 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3225503 502267880> (DF) (ttl 64, id 1743, len 52)
  3650	18:38:44.212089 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502267883 3225500> (DF) (ttl 240, id 63643, len 1500)
  3651	18:38:44.224949 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3225505 502267883> (DF) (ttl 64, id 1744, len 52)
  3652	18:38:44.226468 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502267883 3225500> (DF) (ttl 240, id 63644, len 1252)
  3653	18:38:44.244127 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502267887 3225503> (DF) (ttl 240, id 63645, len 1500)
  3654	18:38:44.258150 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3225508 502267883> (DF) (ttl 64, id 1745, len 52)
  3655	18:38:44.259888 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502267887 3225503> (DF) (ttl 240, id 63646, len 1500)
  3656	18:38:44.272998 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502267887 3225503> (DF) (ttl 240, id 63647, len 1252)
  3657	18:38:44.278150 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3225510 502267887> (DF) (ttl 64, id 1746, len 52)
  3658	18:38:44.288233 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502267888 3225505> (DF) (ttl 240, id 63648, len 1500)
  3659	18:38:44.303022 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502267888 3225505> (DF) (ttl 240, id 63649, len 1500)
  3660	18:38:44.303763 172.16.183.2.1092 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3225512 502267888> (DF) (ttl 64, id 1747, len 52)
  3661	18:38:44.308520 172.16.183.2.1092 > clusterc.icq.com.http: P [bad tcp cksum f644!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3662	18:38:44.308520 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3225513 502267888> (DF) (ttl 64, id 1748, len 52)
  3663	18:38:44.315612 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502267892 3225508> (DF) (ttl 240, id 63650, len 1252)
  3664	18:38:44.316354 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1749, len 40)
  3665	18:38:44.331080 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502267892 3225508> (DF) (ttl 240, id 63651, len 1500)
  3666	18:38:44.331875 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1750, len 40)
  3667	18:38:44.345865 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502267892 3225508> (DF) (ttl 240, id 63652, len 1500)
  3668	18:38:44.346631 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1751, len 40)
  3669	18:38:44.356764 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502267894 3225510> (DF) (ttl 240, id 63653, len 1252)
  3670	18:38:44.357496 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1752, len 40)
  3671	18:38:44.370996 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502267894 3225510> (DF) (ttl 240, id 63654, len 1500)
  3672	18:38:44.371760 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1753, len 40)
  3673	18:38:44.384302 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502267894 3225510> (DF) (ttl 240, id 63655, len 1500)
  3674	18:38:44.385253 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1754, len 40)
  3675	18:38:44.395210 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502267896 3225512> (DF) (ttl 240, id 63656, len 1252)
  3676	18:38:44.395989 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1755, len 40)
  3677	18:38:44.408695 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502267896 3225512> (DF) (ttl 240, id 63657, len 1500)
  3678	18:38:44.409439 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1756, len 40)
  3679	18:38:44.421993 clusterc.icq.com.http > 172.16.183.2.1092: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 502267896 3225512> (DF) (ttl 240, id 63658, len 1500)
  3680	18:38:44.422763 172.16.183.2.1092 > clusterc.icq.com.http: R [tcp sum ok] 1672552167:1672552167(0) win 0 (ttl 255, id 1757, len 40)
  3681	18:38:46.317309 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50790+ A? web.icq.com. [|domain] (ttl 64, id 1758, len 57)
  3682	18:38:49.805495 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50790 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 52350, len 244)
  3683	18:38:49.808524 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3226062 0,nop,wscale 0> (DF) (ttl 64, id 1759, len 60)
  3684	18:38:52.805108 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3226362 0,nop,wscale 0> (DF) (ttl 64, id 1760, len 60)
  3685	18:38:58.805217 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3226962 0,nop,wscale 0> (DF) (ttl 64, id 1761, len 60)
  3686	18:39:10.805174 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3228162 0,nop,wscale 0> (DF) (ttl 64, id 1762, len 60)
  3687	18:39:34.835146 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3230562 0,nop,wscale 0> (DF) (ttl 64, id 1763, len 60)
  3688	18:40:22.815114 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3235362 0,nop,wscale 0> (DF) (ttl 64, id 1764, len 60)
  3689	18:41:58.875290 172.16.183.2.1093 > clusterc.icq.com.http: S [tcp sum ok] 1870282731:1870282731(0) win 32120 <mss 1460,sackOK,timestamp 3244962 0,nop,wscale 0> (DF) (ttl 64, id 1765, len 60)
  3690	18:41:58.891325 clusterc.icq.com.http > 172.16.183.2.1093: S [tcp sum ok] 3193940589:3193940589(0) ack 1870282732 win 65535 <nop,nop,timestamp 502287354 3244962,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 63429, len 64)
  3691	18:41:58.892025 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3244963 502287354> (DF) (ttl 64, id 1766, len 52)
  3692	18:41:59.885560 172.16.183.2.1093 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3245063 502287354> (DF) (ttl 64, id 1767, len 104)
  3693	18:41:59.903679 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502287455 3245063> (DF) (ttl 240, id 63430, len 52)
  3694	18:42:00.549612 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502287518 3245063> (DF) (ttl 240, id 63431, len 1500)
  3695	18:42:00.550498 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3245143 502287518> (DF) (ttl 64, id 1768, len 52)
  3696	18:42:00.567101 clusterc.icq.com.http > 172.16.183.2.1093: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502287518 3245063> (DF) (ttl 240, id 63432, len 1500)
  3697	18:42:00.584334 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502287521 3245143> (DF) (ttl 240, id 63433, len 1477)
  3698	18:42:00.585388 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3245147 502287518> (DF) (ttl 64, id 1769, len 52)
  3699	18:42:00.599137 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502287521 3245143> (DF) (ttl 240, id 63434, len 1500)
  3700	18:42:00.614911 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3245150 502287521> (DF) (ttl 64, id 1770, len 52)
  3701	18:42:00.617112 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502287525 3245147> (DF) (ttl 240, id 63435, len 1500)
  3702	18:42:00.629724 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502287525 3245147> (DF) (ttl 240, id 63436, len 1252)
  3703	18:42:00.644942 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3245153 502287525> (DF) (ttl 64, id 1771, len 52)
  3704	18:42:00.646928 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502287528 3245150> (DF) (ttl 240, id 63437, len 1500)
  3705	18:42:00.662205 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502287528 3245150> (DF) (ttl 240, id 63438, len 1500)
  3706	18:42:00.662986 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3245155 502287528> (DF) (ttl 64, id 1772, len 52)
  3707	18:42:00.673082 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502287528 3245150> (DF) (ttl 240, id 63439, len 1252)
  3708	18:42:00.686593 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502287531 3245153> (DF) (ttl 240, id 63440, len 1500)
  3709	18:42:00.696397 172.16.183.2.1093 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3245158 502287528> (DF) (ttl 64, id 1773, len 52)
  3710	18:42:00.699899 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502287531 3245153> (DF) (ttl 240, id 63441, len 1500)
  3711	18:42:00.704566 172.16.183.2.1093 > clusterc.icq.com.http: P [bad tcp cksum 6205!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3712	18:42:00.704566 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3245158 502287531> (DF) (ttl 64, id 1774, len 52)
  3713	18:42:00.711019 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502287531 3245153> (DF) (ttl 240, id 63442, len 1252)
  3714	18:42:00.711775 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1775, len 40)
  3715	18:42:00.724521 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502287532 3245155> (DF) (ttl 240, id 63443, len 1500)
  3716	18:42:00.725528 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1776, len 40)
  3717	18:42:00.737834 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502287532 3245155> (DF) (ttl 240, id 63444, len 1500)
  3718	18:42:00.738593 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1777, len 40)
  3719	18:42:00.749205 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502287532 3245155> (DF) (ttl 240, id 63445, len 1252)
  3720	18:42:00.749899 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1778, len 40)
  3721	18:42:00.762209 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502287536 3245158> (DF) (ttl 240, id 63446, len 1500)
  3722	18:42:00.762960 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1779, len 40)
  3723	18:42:00.774036 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502287536 3245158> (DF) (ttl 240, id 63447, len 1500)
  3724	18:42:00.774995 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1780, len 40)
  3725	18:42:00.783945 clusterc.icq.com.http > 172.16.183.2.1093: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502287536 3245158> (DF) (ttl 240, id 63448, len 1252)
  3726	18:42:00.784939 172.16.183.2.1093 > clusterc.icq.com.http: R [tcp sum ok] 1870282784:1870282784(0) win 0 (ttl 255, id 1781, len 40)
  3727	18:42:02.726953 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50791+ A? web.icq.com. [|domain] (ttl 64, id 1782, len 57)
  3728	18:42:02.747955 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50791* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 61931, len 233)
  3729	18:42:02.749251 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3245361 0,nop,wscale 0> (DF) (ttl 64, id 1783, len 60)
  3730	18:42:05.755308 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3245662 0,nop,wscale 0> (DF) (ttl 64, id 1784, len 60)
  3731	18:42:11.754981 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3246262 0,nop,wscale 0> (DF) (ttl 64, id 1785, len 60)
  3732	18:42:23.775523 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3247462 0,nop,wscale 0> (DF) (ttl 64, id 1786, len 60)
  3733	18:42:47.815317 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3249862 0,nop,wscale 0> (DF) (ttl 64, id 1787, len 60)
  3734	18:43:41.275170 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3254662 0,nop,wscale 0> (DF) (ttl 64, id 1788, len 60)
  3735	18:45:17.835504 172.16.183.2.1094 > clustera.icq.com.http: S [tcp sum ok] 2070051950:2070051950(0) win 32120 <mss 1460,sackOK,timestamp 3264262 0,nop,wscale 0> (DF) (ttl 64, id 1789, len 60)
  3736	18:45:17.851747 clustera.icq.com.http > 172.16.183.2.1094: S [tcp sum ok] 3486604323:3486604323(0) ack 2070051951 win 33304 <nop,nop,timestamp 17967590 3264262,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 41725, len 64)
  3737	18:45:17.852592 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3264263 17967590> (DF) (ttl 64, id 1790, len 52)
  3738	18:45:18.845536 172.16.183.2.1094 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3264363 17967590> (DF) (ttl 64, id 1791, len 104)
  3739	18:45:18.865066 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17967691 3264363> (DF) (ttl 49, id 41726, len 52)
  3740	18:45:19.589345 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17967762 3264363> (DF) (ttl 49, id 41727, len 1500)
  3741	18:45:19.590097 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3264437 17967762> (DF) (ttl 64, id 1792, len 52)
  3742	18:45:19.604129 clustera.icq.com.http > 172.16.183.2.1094: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17967762 3264363> (DF) (ttl 49, id 41728, len 1500)
  3743	18:45:19.619141 clustera.icq.com.http > 172.16.183.2.1094: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17967762 3264363> (DF) (ttl 49, id 41729, len 1477)
  3744	18:45:19.619947 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3264441 17967762> (DF) (ttl 64, id 1793, len 52)
  3745	18:45:19.634675 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17967766 3264437> (DF) (ttl 49, id 41730, len 1500)
  3746	18:45:19.644924 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3264444 17967762> (DF) (ttl 64, id 1794, len 52)
  3747	18:45:19.649220 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17967766 3264437> (DF) (ttl 49, id 41731, len 1500)
  3748	18:45:19.661827 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17967769 3264441> (DF) (ttl 49, id 41732, len 1252)
  3749	18:45:19.664930 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3264448 17967766> (DF) (ttl 64, id 1795, len 52)
  3750	18:45:19.676807 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17967769 3264441> (DF) (ttl 49, id 41733, len 1500)
  3751	18:45:19.690112 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17967771 3264444> (DF) (ttl 49, id 41734, len 1500)
  3752	18:45:19.690865 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3264450 17967769> (DF) (ttl 64, id 1796, len 52)
  3753	18:45:19.701247 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17967771 3264444> (DF) (ttl 49, id 41735, len 1252)
  3754	18:45:19.714505 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17967771 3264444> (DF) (ttl 49, id 41736, len 1500)
  3755	18:45:19.724872 172.16.183.2.1094 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3264455 17967771> (DF) (ttl 64, id 1797, len 52)
  3756	18:45:19.727827 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17967773 3264448> (DF) (ttl 49, id 41737, len 1500)
  3757	18:45:19.732489 172.16.183.2.1094 > clustera.icq.com.http: P [bad tcp cksum cfa!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3758	18:45:19.732489 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3264456 17967773> (DF) (ttl 64, id 1798, len 52)
  3759	18:45:19.738929 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17967773 3264448> (DF) (ttl 49, id 41738, len 1252)
  3760	18:45:19.739731 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1799, len 40)
  3761	18:45:19.752675 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17967773 3264448> (DF) (ttl 49, id 41739, len 1500)
  3762	18:45:19.753469 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1800, len 40)
  3763	18:45:19.765493 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17967776 3264450> (DF) (ttl 49, id 41740, len 1500)
  3764	18:45:19.766300 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1801, len 40)
  3765	18:45:19.775886 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17967776 3264450> (DF) (ttl 49, id 41741, len 1252)
  3766	18:45:19.776626 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1802, len 40)
  3767	18:45:19.788390 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17967776 3264450> (DF) (ttl 49, id 41742, len 1500)
  3768	18:45:19.789159 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1803, len 40)
  3769	18:45:19.799978 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17967779 3264455> (DF) (ttl 49, id 41743, len 1500)
  3770	18:45:19.800742 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1804, len 40)
  3771	18:45:19.809879 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17967779 3264455> (DF) (ttl 49, id 41744, len 1252)
  3772	18:45:19.810552 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1805, len 40)
  3773	18:45:19.822391 clustera.icq.com.http > 172.16.183.2.1094: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17967779 3264455> (DF) (ttl 49, id 41745, len 1500)
  3774	18:45:19.823140 172.16.183.2.1094 > clustera.icq.com.http: R [tcp sum ok] 2070052003:2070052003(0) win 0 (ttl 255, id 1806, len 40)
  3775	18:45:21.717077 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50792+ A? web.icq.com. [|domain] (ttl 64, id 1807, len 57)
  3776	18:45:21.730782 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50792 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 7107, len 233)
  3777	18:45:21.732023 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3264658 0,nop,wscale 0> (DF) (ttl 64, id 1808, len 60)
  3778	18:45:24.734889 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3264958 0,nop,wscale 0> (DF) (ttl 64, id 1809, len 60)
  3779	18:45:30.735368 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3265558 0,nop,wscale 0> (DF) (ttl 64, id 1810, len 60)
  3780	18:45:42.735279 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3266758 0,nop,wscale 0> (DF) (ttl 64, id 1811, len 60)
  3781	18:46:06.865117 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3269158 0,nop,wscale 0> (DF) (ttl 64, id 1812, len 60)
  3782	18:46:54.925325 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3273958 0,nop,wscale 0> (DF) (ttl 64, id 1813, len 60)
  3783	18:48:30.915312 172.16.183.2.1095 > clusterc.icq.com.http: S [tcp sum ok] 2272791055:2272791055(0) win 32120 <mss 1460,sackOK,timestamp 3283558 0,nop,wscale 0> (DF) (ttl 64, id 1814, len 60)
  3784	18:48:30.936126 clusterc.icq.com.http > 172.16.183.2.1095: S [tcp sum ok] 833551745:833551745(0) ack 2272791056 win 65535 <nop,nop,timestamp 502326559 3283558,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 62263, len 64)
  3785	18:48:30.937093 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3283560 502326559> (DF) (ttl 64, id 1815, len 52)
  3786	18:48:31.935500 172.16.183.2.1095 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3283660 502326559> (DF) (ttl 64, id 1816, len 104)
  3787	18:48:31.954873 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502326661 3283660> (DF) (ttl 240, id 62264, len 52)
  3788	18:48:32.785351 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502326742 3283660> (DF) (ttl 240, id 62265, len 1500)
  3789	18:48:32.786141 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3283789 502326742> (DF) (ttl 64, id 1817, len 52)
  3790	18:48:32.802838 clusterc.icq.com.http > 172.16.183.2.1095: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502326742 3283660> (DF) (ttl 240, id 62266, len 1500)
  3791	18:48:32.812883 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3283793 502326742> (DF) (ttl 64, id 1818, len 52)
  3792	18:48:32.820306 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502326746 3283789> (DF) (ttl 240, id 62267, len 1477)
  3793	18:48:32.835358 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502326746 3283789> (DF) (ttl 240, id 62268, len 1500)
  3794	18:48:32.842925 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3283798 502326746> (DF) (ttl 64, id 1819, len 52)
  3795	18:48:32.850394 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502326749 3283793> (DF) (ttl 240, id 62269, len 1500)
  3796	18:48:32.863003 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502326749 3283793> (DF) (ttl 240, id 62270, len 1252)
  3797	18:48:32.874958 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3283803 502326749> (DF) (ttl 64, id 1820, len 52)
  3798	18:48:32.878224 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502326752 3283798> (DF) (ttl 240, id 62271, len 1500)
  3799	18:48:32.893496 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502326752 3283798> (DF) (ttl 240, id 62272, len 1500)
  3800	18:48:32.894242 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3283805 502326752> (DF) (ttl 64, id 1821, len 52)
  3801	18:48:32.905135 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502326752 3283798> (DF) (ttl 240, id 62273, len 1252)
  3802	18:48:32.918408 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502326755 3283803> (DF) (ttl 240, id 62274, len 1500)
  3803	18:48:32.931938 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502326755 3283803> (DF) (ttl 240, id 62275, len 1500)
  3804	18:48:32.932714 172.16.183.2.1095 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3283811 502326752> (DF) (ttl 64, id 1822, len 52)
  3805	18:48:32.937031 172.16.183.2.1095 > clusterc.icq.com.http: P [bad tcp cksum d95c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3806	18:48:32.937031 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3283811 502326755> (DF) (ttl 64, id 1823, len 52)
  3807	18:48:32.942813 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502326755 3283803> (DF) (ttl 240, id 62276, len 1252)
  3808	18:48:32.943602 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1824, len 40)
  3809	18:48:32.956313 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502326757 3283805> (DF) (ttl 240, id 62277, len 1500)
  3810	18:48:32.957103 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1825, len 40)
  3811	18:48:32.970100 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502326757 3283805> (DF) (ttl 240, id 62278, len 1500)
  3812	18:48:32.970840 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1826, len 40)
  3813	18:48:32.980996 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502326757 3283805> (DF) (ttl 240, id 62279, len 1252)
  3814	18:48:32.981695 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1827, len 40)
  3815	18:48:32.993759 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502326760 3283811> (DF) (ttl 240, id 62280, len 1500)
  3816	18:48:32.994489 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1828, len 40)
  3817	18:48:33.006575 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502326760 3283811> (DF) (ttl 240, id 62281, len 1500)
  3818	18:48:33.007350 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1829, len 40)
  3819	18:48:33.016230 clusterc.icq.com.http > 172.16.183.2.1095: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502326760 3283811> (DF) (ttl 240, id 62282, len 1252)
  3820	18:48:33.016930 172.16.183.2.1095 > clusterc.icq.com.http: R [tcp sum ok] 2272791108:2272791108(0) win 0 (ttl 255, id 1830, len 40)
  3821	18:48:34.937528 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50793+ A? web.icq.com. [|domain] (ttl 64, id 1831, len 57)
  3822	18:48:34.950186 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50793 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 16349, len 233)
  3823	18:48:34.951519 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3284013 0,nop,wscale 0> (DF) (ttl 64, id 1832, len 60)
  3824	18:48:37.955019 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3284314 0,nop,wscale 0> (DF) (ttl 64, id 1833, len 60)
  3825	18:48:43.955182 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3284914 0,nop,wscale 0> (DF) (ttl 64, id 1834, len 60)
  3826	18:48:55.945269 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3286114 0,nop,wscale 0> (DF) (ttl 64, id 1835, len 60)
  3827	18:49:19.965197 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3288514 0,nop,wscale 0> (DF) (ttl 64, id 1836, len 60)
  3828	18:50:07.955178 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3293314 0,nop,wscale 0> (DF) (ttl 64, id 1837, len 60)
  3829	18:51:44.055207 172.16.183.2.1096 > clusterb.icq.com.http: S [tcp sum ok] 2481784217:2481784217(0) win 32120 <mss 1460,sackOK,timestamp 3302914 0,nop,wscale 0> (DF) (ttl 64, id 1838, len 60)
  3830	18:51:44.073984 clusterb.icq.com.http > 172.16.183.2.1096: S [tcp sum ok] 2326526492:2326526492(0) ack 2481784218 win 65535 <nop,nop,timestamp 501653596 3302914,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 17305, len 64)
  3831	18:51:44.074888 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3302915 501653596> (DF) (ttl 64, id 1839, len 52)
  3832	18:51:45.075553 172.16.183.2.1096 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3303015 501653596> (DF) (ttl 64, id 1840, len 104)
  3833	18:51:45.102833 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501653699 3303015> (DF) (ttl 240, id 17306, len 52)
  3834	18:51:45.565744 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501653744 3303015> (DF) (ttl 240, id 17307, len 1500)
  3835	18:51:45.566515 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3303090 501653744> (DF) (ttl 64, id 1841, len 52)
  3836	18:51:45.574338 clusterb.icq.com.http > 172.16.183.2.1096: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501653744 3303015> (DF) (ttl 240, id 17308, len 1500)
  3837	18:51:45.591184 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3303094 501653744> (DF) (ttl 64, id 1842, len 52)
  3838	18:51:45.593523 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501653747 3303090> (DF) (ttl 240, id 17309, len 1477)
  3839	18:51:45.602418 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501653747 3303090> (DF) (ttl 240, id 17310, len 1500)
  3840	18:51:45.611185 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3303097 501653747> (DF) (ttl 64, id 1843, len 52)
  3841	18:51:45.617943 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501653750 3303094> (DF) (ttl 240, id 17311, len 1500)
  3842	18:51:45.625138 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501653750 3303094> (DF) (ttl 240, id 17312, len 1252)
  3843	18:51:45.631190 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3303101 501653750> (DF) (ttl 64, id 1844, len 52)
  3844	18:51:45.637407 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501653752 3303097> (DF) (ttl 240, id 17313, len 1500)
  3845	18:51:45.646033 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501653752 3303097> (DF) (ttl 240, id 17314, len 1500)
  3846	18:51:45.646792 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3303103 501653752> (DF) (ttl 64, id 1845, len 52)
  3847	18:51:45.653473 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501653752 3303097> (DF) (ttl 240, id 17315, len 1252)
  3848	18:51:45.662538 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501653754 3303101> (DF) (ttl 240, id 17316, len 1500)
  3849	18:51:45.671164 172.16.183.2.1096 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3303108 501653752> (DF) (ttl 64, id 1846, len 52)
  3850	18:51:45.671370 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501653754 3303101> (DF) (ttl 240, id 17317, len 1500)
  3851	18:51:45.678596 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501653754 3303101> (DF) (ttl 240, id 17318, len 1252)
  3852	18:51:45.680208 172.16.183.2.1096 > clusterb.icq.com.http: P [bad tcp cksum b9f9!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3853	18:51:45.680208 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3303109 501653754> (DF) (ttl 64, id 1847, len 52)
  3854	18:51:45.687658 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501653755 3303103> (DF) (ttl 240, id 17319, len 1500)
  3855	18:51:45.688589 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1848, len 40)
  3856	18:51:45.696296 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501653755 3303103> (DF) (ttl 240, id 17320, len 1500)
  3857	18:51:45.697085 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1849, len 40)
  3858	18:51:45.703708 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501653755 3303103> (DF) (ttl 240, id 17321, len 1252)
  3859	18:51:45.704439 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1850, len 40)
  3860	18:51:45.712773 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501653758 3303108> (DF) (ttl 240, id 17322, len 1500)
  3861	18:51:45.713468 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1851, len 40)
  3862	18:51:45.721653 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501653758 3303108> (DF) (ttl 240, id 17323, len 1500)
  3863	18:51:45.722412 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1852, len 40)
  3864	18:51:45.728836 clusterb.icq.com.http > 172.16.183.2.1096: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501653758 3303108> (DF) (ttl 240, id 17324, len 1252)
  3865	18:51:45.729517 172.16.183.2.1096 > clusterb.icq.com.http: R [tcp sum ok] 2481784270:2481784270(0) win 0 (ttl 255, id 1853, len 40)
  3866	18:51:47.667188 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50794+ A? web.icq.com. [|domain] (ttl 64, id 1854, len 57)
  3867	18:51:47.679553 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50794 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 25130, len 233)
  3868	18:51:47.680530 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3303311 0,nop,wscale 0> (DF) (ttl 64, id 1855, len 60)
  3869	18:51:50.685321 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3303611 0,nop,wscale 0> (DF) (ttl 64, id 1856, len 60)
  3870	18:51:56.756206 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3304211 0,nop,wscale 0> (DF) (ttl 64, id 1857, len 60)
  3871	18:52:08.756203 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3305411 0,nop,wscale 0> (DF) (ttl 64, id 1858, len 60)
  3872	18:52:32.775123 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3307811 0,nop,wscale 0> (DF) (ttl 64, id 1859, len 60)
  3873	18:53:20.815266 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3312611 0,nop,wscale 0> (DF) (ttl 64, id 1860, len 60)
  3874	18:54:56.725271 172.16.183.2.1097 > clusterb.icq.com.http: S [tcp sum ok] 2670866967:2670866967(0) win 32120 <mss 1460,sackOK,timestamp 3322211 0,nop,wscale 0> (DF) (ttl 64, id 1861, len 60)
  3875	18:54:56.742761 clusterb.icq.com.http > 172.16.183.2.1097: S [tcp sum ok] 3994026358:3994026358(0) ack 2670866968 win 65535 <nop,nop,timestamp 503639380 3322211,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 17737, len 64)
  3876	18:54:56.743429 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3322212 503639380> (DF) (ttl 64, id 1862, len 52)
  3877	18:54:57.735473 172.16.183.2.1097 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3322312 503639380> (DF) (ttl 64, id 1863, len 104)
  3878	18:54:57.756090 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 503639481 3322312> (DF) (ttl 240, id 17738, len 52)
  3879	18:54:58.209350 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 503639525 3322312> (DF) (ttl 240, id 17739, len 1500)
  3880	18:54:58.210157 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3322384 503639525> (DF) (ttl 64, id 1864, len 52)
  3881	18:54:58.226846 clusterb.icq.com.http > 172.16.183.2.1097: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 503639525 3322312> (DF) (ttl 240, id 17740, len 1500)
  3882	18:54:58.243816 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 503639529 3322384> (DF) (ttl 240, id 17741, len 1477)
  3883	18:54:58.244899 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3322390 503639525> (DF) (ttl 64, id 1865, len 52)
  3884	18:54:58.258869 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 503639529 3322384> (DF) (ttl 240, id 17742, len 1500)
  3885	18:54:58.269448 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3322394 503639529> (DF) (ttl 64, id 1866, len 52)
  3886	18:54:58.277342 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 503639532 3322390> (DF) (ttl 240, id 17743, len 1500)
  3887	18:54:58.289708 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 503639532 3322390> (DF) (ttl 240, id 17744, len 1252)
  3888	18:54:58.304935 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 503639535 3322394> (DF) (ttl 240, id 17745, len 1500)
  3889	18:54:58.305741 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3322399 503639532> (DF) (ttl 64, id 1867, len 52)
  3890	18:54:58.320454 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 503639535 3322394> (DF) (ttl 240, id 17746, len 1500)
  3891	18:54:58.331350 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 503639535 3322394> (DF) (ttl 240, id 17747, len 1252)
  3892	18:54:58.345109 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 503639538 3322399> (DF) (ttl 240, id 17748, len 1500)
  3893	18:54:58.345848 172.16.183.2.1097 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3322406 503639535> (DF) (ttl 64, id 1868, len 52)
  3894	18:54:58.358396 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 503639538 3322399> (DF) (ttl 240, id 17749, len 1500)
  3895	18:54:58.361309 172.16.183.2.1097 > clusterb.icq.com.http: P [bad tcp cksum e65b!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3896	18:54:58.361309 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3322408 503639538> (DF) (ttl 64, id 1869, len 52)
  3897	18:54:58.369273 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 503639538 3322399> (DF) (ttl 240, id 17750, len 1252)
  3898	18:54:58.370093 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1870, len 40)
  3899	18:54:58.383023 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 503639538 3322399> (DF) (ttl 240, id 17751, len 1500)
  3900	18:54:58.383760 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1871, len 40)
  3901	18:54:58.396326 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 503639542 3322406> (DF) (ttl 240, id 17752, len 1500)
  3902	18:54:58.397047 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1872, len 40)
  3903	18:54:58.407944 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 503639542 3322406> (DF) (ttl 240, id 17753, len 1252)
  3904	18:54:58.408705 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1873, len 40)
  3905	18:54:58.420714 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 503639542 3322406> (DF) (ttl 240, id 17754, len 1500)
  3906	18:54:58.421459 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1874, len 40)
  3907	18:54:58.432541 clusterb.icq.com.http > 172.16.183.2.1097: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 503639542 3322406> (DF) (ttl 240, id 17755, len 1500)
  3908	18:54:58.433279 172.16.183.2.1097 > clusterb.icq.com.http: R [tcp sum ok] 2670867020:2670867020(0) win 0 (ttl 255, id 1875, len 40)
  3909	18:55:00.346378 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50795+ A? web.icq.com. [|domain] (ttl 64, id 1876, len 57)
  3910	18:55:00.367039 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50795* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 34530, len 233)
  3911	18:55:00.367982 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3322611 0,nop,wscale 0> (DF) (ttl 64, id 1877, len 60)
  3912	18:55:03.315274 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3322911 0,nop,wscale 0> (DF) (ttl 64, id 1878, len 60)
  3913	18:55:09.315373 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3323511 0,nop,wscale 0> (DF) (ttl 64, id 1879, len 60)
  3914	18:55:21.315303 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3324711 0,nop,wscale 0> (DF) (ttl 64, id 1880, len 60)
  3915	18:55:45.355081 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3327111 0,nop,wscale 0> (DF) (ttl 64, id 1881, len 60)
  3916	18:56:33.395176 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3331911 0,nop,wscale 0> (DF) (ttl 64, id 1882, len 60)
  3917	18:58:09.415149 172.16.183.2.1098 > clusterc.icq.com.http: S [tcp sum ok] 2898615292:2898615292(0) win 32120 <mss 1460,sackOK,timestamp 3341511 0,nop,wscale 0> (DF) (ttl 64, id 1883, len 60)
  3918	18:58:09.431712 clusterc.icq.com.http > 172.16.183.2.1098: S [tcp sum ok] 1258439228:1258439228(0) ack 2898615293 win 33304 <nop,nop,timestamp 494080535 3341511,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 46311, len 64)
  3919	18:58:09.432627 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3341512 494080535> (DF) (ttl 64, id 1884, len 52)
  3920	18:58:10.425432 172.16.183.2.1098 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3341612 494080535> (DF) (ttl 64, id 1885, len 104)
  3921	18:58:10.534716 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 494080646 3341612> (DF) (ttl 49, id 46312, len 52)
  3922	18:58:11.074468 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 494080699 3341612> (DF) (ttl 49, id 46313, len 1500)
  3923	18:58:11.075563 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3341716 494080699> (DF) (ttl 64, id 1886, len 52)
  3924	18:58:11.083340 clusterc.icq.com.http > 172.16.183.2.1098: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 494080699 3341612> (DF) (ttl 49, id 46314, len 1500)
  3925	18:58:11.087754 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3341718 494080699> (DF) (ttl 64, id 1887, len 52)
  3926	18:58:11.092183 clusterc.icq.com.http > 172.16.183.2.1098: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 494080699 3341612> (DF) (ttl 49, id 46315, len 1477)
  3927	18:58:11.097756 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3341719 494080699> (DF) (ttl 64, id 1888, len 52)
  3928	18:58:11.102063 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 494080701 3341716> (DF) (ttl 49, id 46316, len 1500)
  3929	18:58:11.107751 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3341720 494080701> (DF) (ttl 64, id 1889, len 52)
  3930	18:58:11.110916 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 494080701 3341716> (DF) (ttl 49, id 46317, len 1500)
  3931	18:58:11.118371 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 494080703 3341718> (DF) (ttl 49, id 46318, len 1252)
  3932	18:58:11.124970 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3341723 494080701> (DF) (ttl 64, id 1890, len 52)
  3933	18:58:11.127185 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 494080703 3341718> (DF) (ttl 49, id 46319, len 1500)
  3934	18:58:11.136068 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 494080704 3341719> (DF) (ttl 49, id 46320, len 1500)
  3935	18:58:11.136772 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3341724 494080703> (DF) (ttl 64, id 1891, len 52)
  3936	18:58:11.143243 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 494080704 3341719> (DF) (ttl 49, id 46321, len 1252)
  3937	18:58:11.152328 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 494080705 3341720> (DF) (ttl 49, id 46322, len 1500)
  3938	18:58:11.153124 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3341727 494080704> (DF) (ttl 64, id 1892, len 52)
  3939	18:58:11.161183 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 494080705 3341720> (DF) (ttl 49, id 46323, len 1500)
  3940	18:58:11.161868 172.16.183.2.1098 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3341728 494080705> (DF) (ttl 64, id 1893, len 52)
  3941	18:58:11.168615 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 494080706 3341723> (DF) (ttl 49, id 46324, len 1252)
  3942	18:58:11.170837 172.16.183.2.1098 > clusterc.icq.com.http: P [bad tcp cksum e481!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3943	18:58:11.170837 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3341730 494080706> (DF) (ttl 64, id 1894, len 52)
  3944	18:58:11.177438 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 494080706 3341723> (DF) (ttl 49, id 46325, len 1500)
  3945	18:58:11.178253 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1895, len 40)
  3946	18:58:11.186303 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 494080706 3341723> (DF) (ttl 49, id 46326, len 1500)
  3947	18:58:11.187061 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1896, len 40)
  3948	18:58:11.193483 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 494080707 3341724> (DF) (ttl 49, id 46327, len 1252)
  3949	18:58:11.194195 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1897, len 40)
  3950	18:58:11.202568 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 494080707 3341724> (DF) (ttl 49, id 46328, len 1500)
  3951	18:58:11.203335 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1898, len 40)
  3952	18:58:11.211437 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 494080707 3341724> (DF) (ttl 49, id 46329, len 1500)
  3953	18:58:11.212200 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1899, len 40)
  3954	18:58:11.218883 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 494080709 3341727> (DF) (ttl 49, id 46330, len 1252)
  3955	18:58:11.219621 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1900, len 40)
  3956	18:58:11.227691 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 494080709 3341727> (DF) (ttl 49, id 46331, len 1500)
  3957	18:58:11.228405 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1901, len 40)
  3958	18:58:11.236573 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 494080710 3341728> (DF) (ttl 49, id 46332, len 1500)
  3959	18:58:11.237372 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1902, len 40)
  3960	18:58:11.243751 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 494080710 3341728> (DF) (ttl 49, id 46333, len 1252)
  3961	18:58:11.244443 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1903, len 40)
  3962	18:58:11.252584 clusterc.icq.com.http > 172.16.183.2.1098: . [tcp sum ok] 28898:30346(1448) ack 53 win 33304 <nop,nop,timestamp 494080710 3341728> (DF) (ttl 49, id 46334, len 1500)
  3963	18:58:11.253326 172.16.183.2.1098 > clusterc.icq.com.http: R [tcp sum ok] 2898615345:2898615345(0) win 0 (ttl 255, id 1904, len 40)
  3964	18:58:13.156948 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50796+ A? web.icq.com. [|domain] (ttl 64, id 1905, len 57)
  3965	18:58:13.167852 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50796 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 43977, len 233)
  3966	18:58:13.169120 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3341932 0,nop,wscale 0> (DF) (ttl 64, id 1906, len 60)
  3967	18:58:16.165310 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3342232 0,nop,wscale 0> (DF) (ttl 64, id 1907, len 60)
  3968	18:58:22.165027 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3342832 0,nop,wscale 0> (DF) (ttl 64, id 1908, len 60)
  3969	18:58:34.165279 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3344032 0,nop,wscale 0> (DF) (ttl 64, id 1909, len 60)
  3970	18:58:58.185168 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3346432 0,nop,wscale 0> (DF) (ttl 64, id 1910, len 60)
  3971	18:59:46.175248 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3351232 0,nop,wscale 0> (DF) (ttl 64, id 1911, len 60)
  3972	19:01:22.215103 172.16.183.2.1099 > clustera.icq.com.http: S [tcp sum ok] 3099401961:3099401961(0) win 32120 <mss 1460,sackOK,timestamp 3360832 0,nop,wscale 0> (DF) (ttl 64, id 1912, len 60)
  3973	19:01:22.232039 clustera.icq.com.http > 172.16.183.2.1099: S [tcp sum ok] 3130400235:3130400235(0) ack 3099401962 win 33304 <nop,nop,timestamp 18064050 3360832,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 23285, len 64)
  3974	19:01:22.232925 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3360833 18064050> (DF) (ttl 64, id 1913, len 52)
  3975	19:01:23.225485 172.16.183.2.1099 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3360933 18064050> (DF) (ttl 64, id 1914, len 104)
  3976	19:01:23.242403 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18064151 3360933> (DF) (ttl 49, id 23286, len 52)
  3977	19:01:23.829447 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18064209 3360933> (DF) (ttl 49, id 23287, len 1500)
  3978	19:01:23.830173 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3361023 18064209> (DF) (ttl 64, id 1915, len 52)
  3979	19:01:23.838083 clustera.icq.com.http > 172.16.183.2.1099: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18064209 3360933> (DF) (ttl 49, id 23288, len 1500)
  3980	19:01:23.846006 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3361027 18064209> (DF) (ttl 64, id 1916, len 52)
  3981	19:01:23.846927 clustera.icq.com.http > 172.16.183.2.1099: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18064209 3360933> (DF) (ttl 49, id 23289, len 1477)
  3982	19:01:23.856805 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18064212 3361023> (DF) (ttl 49, id 23290, len 1500)
  3983	19:01:23.865672 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18064212 3361023> (DF) (ttl 49, id 23291, len 1500)
  3984	19:01:23.866596 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3361029 18064209> (DF) (ttl 64, id 1917, len 52)
  3985	19:01:23.872858 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18064213 3361027> (DF) (ttl 49, id 23292, len 1252)
  3986	19:01:23.882171 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18064213 3361027> (DF) (ttl 49, id 23293, len 1500)
  3987	19:01:23.885020 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 30408 <nop,nop,timestamp 3361032 18064213> (DF) (ttl 64, id 1918, len 52)
  3988	19:01:23.892759 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18064215 3361029> (DF) (ttl 49, id 23294, len 1500)
  3989	19:01:23.899965 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18064215 3361029> (DF) (ttl 49, id 23295, len 1252)
  3990	19:01:23.906030 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3361036 18064215> (DF) (ttl 64, id 1919, len 52)
  3991	19:01:23.909025 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18064215 3361029> (DF) (ttl 49, id 23296, len 1500)
  3992	19:01:23.916011 172.16.183.2.1099 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3361038 18064215> (DF) (ttl 64, id 1920, len 52)
  3993	19:01:23.917902 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18064215 3361029> (DF) (ttl 49, id 23297, len 1500)
  3994	19:01:23.925094 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18064217 3361032> (DF) (ttl 49, id 23298, len 1252)
  3995	19:01:23.926535 172.16.183.2.1099 > clustera.icq.com.http: P [bad tcp cksum fa67!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  3996	19:01:23.926535 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3361039 18064215> (DF) (ttl 64, id 1921, len 52)
  3997	19:01:23.934155 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18064217 3361032> (DF) (ttl 49, id 23299, len 1500)
  3998	19:01:23.935249 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1922, len 40)
  3999	19:01:23.943006 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18064217 3361032> (DF) (ttl 49, id 23300, len 1500)
  4000	19:01:23.943720 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1923, len 40)
  4001	19:01:23.950206 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18064219 3361036> (DF) (ttl 49, id 23301, len 1252)
  4002	19:01:23.950897 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1924, len 40)
  4003	19:01:23.959268 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18064219 3361036> (DF) (ttl 49, id 23302, len 1500)
  4004	19:01:23.960084 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1925, len 40)
  4005	19:01:23.968146 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18064219 3361036> (DF) (ttl 49, id 23303, len 1500)
  4006	19:01:23.968923 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1926, len 40)
  4007	19:01:23.975334 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18064220 3361038> (DF) (ttl 49, id 23304, len 1252)
  4008	19:01:23.976016 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1927, len 40)
  4009	19:01:23.984405 clustera.icq.com.http > 172.16.183.2.1099: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18064220 3361038> (DF) (ttl 49, id 23305, len 1500)
  4010	19:01:23.985425 172.16.183.2.1099 > clustera.icq.com.http: R [tcp sum ok] 3099402014:3099402014(0) win 0 (ttl 255, id 1928, len 40)
  4011	19:01:25.937474 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50797+ A? web.icq.com. [|domain] (ttl 64, id 1929, len 57)
  4012	19:01:30.986465 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50797+ A? web.icq.com. [|domain] (ttl 64, id 1930, len 57)
  4013	19:01:31.015882 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50797 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 57224, len 244)
  4014	19:01:31.017678 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3361744 0,nop,wscale 0> (DF) (ttl 64, id 1931, len 60)
  4015	19:01:33.745443 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50797 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 57425, len 244)
  4016	19:01:33.747278 172.16.183.2 > ns2.dca.net: icmp: 216.158.2.203 udp port 1025 unreachable [tos 0xc0]  (ttl 255, id 1932, len 272)
  4017	19:01:34.025257 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3362045 0,nop,wscale 0> (DF) (ttl 64, id 1933, len 60)
  4018	19:01:40.015366 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3362645 0,nop,wscale 0> (DF) (ttl 64, id 1934, len 60)
  4019	19:01:52.025308 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3363845 0,nop,wscale 0> (DF) (ttl 64, id 1935, len 60)
  4020	19:02:16.085092 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3366245 0,nop,wscale 0> (DF) (ttl 64, id 1936, len 60)
  4021	19:03:04.075080 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3371045 0,nop,wscale 0> (DF) (ttl 64, id 1937, len 60)
  4022	19:04:40.015152 172.16.183.2.1100 > clusterb.icq.com.http: S [tcp sum ok] 3314793965:3314793965(0) win 32120 <mss 1460,sackOK,timestamp 3380645 0,nop,wscale 0> (DF) (ttl 64, id 1938, len 60)
  4023	19:04:40.035222 clusterb.icq.com.http > 172.16.183.2.1100: S [tcp sum ok] 888532244:888532244(0) ack 3314793966 win 33304 <nop,nop,timestamp 79088032 3380645,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 57409, len 64)
  4024	19:04:40.036112 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3380647 79088032> (DF) (ttl 64, id 1939, len 52)
  4025	19:04:41.035546 172.16.183.2.1100 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3380747 79088032> (DF) (ttl 64, id 1940, len 104)
  4026	19:04:41.151530 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 79088143 3380747> (DF) (ttl 49, id 57410, len 52)
  4027	19:04:41.577442 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 79088185 3380747> (DF) (ttl 49, id 57411, len 1500)
  4028	19:04:41.578263 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3380830 79088185> (DF) (ttl 64, id 1941, len 52)
  4029	19:04:41.586320 clusterb.icq.com.http > 172.16.183.2.1100: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 79088185 3380747> (DF) (ttl 49, id 57412, len 1500)
  4030	19:04:41.594278 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3380832 79088185> (DF) (ttl 64, id 1942, len 52)
  4031	19:04:41.594944 clusterb.icq.com.http > 172.16.183.2.1100: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 79088185 3380747> (DF) (ttl 49, id 57413, len 1477)
  4032	19:04:41.605037 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 79088188 3380830> (DF) (ttl 49, id 57414, len 1500)
  4033	19:04:41.613676 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 79088188 3380830> (DF) (ttl 49, id 57415, len 1500)
  4034	19:04:41.614444 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3380833 79088185> (DF) (ttl 64, id 1943, len 52)
  4035	19:04:41.621104 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 79088189 3380832> (DF) (ttl 49, id 57416, len 1252)
  4036	19:04:41.629929 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 79088189 3380832> (DF) (ttl 49, id 57417, len 1500)
  4037	19:04:41.630783 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 3380836 79088189> (DF) (ttl 64, id 1944, len 52)
  4038	19:04:41.641010 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 79088191 3380833> (DF) (ttl 49, id 57418, len 1500)
  4039	19:04:41.641821 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3380838 79088189> (DF) (ttl 64, id 1945, len 52)
  4040	19:04:41.647959 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 79088191 3380833> (DF) (ttl 49, id 57419, len 1252)
  4041	19:04:41.654940 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 30408 <nop,nop,timestamp 3380841 79088191> (DF) (ttl 64, id 1946, len 52)
  4042	19:04:41.657263 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 79088191 3380833> (DF) (ttl 49, id 57420, len 1500)
  4043	19:04:41.665904 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 79088191 3380833> (DF) (ttl 49, id 57421, len 1500)
  4044	19:04:41.666627 172.16.183.2.1100 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3380843 79088191> (DF) (ttl 64, id 1947, len 52)
  4045	19:04:41.673320 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 79088193 3380836> (DF) (ttl 49, id 57422, len 1252)
  4046	19:04:41.679880 172.16.183.2.1100 > clusterb.icq.com.http: P [bad tcp cksum 7572!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4047	19:04:41.679880 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3380844 79088193> (DF) (ttl 64, id 1948, len 52)
  4048	19:04:41.682148 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 79088193 3380836> (DF) (ttl 49, id 57423, len 1500)
  4049	19:04:41.682992 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1949, len 40)
  4050	19:04:41.691251 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 79088194 3380838> (DF) (ttl 49, id 57424, len 1500)
  4051	19:04:41.691965 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1950, len 40)
  4052	19:04:41.698210 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 79088194 3380838> (DF) (ttl 49, id 57425, len 1252)
  4053	19:04:41.698996 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1951, len 40)
  4054	19:04:41.707513 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 79088194 3380838> (DF) (ttl 49, id 57426, len 1500)
  4055	19:04:41.708298 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1952, len 40)
  4056	19:04:41.716132 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 79088195 3380841> (DF) (ttl 49, id 57427, len 1500)
  4057	19:04:41.716928 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1953, len 40)
  4058	19:04:41.723569 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 79088195 3380841> (DF) (ttl 49, id 57428, len 1252)
  4059	19:04:41.724330 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1954, len 40)
  4060	19:04:41.732421 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 79088197 3380843> (DF) (ttl 49, id 57429, len 1500)
  4061	19:04:41.733166 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1955, len 40)
  4062	19:04:41.741274 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 79088197 3380843> (DF) (ttl 49, id 57430, len 1500)
  4063	19:04:41.742087 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1956, len 40)
  4064	19:04:41.748465 clusterb.icq.com.http > 172.16.183.2.1100: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 79088197 3380843> (DF) (ttl 49, id 57431, len 1252)
  4065	19:04:41.749195 172.16.183.2.1100 > clusterb.icq.com.http: R [tcp sum ok] 3314794018:3314794018(0) win 0 (ttl 255, id 1957, len 40)
  4066	19:04:43.667193 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50798+ A? web.icq.com. [|domain] (ttl 64, id 1958, len 57)
  4067	19:04:43.712715 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50798 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 1295, len 233)
  4068	19:04:43.714027 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3381050 0,nop,wscale 0> (DF) (ttl 64, id 1959, len 60)
  4069	19:04:46.725001 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3381351 0,nop,wscale 0> (DF) (ttl 64, id 1960, len 60)
  4070	19:04:52.715252 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3381951 0,nop,wscale 0> (DF) (ttl 64, id 1961, len 60)
  4071	19:05:04.715169 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3383151 0,nop,wscale 0> (DF) (ttl 64, id 1962, len 60)
  4072	19:05:28.745394 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3385551 0,nop,wscale 0> (DF) (ttl 64, id 1963, len 60)
  4073	19:06:16.785108 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3390351 0,nop,wscale 0> (DF) (ttl 64, id 1964, len 60)
  4074	19:07:52.825232 172.16.183.2.1101 > clustera.icq.com.http: S [tcp sum ok] 3507853281:3507853281(0) win 32120 <mss 1460,sackOK,timestamp 3399951 0,nop,wscale 0> (DF) (ttl 64, id 1965, len 60)
  4075	19:07:52.843654 clustera.icq.com.http > 172.16.183.2.1101: S [tcp sum ok] 4104535619:4104535619(0) ack 3507853282 win 33304 <nop,nop,timestamp 200641825 3399951,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 33611, len 64)
  4076	19:07:52.844328 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3399952 200641825> (DF) (ttl 64, id 1966, len 52)
  4077	19:07:53.845499 172.16.183.2.1101 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3400052 200641825> (DF) (ttl 64, id 1967, len 104)
  4078	19:07:53.863393 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200641927 3400052> (DF) (ttl 49, id 33612, len 52)
  4079	19:07:54.442319 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200641984 3400052> (DF) (ttl 49, id 33613, len 1500)
  4080	19:07:54.443094 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3400145 200641984> (DF) (ttl 64, id 1968, len 52)
  4081	19:07:54.451190 clustera.icq.com.http > 172.16.183.2.1101: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200641984 3400052> (DF) (ttl 49, id 33614, len 1500)
  4082	19:07:54.452565 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3400147 200641984> (DF) (ttl 64, id 1969, len 52)
  4083	19:07:54.460344 clustera.icq.com.http > 172.16.183.2.1101: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200641984 3400052> (DF) (ttl 49, id 33615, len 1477)
  4084	19:07:54.468922 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200641987 3400145> (DF) (ttl 49, id 33616, len 1500)
  4085	19:07:54.469716 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3400150 200641984> (DF) (ttl 64, id 1970, len 52)
  4086	19:07:54.477549 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200641987 3400145> (DF) (ttl 49, id 33617, len 1500)
  4087	19:07:54.478307 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3400151 200641987> (DF) (ttl 64, id 1971, len 52)
  4088	19:07:54.484991 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200641988 3400147> (DF) (ttl 49, id 33618, len 1252)
  4089	19:07:54.493820 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200641988 3400147> (DF) (ttl 49, id 33619, len 1500)
  4090	19:07:54.502921 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200641989 3400150> (DF) (ttl 49, id 33620, len 1500)
  4091	19:07:54.503617 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3400156 200641988> (DF) (ttl 64, id 1972, len 52)
  4092	19:07:54.509872 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200641989 3400150> (DF) (ttl 49, id 33621, len 1252)
  4093	19:07:54.519195 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200641990 3400151> (DF) (ttl 49, id 33622, len 1500)
  4094	19:07:54.522550 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 30408 <nop,nop,timestamp 3400159 200641989> (DF) (ttl 64, id 1973, len 52)
  4095	19:07:54.527805 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200641990 3400151> (DF) (ttl 49, id 33623, len 1500)
  4096	19:07:54.534971 172.16.183.2.1101 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3400161 200641990> (DF) (ttl 64, id 1974, len 52)
  4097	19:07:54.535212 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200641990 3400151> (DF) (ttl 49, id 33624, len 1252)
  4098	19:07:54.536244 172.16.183.2.1101 > clustera.icq.com.http: P [bad tcp cksum ed80!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4099	19:07:54.536244 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3400161 200641990> (DF) (ttl 64, id 1975, len 52)
  4100	19:07:54.544047 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200641993 3400156> (DF) (ttl 49, id 33625, len 1500)
  4101	19:07:54.545004 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1977, len 40)
  4102	19:07:54.553154 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200641993 3400156> (DF) (ttl 49, id 33626, len 1500)
  4103	19:07:54.553884 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1978, len 40)
  4104	19:07:54.560113 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200641993 3400156> (DF) (ttl 49, id 33627, len 1252)
  4105	19:07:54.560928 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1979, len 40)
  4106	19:07:54.569428 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200641993 3400156> (DF) (ttl 49, id 33628, len 1500)
  4107	19:07:54.570213 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1980, len 40)
  4108	19:07:54.578058 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200641995 3400159> (DF) (ttl 49, id 33629, len 1500)
  4109	19:07:54.578802 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1981, len 40)
  4110	19:07:54.585493 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200641995 3400159> (DF) (ttl 49, id 33630, len 1252)
  4111	19:07:54.586249 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1982, len 40)
  4112	19:07:54.594305 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 200641995 3400159> (DF) (ttl 49, id 33631, len 1500)
  4113	19:07:54.595278 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1983, len 40)
  4114	19:07:54.603418 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 200641996 3400161> (DF) (ttl 49, id 33632, len 1500)
  4115	19:07:54.604182 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1984, len 40)
  4116	19:07:54.610383 clustera.icq.com.http > 172.16.183.2.1101: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 200641996 3400161> (DF) (ttl 49, id 33633, len 1252)
  4117	19:07:54.611101 172.16.183.2.1101 > clustera.icq.com.http: R [tcp sum ok] 3507853334:3507853334(0) win 0 (ttl 255, id 1985, len 40)
  4118	19:07:56.537165 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50799+ A? web.icq.com. [|domain] (ttl 64, id 1986, len 57)
  4119	19:07:56.558372 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50799* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 11060, len 233)
  4120	19:07:56.559629 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3400364 0,nop,wscale 0> (DF) (ttl 64, id 1987, len 60)
  4121	19:07:59.575009 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3400665 0,nop,wscale 0> (DF) (ttl 64, id 1988, len 60)
  4122	19:08:05.575201 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3401265 0,nop,wscale 0> (DF) (ttl 64, id 1989, len 60)
  4123	19:08:17.575325 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3402465 0,nop,wscale 0> (DF) (ttl 64, id 1990, len 60)
  4124	19:08:41.595541 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3404865 0,nop,wscale 0> (DF) (ttl 64, id 1991, len 60)
  4125	19:09:29.605337 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3409665 0,nop,wscale 0> (DF) (ttl 64, id 1992, len 60)
  4126	19:11:05.625132 172.16.183.2.1102 > clusterc.icq.com.http: S [tcp sum ok] 3704744152:3704744152(0) win 32120 <mss 1460,sackOK,timestamp 3419265 0,nop,wscale 0> (DF) (ttl 64, id 1993, len 60)
  4127	19:11:05.642017 clusterc.icq.com.http > 172.16.183.2.1102: S [tcp sum ok] 4200573296:4200573296(0) ack 3704744153 win 33304 <nop,nop,timestamp 215825228 3419265,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 20729, len 64)
  4128	19:11:05.642678 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3419266 215825228> (DF) (ttl 64, id 1994, len 52)
  4129	19:11:06.635429 172.16.183.2.1102 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3419366 215825228> (DF) (ttl 64, id 1995, len 104)
  4130	19:11:06.682937 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215825332 3419366> (DF) (ttl 49, id 20730, len 52)
  4131	19:11:07.121421 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215825375 3419366> (DF) (ttl 49, id 20731, len 1500)
  4132	19:11:07.122743 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3419444 215825375> (DF) (ttl 64, id 1996, len 52)
  4133	19:11:07.130294 clusterc.icq.com.http > 172.16.183.2.1102: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215825375 3419366> (DF) (ttl 49, id 20732, len 1500)
  4134	19:11:07.134983 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3419445 215825375> (DF) (ttl 64, id 1997, len 52)
  4135	19:11:07.139136 clusterc.icq.com.http > 172.16.183.2.1102: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215825375 3419366> (DF) (ttl 49, id 20733, len 1477)
  4136	19:11:07.145030 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3419447 215825375> (DF) (ttl 64, id 1998, len 52)
  4137	19:11:07.159859 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215825378 3419444> (DF) (ttl 49, id 20734, len 1500)
  4138	19:11:07.168726 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215825378 3419444> (DF) (ttl 49, id 20735, len 1500)
  4139	19:11:07.169819 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3419449 215825378> (DF) (ttl 64, id 1999, len 52)
  4140	19:11:07.176156 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215825379 3419445> (DF) (ttl 49, id 20736, len 1252)
  4141	19:11:07.184991 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215825379 3419445> (DF) (ttl 49, id 20737, len 1500)
  4142	19:11:07.190824 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3419454 215825379> (DF) (ttl 64, id 2000, len 52)
  4143	19:11:07.193860 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215825380 3419447> (DF) (ttl 49, id 20738, len 1500)
  4144	19:11:07.201053 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215825380 3419447> (DF) (ttl 49, id 20739, len 1252)
  4145	19:11:07.210123 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215825382 3419449> (DF) (ttl 49, id 20740, len 1500)
  4146	19:11:07.211303 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 30408 <nop,nop,timestamp 3419457 215825380> (DF) (ttl 64, id 2001, len 52)
  4147	19:11:07.218983 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215825382 3419449> (DF) (ttl 49, id 20741, len 1500)
  4148	19:11:07.225033 172.16.183.2.1102 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3419459 215825382> (DF) (ttl 64, id 2002, len 52)
  4149	19:11:07.226181 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215825382 3419449> (DF) (ttl 49, id 20742, len 1252)
  4150	19:11:07.230371 172.16.183.2.1102 > clusterc.icq.com.http: P [bad tcp cksum 61ae!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4151	19:11:07.230371 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3419459 215825382> (DF) (ttl 64, id 2003, len 52)
  4152	19:11:07.235725 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215825384 3419454> (DF) (ttl 49, id 20743, len 1500)
  4153	19:11:07.236898 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2004, len 40)
  4154	19:11:07.244602 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215825384 3419454> (DF) (ttl 49, id 20744, len 1500)
  4155	19:11:07.245944 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2005, len 40)
  4156	19:11:07.251799 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215825384 3419454> (DF) (ttl 49, id 20745, len 1252)
  4157	19:11:07.252810 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2006, len 40)
  4158	19:11:07.261092 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215825386 3419457> (DF) (ttl 49, id 20746, len 1500)
  4159	19:11:07.262162 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2007, len 40)
  4160	19:11:07.269721 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215825386 3419457> (DF) (ttl 49, id 20747, len 1500)
  4161	19:11:07.270894 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2008, len 40)
  4162	19:11:07.277160 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215825386 3419457> (DF) (ttl 49, id 20748, len 1252)
  4163	19:11:07.278219 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2009, len 40)
  4164	19:11:07.285987 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215825386 3419457> (DF) (ttl 49, id 20749, len 1500)
  4165	19:11:07.287020 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2010, len 40)
  4166	19:11:07.294852 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 215825388 3419459> (DF) (ttl 49, id 20750, len 1500)
  4167	19:11:07.295912 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2011, len 40)
  4168	19:11:07.302102 clusterc.icq.com.http > 172.16.183.2.1102: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 215825388 3419459> (DF) (ttl 49, id 20751, len 1252)
  4169	19:11:07.303106 172.16.183.2.1102 > clusterc.icq.com.http: R [tcp sum ok] 3704744205:3704744205(0) win 0 (ttl 255, id 2012, len 40)
  4170	19:11:09.217150 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50800+ A? web.icq.com. [|domain] (ttl 64, id 2013, len 57)
  4171	19:11:09.228844 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50800 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 21051, len 233)
  4172	19:11:09.230138 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3419661 0,nop,wscale 0> (DF) (ttl 64, id 2014, len 60)
  4173	19:11:12.225049 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3419961 0,nop,wscale 0> (DF) (ttl 64, id 2015, len 60)
  4174	19:11:18.265384 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3420561 0,nop,wscale 0> (DF) (ttl 64, id 2016, len 60)
  4175	19:11:30.275246 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3421761 0,nop,wscale 0> (DF) (ttl 64, id 2017, len 60)
  4176	19:11:54.405345 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3424161 0,nop,wscale 0> (DF) (ttl 64, id 2018, len 60)
  4177	19:12:42.405359 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3428961 0,nop,wscale 0> (DF) (ttl 64, id 2019, len 60)
  4178	19:14:18.315175 172.16.183.2.1103 > clusterb.icq.com.http: S [tcp sum ok] 3898256155:3898256155(0) win 32120 <mss 1460,sackOK,timestamp 3438561 0,nop,wscale 0> (DF) (ttl 64, id 2020, len 60)
  4179	19:14:18.333442 clusterb.icq.com.http > 172.16.183.2.1103: S [tcp sum ok] 231929465:231929465(0) ack 3898256156 win 33304 <nop,nop,timestamp 79145874 3438561,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 46005, len 64)
  4180	19:14:18.335088 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3438562 79145874> (DF) (ttl 64, id 2021, len 52)
  4181	19:14:19.335428 172.16.183.2.1103 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3438662 79145874> (DF) (ttl 64, id 2022, len 104)
  4182	19:14:19.352193 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 79145976 3438662> (DF) (ttl 49, id 46006, len 52)
  4183	19:14:20.083865 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 79146048 3438662> (DF) (ttl 49, id 46007, len 1500)
  4184	19:14:20.088330 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3438779 79146048> (DF) (ttl 64, id 2023, len 52)
  4185	19:14:20.092726 clusterb.icq.com.http > 172.16.183.2.1103: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 79146048 3438662> (DF) (ttl 49, id 46008, len 1500)
  4186	19:14:20.099107 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3438781 79146048> (DF) (ttl 64, id 2024, len 52)
  4187	19:14:20.101576 clusterb.icq.com.http > 172.16.183.2.1103: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 79146048 3438662> (DF) (ttl 49, id 46009, len 1477)
  4188	19:14:20.109118 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 30408 <nop,nop,timestamp 3438782 79146048> (DF) (ttl 64, id 2025, len 52)
  4189	19:14:20.116134 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 79146052 3438779> (DF) (ttl 49, id 46010, len 1500)
  4190	19:14:20.119119 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 30408 <nop,nop,timestamp 3438783 79146052> (DF) (ttl 64, id 2026, len 52)
  4191	19:14:20.125013 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 79146052 3438779> (DF) (ttl 49, id 46011, len 1500)
  4192	19:14:20.132196 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 79146052 3438781> (DF) (ttl 49, id 46012, len 1252)
  4193	19:14:20.139109 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 3438786 79146052> (DF) (ttl 64, id 2027, len 52)
  4194	19:14:20.141564 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 79146052 3438781> (DF) (ttl 49, id 46013, len 1500)
  4195	19:14:20.150139 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 79146053 3438782> (DF) (ttl 49, id 46014, len 1500)
  4196	19:14:20.150937 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 30408 <nop,nop,timestamp 3438788 79146052> (DF) (ttl 64, id 2028, len 52)
  4197	19:14:20.157577 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 79146053 3438782> (DF) (ttl 49, id 46015, len 1252)
  4198	19:14:20.165010 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 30408 <nop,nop,timestamp 3438790 79146053> (DF) (ttl 64, id 2029, len 52)
  4199	19:14:20.166384 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 79146054 3438783> (DF) (ttl 49, id 46016, len 1500)
  4200	19:14:20.175278 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 79146054 3438783> (DF) (ttl 49, id 46017, len 1500)
  4201	19:14:20.176119 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3438792 79146054> (DF) (ttl 64, id 2030, len 52)
  4202	19:14:20.182949 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 79146056 3438786> (DF) (ttl 49, id 46018, len 1252)
  4203	19:14:20.192257 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 79146056 3438786> (DF) (ttl 49, id 46019, len 1500)
  4204	19:14:20.193081 172.16.183.2.1103 > clusterb.icq.com.http: . [tcp sum ok] ack 16610 win 30408 <nop,nop,timestamp 3438795 79146056> (DF) (ttl 64, id 2031, len 52)
  4205	19:14:20.195232 172.16.183.2.1103 > clusterb.icq.com.http: P [bad tcp cksum 907a!] 53:104(51) ack 18058 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4206	19:14:20.195232 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 18058 win 31856 <nop,nop,timestamp 3438795 79146056> (DF) (ttl 64, id 2032, len 52)
  4207	19:14:20.200871 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 79146056 3438786> (DF) (ttl 49, id 46020, len 1500)
  4208	19:14:20.201714 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2033, len 40)
  4209	19:14:20.208310 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 79146058 3438788> (DF) (ttl 49, id 46021, len 1252)
  4210	19:14:20.209068 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2034, len 40)
  4211	19:14:20.217134 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 79146058 3438788> (DF) (ttl 49, id 46022, len 1500)
  4212	19:14:20.217952 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2035, len 40)
  4213	19:14:20.226238 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 79146059 3438790> (DF) (ttl 49, id 46023, len 1500)
  4214	19:14:20.227063 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2036, len 40)
  4215	19:14:20.233186 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 79146059 3438790> (DF) (ttl 49, id 46024, len 1252)
  4216	19:14:20.233886 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2037, len 40)
  4217	19:14:20.242505 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 79146059 3438790> (DF) (ttl 49, id 46025, len 1500)
  4218	19:14:20.243275 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2038, len 40)
  4219	19:14:20.251134 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 79146060 3438792> (DF) (ttl 49, id 46026, len 1500)
  4220	19:14:20.251906 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2039, len 40)
  4221	19:14:20.258571 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 79146060 3438792> (DF) (ttl 49, id 46027, len 1252)
  4222	19:14:20.259339 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2040, len 40)
  4223	19:14:20.267396 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 28898:30346(1448) ack 53 win 33304 <nop,nop,timestamp 79146060 3438792> (DF) (ttl 49, id 46028, len 1500)
  4224	19:14:20.268200 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2041, len 40)
  4225	19:14:20.276263 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 30346:31794(1448) ack 53 win 33304 <nop,nop,timestamp 79146062 3438795> (DF) (ttl 49, id 46029, len 1500)
  4226	19:14:20.277069 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2042, len 40)
  4227	19:14:20.283446 clusterb.icq.com.http > 172.16.183.2.1103: . [tcp sum ok] 31794:32994(1200) ack 53 win 33304 <nop,nop,timestamp 79146062 3438795> (DF) (ttl 49, id 46030, len 1252)
  4228	19:14:20.284147 172.16.183.2.1103 > clusterb.icq.com.http: R [tcp sum ok] 3898256208:3898256208(0) win 0 (ttl 255, id 2043, len 40)
  4229	19:14:22.197381 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50801+ A? web.icq.com. [|domain] (ttl 64, id 2044, len 57)
  4230	19:14:22.209026 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50801 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 30347, len 233)
  4231	19:14:22.210369 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3438997 0,nop,wscale 0> (DF) (ttl 64, id 2045, len 60)
  4232	19:14:25.205497 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3439298 0,nop,wscale 0> (DF) (ttl 64, id 2046, len 60)
  4233	19:14:31.195304 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3439898 0,nop,wscale 0> (DF) (ttl 64, id 2047, len 60)
  4234	19:14:43.215016 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3441098 0,nop,wscale 0> (DF) (ttl 64, id 2048, len 60)
  4235	19:15:07.235021 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3443498 0,nop,wscale 0> (DF) (ttl 64, id 2049, len 60)
  4236	19:15:55.225169 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3448298 0,nop,wscale 0> (DF) (ttl 64, id 2050, len 60)
  4237	19:17:31.315247 172.16.183.2.1104 > clustera.icq.com.http: S [tcp sum ok] 4127275227:4127275227(0) win 32120 <mss 1460,sackOK,timestamp 3457898 0,nop,wscale 0> (DF) (ttl 64, id 2051, len 60)
  4238	19:17:31.332841 clustera.icq.com.http > 172.16.183.2.1104: S [tcp sum ok] 2375692608:2375692608(0) ack 4127275228 win 33304 <nop,nop,timestamp 19747855 3457898,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 18583, len 64)
  4239	19:17:31.334450 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3457899 19747855> (DF) (ttl 64, id 2052, len 52)
  4240	19:17:32.335583 172.16.183.2.1104 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3457999 19747855> (DF) (ttl 64, id 2053, len 104)
  4241	19:17:32.373516 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 19747959 3457999> (DF) (ttl 49, id 18584, len 52)
  4242	19:17:32.965488 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 19748017 3457999> (DF) (ttl 49, id 18585, len 1500)
  4243	19:17:32.969935 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3458099 19748017> (DF) (ttl 64, id 2054, len 52)
  4244	19:17:32.976567 clustera.icq.com.http > 172.16.183.2.1104: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 19748017 3457999> (DF) (ttl 49, id 18586, len 1500)
  4245	19:17:32.987645 clustera.icq.com.http > 172.16.183.2.1104: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 19748017 3457999> (DF) (ttl 49, id 18587, len 1477)
  4246	19:17:32.997406 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3458102 19748017> (DF) (ttl 64, id 2055, len 52)
  4247	19:17:33.019938 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 19748022 3458099> (DF) (ttl 49, id 18588, len 1500)
  4248	19:17:33.030049 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 19748022 3458099> (DF) (ttl 49, id 18589, len 1500)
  4249	19:17:33.032701 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3458107 19748022> (DF) (ttl 64, id 2056, len 52)
  4250	19:17:33.066788 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 19748027 3458102> (DF) (ttl 49, id 18590, len 1252)
  4251	19:17:33.076847 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 19748027 3458102> (DF) (ttl 49, id 18591, len 1500)
  4252	19:17:33.086448 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 19748027 3458102> (DF) (ttl 49, id 18592, len 1500)
  4253	19:17:33.087184 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3458114 19748027> (DF) (ttl 64, id 2057, len 52)
  4254	19:17:33.093637 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 19748028 3458107> (DF) (ttl 49, id 18593, len 1252)
  4255	19:17:33.097363 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3458116 19748028> (DF) (ttl 64, id 2058, len 52)
  4256	19:17:33.103449 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 19748028 3458107> (DF) (ttl 49, id 18594, len 1500)
  4257	19:17:33.112571 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 19748028 3458107> (DF) (ttl 49, id 18595, len 1500)
  4258	19:17:33.113390 172.16.183.2.1104 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3458118 19748028> (DF) (ttl 64, id 2059, len 52)
  4259	19:17:33.118354 172.16.183.2.1104 > clustera.icq.com.http: P [bad tcp cksum 112f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4260	19:17:33.118354 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3458119 19748028> (DF) (ttl 64, id 2060, len 52)
  4261	19:17:33.120233 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 19748032 3458114> (DF) (ttl 49, id 18596, len 1252)
  4262	19:17:33.121008 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2061, len 40)
  4263	19:17:33.129313 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 19748032 3458114> (DF) (ttl 49, id 18597, len 1500)
  4264	19:17:33.130110 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2062, len 40)
  4265	19:17:33.138911 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 19748032 3458114> (DF) (ttl 49, id 18598, len 1500)
  4266	19:17:33.139680 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2063, len 40)
  4267	19:17:33.146350 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 19748032 3458114> (DF) (ttl 49, id 18599, len 1252)
  4268	19:17:33.147044 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2064, len 40)
  4269	19:17:33.155668 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 19748033 3458116> (DF) (ttl 49, id 18600, len 1500)
  4270	19:17:33.156437 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2065, len 40)
  4271	19:17:33.164797 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 19748033 3458116> (DF) (ttl 49, id 18601, len 1500)
  4272	19:17:33.165608 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2066, len 40)
  4273	19:17:33.172219 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 19748034 3458118> (DF) (ttl 49, id 18602, len 1252)
  4274	19:17:33.172881 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2067, len 40)
  4275	19:17:33.181287 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 19748034 3458118> (DF) (ttl 49, id 18603, len 1500)
  4276	19:17:33.182128 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2068, len 40)
  4277	19:17:33.190168 clustera.icq.com.http > 172.16.183.2.1104: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 19748034 3458118> (DF) (ttl 49, id 18604, len 1500)
  4278	19:17:33.190943 172.16.183.2.1104 > clustera.icq.com.http: R [tcp sum ok] 4127275280:4127275280(0) win 0 (ttl 255, id 2069, len 40)
  4279	19:17:35.107175 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50802+ A? web.icq.com. [|domain] (ttl 64, id 2070, len 57)
  4280	19:17:35.119969 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50802 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 40040, len 233)
  4281	19:17:35.121007 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3458321 0,nop,wscale 0> (DF) (ttl 64, id 2071, len 60)
  4282	19:17:38.125232 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3458621 0,nop,wscale 0> (DF) (ttl 64, id 2072, len 60)
  4283	19:17:44.095294 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3459221 0,nop,wscale 0> (DF) (ttl 64, id 2073, len 60)
  4284	19:17:56.095255 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3460421 0,nop,wscale 0> (DF) (ttl 64, id 2074, len 60)
  4285	19:18:20.115080 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3462821 0,nop,wscale 0> (DF) (ttl 64, id 2075, len 60)
  4286	19:19:08.105072 172.16.183.2.1105 > clustera.icq.com.http: S [tcp sum ok] 20478966:20478966(0) win 32120 <mss 1460,sackOK,timestamp 3467621 0,nop,wscale 0> (DF) (ttl 64, id 2076, len 60)
  4287	19:19:08.121887 clustera.icq.com.http > 172.16.183.2.1105: S [tcp sum ok] 932324554:932324554(0) ack 20478967 win 33304 <nop,nop,timestamp 19757536 3467621,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 18605, len 64)
  4288	19:19:08.122878 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3467622 19757536> (DF) (ttl 64, id 2077, len 52)
  4289	19:19:09.115445 172.16.183.2.1105 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3467722 19757536> (DF) (ttl 64, id 2078, len 104)
  4290	19:19:09.152474 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 19757639 3467722> (DF) (ttl 49, id 18606, len 52)
  4291	19:19:09.756769 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 19757698 3467722> (DF) (ttl 49, id 18607, len 1500)
  4292	19:19:09.761228 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3467821 19757698> (DF) (ttl 64, id 2079, len 52)
  4293	19:19:09.767600 clustera.icq.com.http > 172.16.183.2.1105: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 19757698 3467722> (DF) (ttl 49, id 18608, len 1500)
  4294	19:19:09.776502 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3467825 19757698> (DF) (ttl 64, id 2080, len 52)
  4295	19:19:09.778178 clustera.icq.com.http > 172.16.183.2.1105: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 19757698 3467722> (DF) (ttl 49, id 18609, len 1477)
  4296	19:19:09.796500 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3467828 19757698> (DF) (ttl 64, id 2081, len 52)
  4297	19:19:09.809486 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 19757703 3467821> (DF) (ttl 49, id 18610, len 1500)
  4298	19:19:09.819105 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 19757703 3467821> (DF) (ttl 49, id 18611, len 1500)
  4299	19:19:09.821681 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3467832 19757703> (DF) (ttl 64, id 2082, len 52)
  4300	19:19:09.830478 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 19757706 3467825> (DF) (ttl 49, id 18612, len 1252)
  4301	19:19:09.840798 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 19757706 3467825> (DF) (ttl 49, id 18613, len 1500)
  4302	19:19:09.855287 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3467838 19757706> (DF) (ttl 64, id 2083, len 52)
  4303	19:19:09.856048 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 19757708 3467828> (DF) (ttl 49, id 18614, len 1500)
  4304	19:19:09.864481 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 19757708 3467828> (DF) (ttl 49, id 18615, len 1252)
  4305	19:19:09.878225 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 19757710 3467832> (DF) (ttl 49, id 18616, len 1500)
  4306	19:19:09.879039 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3467842 19757708> (DF) (ttl 64, id 2084, len 52)
  4307	19:19:09.887354 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 19757710 3467832> (DF) (ttl 49, id 18617, len 1500)
  4308	19:19:09.888123 172.16.183.2.1105 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3467843 19757710> (DF) (ttl 64, id 2085, len 52)
  4309	19:19:09.892985 172.16.183.2.1105 > clustera.icq.com.http: P [bad tcp cksum 3c43!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4310	19:19:09.892985 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3467843 19757710> (DF) (ttl 64, id 2086, len 52)
  4311	19:19:09.894779 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 19757710 3467832> (DF) (ttl 49, id 18618, len 1252)
  4312	19:19:09.895725 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2087, len 40)
  4313	19:19:09.904073 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 19757711 3467838> (DF) (ttl 49, id 18619, len 1500)
  4314	19:19:09.904999 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2088, len 40)
  4315	19:19:09.913434 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 19757711 3467838> (DF) (ttl 49, id 18620, len 1500)
  4316	19:19:09.914178 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2089, len 40)
  4317	19:19:09.921118 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 19757711 3467838> (DF) (ttl 49, id 18621, len 1252)
  4318	19:19:09.921795 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2090, len 40)
  4319	19:19:09.930193 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 19757713 3467842> (DF) (ttl 49, id 18622, len 1500)
  4320	19:19:09.930947 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2091, len 40)
  4321	19:19:09.939550 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 19757713 3467842> (DF) (ttl 49, id 18623, len 1500)
  4322	19:19:09.940278 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2092, len 40)
  4323	19:19:09.947238 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 19757713 3467842> (DF) (ttl 49, id 18624, len 1252)
  4324	19:19:09.947968 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2093, len 40)
  4325	19:19:09.956308 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 19757714 3467843> (DF) (ttl 49, id 18625, len 1500)
  4326	19:19:09.957081 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2094, len 40)
  4327	19:19:09.965425 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 19757714 3467843> (DF) (ttl 49, id 18626, len 1500)
  4328	19:19:09.966157 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2095, len 40)
  4329	19:19:09.973101 clustera.icq.com.http > 172.16.183.2.1105: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 19757714 3467843> (DF) (ttl 49, id 18627, len 1252)
  4330	19:19:09.973869 172.16.183.2.1105 > clustera.icq.com.http: R [tcp sum ok] 20479019:20479019(0) win 0 (ttl 255, id 2096, len 40)
  4331	19:19:11.907392 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50803+ A? web.icq.com. [|domain] (ttl 64, id 2097, len 57)
  4332	19:19:11.926527 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50803* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 47724, len 233)
  4333	19:19:11.927641 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3468047 0,nop,wscale 0> (DF) (ttl 64, id 2098, len 60)
  4334	19:19:14.934966 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3468347 0,nop,wscale 0> (DF) (ttl 64, id 2099, len 60)
  4335	19:19:20.925240 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3468947 0,nop,wscale 0> (DF) (ttl 64, id 2100, len 60)
  4336	19:19:32.925128 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3470147 0,nop,wscale 0> (DF) (ttl 64, id 2101, len 60)
  4337	19:19:56.945167 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3472547 0,nop,wscale 0> (DF) (ttl 64, id 2102, len 60)
  4338	19:20:44.935201 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3477347 0,nop,wscale 0> (DF) (ttl 64, id 2103, len 60)
  4339	19:22:21.015233 172.16.183.2.1106 > clusterb.icq.com.http: S [tcp sum ok] 117241051:117241051(0) win 32120 <mss 1460,sackOK,timestamp 3486947 0,nop,wscale 0> (DF) (ttl 64, id 2104, len 60)
  4340	19:22:21.032338 clusterb.icq.com.http > 172.16.183.2.1106: S [tcp sum ok] 3436276405:3436276405(0) ack 117241052 win 65535 <nop,nop,timestamp 503803813 3486947,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 23667, len 64)
  4341	19:22:21.033793 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3486948 503803813> (DF) (ttl 64, id 2105, len 52)
  4342	19:22:22.035886 172.16.183.2.1106 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3487048 503803813> (DF) (ttl 64, id 2106, len 104)
  4343	19:22:22.055277 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 503803916 3487048> (DF) (ttl 240, id 23668, len 52)
  4344	19:22:22.558836 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 503803964 3487048> (DF) (ttl 240, id 23669, len 1500)
  4345	19:22:22.563527 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3487096 503803964> (DF) (ttl 64, id 2107, len 52)
  4346	19:22:22.572603 clusterb.icq.com.http > 172.16.183.2.1106: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 503803964 3487048> (DF) (ttl 240, id 23670, len 1500)
  4347	19:22:22.594947 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3487098 503803964> (DF) (ttl 64, id 2108, len 52)
  4348	19:22:22.618167 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 503803970 3487096> (DF) (ttl 240, id 23671, len 1477)
  4349	19:22:22.630011 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 503803970 3487096> (DF) (ttl 240, id 23672, len 1500)
  4350	19:22:22.665031 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3487105 503803970> (DF) (ttl 64, id 2109, len 52)
  4351	19:22:22.675350 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 503803976 3487098> (DF) (ttl 240, id 23673, len 1500)
  4352	19:22:22.685245 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 503803976 3487098> (DF) (ttl 240, id 23674, len 1252)
  4353	19:22:22.700966 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 503803979 3487105> (DF) (ttl 240, id 23675, len 1500)
  4354	19:22:22.701905 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3487108 503803976> (DF) (ttl 64, id 2110, len 52)
  4355	19:22:22.712058 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 503803979 3487105> (DF) (ttl 240, id 23676, len 1500)
  4356	19:22:22.721217 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 503803979 3487105> (DF) (ttl 240, id 23677, len 1252)
  4357	19:22:22.722154 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3487111 503803979> (DF) (ttl 64, id 2111, len 52)
  4358	19:22:22.732255 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 503803982 3487108> (DF) (ttl 240, id 23678, len 1500)
  4359	19:22:22.742844 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 503803982 3487108> (DF) (ttl 240, id 23679, len 1500)
  4360	19:22:22.743623 172.16.183.2.1106 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3487113 503803979> (DF) (ttl 64, id 2112, len 52)
  4361	19:22:22.748566 172.16.183.2.1106 > clusterb.icq.com.http: P [bad tcp cksum 4fe8!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4362	19:22:22.748566 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3487113 503803979> (DF) (ttl 64, id 2113, len 52)
  4363	19:22:22.751761 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 503803982 3487108> (DF) (ttl 240, id 23680, len 1252)
  4364	19:22:22.752530 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2114, len 40)
  4365	19:22:22.763518 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 503803982 3487108> (DF) (ttl 240, id 23681, len 1500)
  4366	19:22:22.764276 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2115, len 40)
  4367	19:22:22.774365 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 503803984 3487111> (DF) (ttl 240, id 23682, len 1500)
  4368	19:22:22.776178 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2116, len 40)
  4369	19:22:22.783035 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 503803984 3487111> (DF) (ttl 240, id 23683, len 1252)
  4370	19:22:22.783772 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2117, len 40)
  4371	19:22:22.794329 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 503803986 3487113> (DF) (ttl 240, id 23684, len 1500)
  4372	19:22:22.795286 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2118, len 40)
  4373	19:22:22.804423 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 503803986 3487113> (DF) (ttl 240, id 23685, len 1500)
  4374	19:22:22.805490 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2119, len 40)
  4375	19:22:22.812849 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 503803986 3487113> (DF) (ttl 240, id 23686, len 1252)
  4376	19:22:22.813519 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2120, len 40)
  4377	19:22:22.822907 clusterb.icq.com.http > 172.16.183.2.1106: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 503803986 3487113> (DF) (ttl 240, id 23687, len 1500)
  4378	19:22:22.823665 172.16.183.2.1106 > clusterb.icq.com.http: R [tcp sum ok] 117241104:117241104(0) win 0 (ttl 255, id 2121, len 40)
  4379	19:22:24.756991 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50804+ A? web.icq.com. [|domain] (ttl 64, id 2122, len 57)
  4380	19:22:24.769226 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50804 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 64373, len 233)
  4381	19:22:24.770523 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3487315 0,nop,wscale 0> (DF) (ttl 64, id 2123, len 60)
  4382	19:22:27.785367 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3487616 0,nop,wscale 0> (DF) (ttl 64, id 2124, len 60)
  4383	19:22:33.784934 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3488216 0,nop,wscale 0> (DF) (ttl 64, id 2125, len 60)
  4384	19:22:45.775166 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3489416 0,nop,wscale 0> (DF) (ttl 64, id 2126, len 60)
  4385	19:23:09.785108 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3491816 0,nop,wscale 0> (DF) (ttl 64, id 2127, len 60)
  4386	19:23:57.765394 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3496616 0,nop,wscale 0> (DF) (ttl 64, id 2128, len 60)
  4387	19:25:33.785437 172.16.183.2.1107 > clusterc.icq.com.http: S [tcp sum ok] 332826600:332826600(0) win 32120 <mss 1460,sackOK,timestamp 3506216 0,nop,wscale 0> (DF) (ttl 64, id 2129, len 60)
  4388	19:25:33.803115 clusterc.icq.com.http > 172.16.183.2.1107: S [tcp sum ok] 2276570757:2276570757(0) ack 332826601 win 33304 <nop,nop,timestamp 200708409 3506216,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 44091, len 64)
  4389	19:25:33.804038 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3506217 200708409> (DF) (ttl 64, id 2130, len 52)
  4390	19:25:34.805590 172.16.183.2.1107 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3506317 200708409> (DF) (ttl 64, id 2131, len 104)
  4391	19:25:34.825373 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200708511 3506317> (DF) (ttl 49, id 44092, len 52)
  4392	19:25:38.407031 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200708868 3506317> (DF) (ttl 49, id 44093, len 1500)
  4393	19:25:38.407805 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3506877 200708868> (DF) (ttl 64, id 2132, len 52)
  4394	19:25:38.427319 clusterc.icq.com.http > 172.16.183.2.1107: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200708868 3506317> (DF) (ttl 49, id 44094, len 1500)
  4395	19:25:38.447906 clusterc.icq.com.http > 172.16.183.2.1107: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200708868 3506317> (DF) (ttl 49, id 44095, len 1477)
  4396	19:25:38.453076 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3506885 200708868> (DF) (ttl 64, id 2133, len 52)
  4397	19:25:38.467877 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200708868 3506317> (DF) (ttl 49, id 44096, len 1500)
  4398	19:25:38.487582 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200708871 3506877> (DF) (ttl 49, id 44097, len 1500)
  4399	19:25:38.488323 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3506890 200708868> (DF) (ttl 64, id 2134, len 52)
  4400	19:25:38.502411 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200708871 3506877> (DF) (ttl 49, id 44098, len 1252)
  4401	19:25:38.519857 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200708876 3506885> (DF) (ttl 49, id 44099, len 1500)
  4402	19:25:38.525009 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3506896 200708871> (DF) (ttl 64, id 2135, len 52)
  4403	19:25:38.537109 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200708876 3506885> (DF) (ttl 49, id 44100, len 1500)
  4404	19:25:38.551441 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200708876 3506885> (DF) (ttl 49, id 44101, len 1252)
  4405	19:25:38.568899 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200708879 3506890> (DF) (ttl 49, id 44102, len 1500)
  4406	19:25:38.569637 172.16.183.2.1107 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3506903 200708876> (DF) (ttl 64, id 2136, len 52)
  4407	19:25:38.585395 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200708879 3506890> (DF) (ttl 49, id 44103, len 1500)
  4408	19:25:38.589642 172.16.183.2.1107 > clusterc.icq.com.http: P [bad tcp cksum 9741!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4409	19:25:38.589642 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3506905 200708879> (DF) (ttl 64, id 2137, len 52)
  4410	19:25:38.597769 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200708879 3506890> (DF) (ttl 49, id 44104, len 1252)
  4411	19:25:38.598563 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2138, len 40)
  4412	19:25:38.613468 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200708883 3506896> (DF) (ttl 49, id 44105, len 1500)
  4413	19:25:38.614247 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2139, len 40)
  4414	19:25:38.628494 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200708883 3506896> (DF) (ttl 49, id 44106, len 1500)
  4415	19:25:38.629251 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2140, len 40)
  4416	19:25:38.641099 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200708883 3506896> (DF) (ttl 49, id 44107, len 1252)
  4417	19:25:38.641846 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2141, len 40)
  4418	19:25:38.656337 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200708888 3506903> (DF) (ttl 49, id 44108, len 1500)
  4419	19:25:38.657107 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2142, len 40)
  4420	19:25:38.671358 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200708888 3506903> (DF) (ttl 49, id 44109, len 1500)
  4421	19:25:38.672138 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2143, len 40)
  4422	19:25:38.682496 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200708888 3506903> (DF) (ttl 49, id 44110, len 1252)
  4423	19:25:38.683188 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2144, len 40)
  4424	19:25:38.696737 clusterc.icq.com.http > 172.16.183.2.1107: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 200708888 3506903> (DF) (ttl 49, id 44111, len 1500)
  4425	19:25:38.697439 172.16.183.2.1107 > clusterc.icq.com.http: R [tcp sum ok] 332826653:332826653(0) win 0 (ttl 255, id 2145, len 40)
  4426	19:25:40.587104 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50805+ A? web.icq.com. [|domain] (ttl 64, id 2146, len 57)
  4427	19:25:40.616721 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50805 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 15873, len 244)
  4428	19:25:40.618024 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3507109 0,nop,wscale 0> (DF) (ttl 64, id 2147, len 60)
  4429	19:25:43.714934 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3507409 0,nop,wscale 0> (DF) (ttl 64, id 2148, len 60)
  4430	19:25:49.705163 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3508009 0,nop,wscale 0> (DF) (ttl 64, id 2149, len 60)
  4431	19:26:01.705035 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3509209 0,nop,wscale 0> (DF) (ttl 64, id 2150, len 60)
  4432	19:26:25.765255 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3511609 0,nop,wscale 0> (DF) (ttl 64, id 2151, len 60)
  4433	19:27:13.825223 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3516409 0,nop,wscale 0> (DF) (ttl 64, id 2152, len 60)
  4434	19:28:49.805387 172.16.183.2.1108 > clusterb.icq.com.http: S [tcp sum ok] 525728838:525728838(0) win 32120 <mss 1460,sackOK,timestamp 3526009 0,nop,wscale 0> (DF) (ttl 64, id 2153, len 60)
  4435	19:28:49.824514 clusterb.icq.com.http > 172.16.183.2.1108: S [tcp sum ok] 3680525626:3680525626(0) ack 525728839 win 33304 <nop,nop,timestamp 79233042 3526009,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 181, len 64)
  4436	19:28:49.825443 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3526010 79233042> (DF) (ttl 64, id 2154, len 52)
  4437	19:28:50.825643 172.16.183.2.1108 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3526110 79233042> (DF) (ttl 64, id 2155, len 104)
  4438	19:28:50.845241 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 79233144 3526110> (DF) (ttl 49, id 182, len 52)
  4439	19:28:51.408632 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 79233199 3526110> (DF) (ttl 49, id 183, len 1500)
  4440	19:28:51.409377 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3526198 79233199> (DF) (ttl 64, id 2156, len 52)
  4441	19:28:51.424146 clusterb.icq.com.http > 172.16.183.2.1108: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 79233199 3526110> (DF) (ttl 49, id 184, len 1500)
  4442	19:28:51.439402 clusterb.icq.com.http > 172.16.183.2.1108: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 79233199 3526110> (DF) (ttl 49, id 185, len 1477)
  4443	19:28:51.451340 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3526206 79233199> (DF) (ttl 64, id 2157, len 52)
  4444	19:28:51.454201 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 79233203 3526198> (DF) (ttl 49, id 186, len 1500)
  4445	19:28:51.469511 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 79233203 3526198> (DF) (ttl 49, id 187, len 1500)
  4446	19:28:51.470220 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3526208 79233203> (DF) (ttl 64, id 2158, len 52)
  4447	19:28:51.481847 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 79233207 3526206> (DF) (ttl 49, id 188, len 1252)
  4448	19:28:51.496340 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 79233207 3526206> (DF) (ttl 49, id 189, len 1500)
  4449	19:28:51.509402 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 79233207 3526206> (DF) (ttl 49, id 190, len 1500)
  4450	19:28:51.510157 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3526215 79233207> (DF) (ttl 64, id 2159, len 52)
  4451	19:28:51.521264 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 79233209 3526208> (DF) (ttl 49, id 191, len 1252)
  4452	19:28:51.534776 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 79233209 3526208> (DF) (ttl 49, id 192, len 1500)
  4453	19:28:51.541327 172.16.183.2.1108 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3526221 79233209> (DF) (ttl 64, id 2160, len 52)
  4454	19:28:51.548074 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 79233209 3526208> (DF) (ttl 49, id 193, len 1500)
  4455	19:28:51.552372 172.16.183.2.1108 > clusterb.icq.com.http: P [bad tcp cksum 73c7!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4456	19:28:51.552372 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3526223 79233209> (DF) (ttl 64, id 2161, len 52)
  4457	19:28:51.558944 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 79233213 3526215> (DF) (ttl 49, id 194, len 1252)
  4458	19:28:51.559714 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2162, len 40)
  4459	19:28:51.572455 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 79233213 3526215> (DF) (ttl 49, id 195, len 1500)
  4460	19:28:51.573236 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2163, len 40)
  4461	19:28:51.585508 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 79233213 3526215> (DF) (ttl 49, id 196, len 1500)
  4462	19:28:51.586247 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2164, len 40)
  4463	19:28:51.595659 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 79233213 3526215> (DF) (ttl 49, id 197, len 1252)
  4464	19:28:51.596386 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2165, len 40)
  4465	19:28:51.607678 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 79233216 3526221> (DF) (ttl 49, id 198, len 1500)
  4466	19:28:51.608476 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2166, len 40)
  4467	19:28:51.619992 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 79233216 3526221> (DF) (ttl 49, id 199, len 1500)
  4468	19:28:51.620795 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2167, len 40)
  4469	19:28:51.630140 clusterb.icq.com.http > 172.16.183.2.1108: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 79233216 3526221> (DF) (ttl 49, id 200, len 1252)
  4470	19:28:51.630832 172.16.183.2.1108 > clusterb.icq.com.http: R [tcp sum ok] 525728891:525728891(0) win 0 (ttl 255, id 2168, len 40)
  4471	19:28:53.537178 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50806+ A? web.icq.com. [|domain] (ttl 64, id 2169, len 57)
  4472	19:28:53.552030 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50806 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 34780, len 233)
  4473	19:28:53.553425 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3526425 0,nop,wscale 0> (DF) (ttl 64, id 2170, len 60)
  4474	19:28:56.565238 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3526726 0,nop,wscale 0> (DF) (ttl 64, id 2171, len 60)
  4475	19:29:02.555250 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3527326 0,nop,wscale 0> (DF) (ttl 64, id 2172, len 60)
  4476	19:29:14.555182 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3528526 0,nop,wscale 0> (DF) (ttl 64, id 2173, len 60)
  4477	19:29:38.605173 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3530926 0,nop,wscale 0> (DF) (ttl 64, id 2174, len 60)
  4478	19:30:26.625228 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3535726 0,nop,wscale 0> (DF) (ttl 64, id 2175, len 60)
  4479	19:32:02.905045 172.16.183.2.kpop > clustera.icq.com.http: S [tcp sum ok] 766039400:766039400(0) win 32120 <mss 1460,sackOK,timestamp 3545326 0,nop,wscale 0> (DF) (ttl 64, id 2176, len 60)
  4480	19:32:02.931825 clustera.icq.com.http > 172.16.183.2.kpop: S [tcp sum ok] 3645934181:3645934181(0) ack 766039401 win 65535 <nop,nop,timestamp 502438692 3545326,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 3945, len 64)
  4481	19:32:02.932741 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3545328 502438692> (DF) (ttl 64, id 2177, len 52)
  4482	19:32:03.925423 172.16.183.2.kpop > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3545428 502438692> (DF) (ttl 64, id 2178, len 104)
  4483	19:32:03.943172 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502438794 3545428> (DF) (ttl 240, id 3946, len 52)
  4484	19:32:04.409985 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502438840 3545428> (DF) (ttl 240, id 3947, len 1500)
  4485	19:32:04.410852 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3545504 502438840> (DF) (ttl 64, id 2179, len 52)
  4486	19:32:04.418618 clustera.icq.com.http > 172.16.183.2.kpop: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502438840 3545428> (DF) (ttl 240, id 3948, len 1500)
  4487	19:32:04.424954 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3545506 502438840> (DF) (ttl 64, id 2180, len 52)
  4488	19:32:04.437574 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502438842 3545504> (DF) (ttl 240, id 3949, len 1477)
  4489	19:32:04.446691 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502438842 3545504> (DF) (ttl 240, id 3950, len 1500)
  4490	19:32:04.455316 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502438844 3545506> (DF) (ttl 240, id 3951, len 1500)
  4491	19:32:04.456028 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3545511 502438842> (DF) (ttl 64, id 2181, len 52)
  4492	19:32:04.462751 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502438844 3545506> (DF) (ttl 240, id 3952, len 1252)
  4493	19:32:04.479590 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3545516 502438844> (DF) (ttl 64, id 2182, len 52)
  4494	19:32:04.481928 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502438847 3545511> (DF) (ttl 240, id 3953, len 1500)
  4495	19:32:04.490555 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502438847 3545511> (DF) (ttl 240, id 3954, len 1500)
  4496	19:32:04.491306 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3545518 502438847> (DF) (ttl 64, id 2183, len 52)
  4497	19:32:04.497998 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502438847 3545511> (DF) (ttl 240, id 3955, len 1252)
  4498	19:32:04.506821 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502438847 3545511> (DF) (ttl 240, id 3956, len 1500)
  4499	19:32:04.509618 172.16.183.2.kpop > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3545522 502438847> (DF) (ttl 64, id 2184, len 52)
  4500	19:32:04.515925 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502438849 3545516> (DF) (ttl 240, id 3957, len 1500)
  4501	19:32:04.521873 172.16.183.2.kpop > clustera.icq.com.http: P [bad tcp cksum 1b5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4502	19:32:04.521873 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3545523 502438849> (DF) (ttl 64, id 2185, len 52)
  4503	19:32:04.523116 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502438849 3545516> (DF) (ttl 240, id 3958, len 1252)
  4504	19:32:04.523837 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2186, len 40)
  4505	19:32:04.532176 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502438850 3545518> (DF) (ttl 240, id 3959, len 1500)
  4506	19:32:04.532904 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2187, len 40)
  4507	19:32:04.540801 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502438850 3545518> (DF) (ttl 240, id 3960, len 1500)
  4508	19:32:04.541537 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2188, len 40)
  4509	19:32:04.548238 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502438850 3545518> (DF) (ttl 240, id 3961, len 1252)
  4510	19:32:04.548941 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2189, len 40)
  4511	19:32:04.557056 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502438852 3545522> (DF) (ttl 240, id 3962, len 1500)
  4512	19:32:04.557829 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2190, len 40)
  4513	19:32:04.566171 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502438852 3545522> (DF) (ttl 240, id 3963, len 1500)
  4514	19:32:04.566964 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2191, len 40)
  4515	19:32:04.573114 clustera.icq.com.http > 172.16.183.2.kpop: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502438852 3545522> (DF) (ttl 240, id 3964, len 1252)
  4516	19:32:04.573778 172.16.183.2.kpop > clustera.icq.com.http: R [tcp sum ok] 766039453:766039453(0) win 0 (ttl 255, id 2192, len 40)
  4517	19:32:06.516805 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50807+ A? web.icq.com. [|domain] (ttl 64, id 2193, len 57)
  4518	19:32:06.538608 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50807* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 53486, len 233)
  4519	19:32:06.539578 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3545727 0,nop,wscale 0> (DF) (ttl 64, id 2194, len 60)
  4520	19:32:09.545092 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3546027 0,nop,wscale 0> (DF) (ttl 64, id 2195, len 60)
  4521	19:32:15.545099 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3546627 0,nop,wscale 0> (DF) (ttl 64, id 2196, len 60)
  4522	19:32:27.545257 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3547827 0,nop,wscale 0> (DF) (ttl 64, id 2197, len 60)
  4523	19:32:51.545113 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3550227 0,nop,wscale 0> (DF) (ttl 64, id 2198, len 60)
  4524	19:33:39.545103 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3555027 0,nop,wscale 0> (DF) (ttl 64, id 2199, len 60)
  4525	19:35:15.495139 172.16.183.2.1110 > clusterb.icq.com.http: S [tcp sum ok] 955861116:955861116(0) win 32120 <mss 1460,sackOK,timestamp 3564627 0,nop,wscale 0> (DF) (ttl 64, id 2200, len 60)
  4526	19:35:15.513347 clusterb.icq.com.http > 172.16.183.2.1110: S [tcp sum ok] 1667365494:1667365494(0) ack 955861117 win 65535 <nop,nop,timestamp 502610151 3564627,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 14599, len 64)
  4527	19:35:15.514051 172.16.183.2.1110 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3564628 502610151> (DF) (ttl 64, id 2201, len 52)
  4528	19:35:16.515548 172.16.183.2.1110 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3564728 502610151> (DF) (ttl 64, id 2202, len 104)
  4529	19:35:16.553788 clusterb.icq.com.http > 172.16.183.2.1110: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502610255 3564728> (DF) (ttl 240, id 14600, len 52)
  4530	19:35:16.807081 clusterb.icq.com.http > 172.16.183.2.1110: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 502610280 3564728> (DF) (ttl 240, id 14601, len 391)
  4531	19:35:16.807278 clusterb.icq.com.http > 172.16.183.2.1110: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 502610280 3564728> (DF) (ttl 240, id 14602, len 52)
  4532	19:35:16.811794 172.16.183.2.1110 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 3564773 502610280> (DF) (ttl 64, id 2203, len 52)
  4533	19:35:16.812200 172.16.183.2.1110 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 3564773 502610280> (DF) (ttl 64, id 2204, len 52)
  4534	19:35:41.304923 172.16.183.2.1110 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 3567322 502610280> (DF) (ttl 64, id 2205, len 52)
  4535	19:35:41.321941 172.16.183.2.1110 > clusterb.icq.com.http: P [bad tcp cksum 8d71!] 711504719:711504770(51) ack 3583462972 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4536	19:35:41.321941 clusterb.icq.com.http > 172.16.183.2.1110: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 502612732 3567322> (DF) (ttl 240, id 14603, len 52)
  4537	19:35:42.307822 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50808+ A? web.icq.com. [|domain] (ttl 64, id 2206, len 57)
  4538	19:35:42.337899 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50808 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 7828, len 244)
  4539	19:35:42.340157 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3567425 0,nop,wscale 0> (DF) (ttl 64, id 2207, len 60)
  4540	19:35:45.404883 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3567725 0,nop,wscale 0> (DF) (ttl 64, id 2208, len 60)
  4541	19:35:51.395138 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3568325 0,nop,wscale 0> (DF) (ttl 64, id 2209, len 60)
  4542	19:36:03.395137 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3569525 0,nop,wscale 0> (DF) (ttl 64, id 2210, len 60)
  4543	19:36:27.435111 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3571925 0,nop,wscale 0> (DF) (ttl 64, id 2211, len 60)
  4544	19:37:15.485037 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3576725 0,nop,wscale 0> (DF) (ttl 64, id 2212, len 60)
  4545	19:38:51.465209 172.16.183.2.1111 > clustera.icq.com.http: S [tcp sum ok] 1193331293:1193331293(0) win 32120 <mss 1460,sackOK,timestamp 3586325 0,nop,wscale 0> (DF) (ttl 64, id 2213, len 60)
  4546	19:38:51.483387 clustera.icq.com.http > 172.16.183.2.1111: S [tcp sum ok] 1368033351:1368033351(0) ack 1193331294 win 65535 <nop,nop,timestamp 502747265 3586325,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 9483, len 64)
  4547	19:38:51.484608 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3586326 502747265> (DF) (ttl 64, id 2214, len 52)
  4548	19:38:52.485440 172.16.183.2.1111 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3586426 502747265> (DF) (ttl 64, id 2215, len 104)
  4549	19:38:52.593779 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502747376 3586426> (DF) (ttl 240, id 9484, len 52)
  4550	19:38:53.146838 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502747431 3586426> (DF) (ttl 240, id 9485, len 1500)
  4551	19:38:53.155053 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3586513 502747431> (DF) (ttl 64, id 2216, len 52)
  4552	19:38:53.157913 clustera.icq.com.http > 172.16.183.2.1111: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502747431 3586426> (DF) (ttl 240, id 9486, len 1500)
  4553	19:38:53.175981 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3586515 502747431> (DF) (ttl 64, id 2217, len 52)
  4554	19:38:53.223462 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502747438 3586513> (DF) (ttl 240, id 9487, len 1477)
  4555	19:38:53.234078 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502747438 3586513> (DF) (ttl 240, id 9488, len 1500)
  4556	19:38:53.249567 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502747441 3586515> (DF) (ttl 240, id 9489, len 1500)
  4557	19:38:53.252314 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3586522 502747438> (DF) (ttl 64, id 2218, len 52)
  4558	19:38:53.258007 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502747441 3586515> (DF) (ttl 240, id 9490, len 1252)
  4559	19:38:53.279870 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502747444 3586522> (DF) (ttl 240, id 9491, len 1500)
  4560	19:38:53.285973 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3586526 502747441> (DF) (ttl 64, id 2219, len 52)
  4561	19:38:53.289960 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502747444 3586522> (DF) (ttl 240, id 9492, len 1500)
  4562	19:38:53.298149 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502747444 3586522> (DF) (ttl 240, id 9493, len 1252)
  4563	19:38:53.305972 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3586528 502747444> (DF) (ttl 64, id 2220, len 52)
  4564	19:38:53.308204 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502747444 3586522> (DF) (ttl 240, id 9494, len 1500)
  4565	19:38:53.324882 172.16.183.2.1111 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3586530 502747444> (DF) (ttl 64, id 2221, len 52)
  4566	19:38:53.345409 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502747451 3586526> (DF) (ttl 240, id 9495, len 1500)
  4567	19:38:53.350525 172.16.183.2.1111 > clustera.icq.com.http: P [bad tcp cksum 7530!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4568	19:38:53.350525 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3586532 502747451> (DF) (ttl 64, id 2222, len 52)
  4569	19:38:53.353315 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502747451 3586526> (DF) (ttl 240, id 9496, len 1252)
  4570	19:38:53.354081 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2223, len 40)
  4571	19:38:53.362876 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502747451 3586526> (DF) (ttl 240, id 9497, len 1500)
  4572	19:38:53.363631 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2224, len 40)
  4573	19:38:53.372247 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502747453 3586528> (DF) (ttl 240, id 9498, len 1500)
  4574	19:38:53.372988 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2225, len 40)
  4575	19:38:53.379431 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502747453 3586528> (DF) (ttl 240, id 9499, len 1252)
  4576	19:38:53.380129 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2226, len 40)
  4577	19:38:53.389243 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502747453 3586528> (DF) (ttl 240, id 9500, len 1500)
  4578	19:38:53.390003 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2227, len 40)
  4579	19:38:53.398117 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502747453 3586530> (DF) (ttl 240, id 9501, len 1500)
  4580	19:38:53.398864 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2228, len 40)
  4581	19:38:53.405552 clustera.icq.com.http > 172.16.183.2.1111: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502747453 3586530> (DF) (ttl 240, id 9502, len 1252)
  4582	19:38:53.406240 172.16.183.2.1111 > clustera.icq.com.http: R [tcp sum ok] 1193331346:1193331346(0) win 0 (ttl 255, id 2229, len 40)
  4583	19:38:55.347457 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50809+ A? web.icq.com. [|domain] (ttl 64, id 2230, len 57)
  4584	19:38:55.359702 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50809 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 17894, len 233)
  4585	19:38:55.360737 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3586733 0,nop,wscale 0> (DF) (ttl 64, id 2231, len 60)
  4586	19:38:58.365138 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3587033 0,nop,wscale 0> (DF) (ttl 64, id 2232, len 60)
  4587	19:39:04.365028 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3587633 0,nop,wscale 0> (DF) (ttl 64, id 2233, len 60)
  4588	19:39:16.365071 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3588833 0,nop,wscale 0> (DF) (ttl 64, id 2234, len 60)
  4589	19:39:40.365206 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3591233 0,nop,wscale 0> (DF) (ttl 64, id 2235, len 60)
  4590	19:40:28.365303 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3596033 0,nop,wscale 0> (DF) (ttl 64, id 2236, len 60)
  4591	19:42:04.735075 172.16.183.2.1112 > clusterb.icq.com.http: S [tcp sum ok] 1377970916:1377970916(0) win 32120 <mss 1460,sackOK,timestamp 3605633 0,nop,wscale 0> (DF) (ttl 64, id 2237, len 60)
  4592	19:42:04.752783 clusterb.icq.com.http > 172.16.183.2.1112: S [tcp sum ok] 973059998:973059998(0) ack 1377970917 win 65535 <nop,nop,timestamp 502492968 3605633,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22417, len 64)
  4593	19:42:04.754836 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3605634 502492968> (DF) (ttl 64, id 2238, len 52)
  4594	19:42:05.755589 172.16.183.2.1112 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3605734 502492968> (DF) (ttl 64, id 2239, len 104)
  4595	19:42:05.773268 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502493070 3605734> (DF) (ttl 240, id 22418, len 52)
  4596	19:42:06.403681 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502493132 3605734> (DF) (ttl 240, id 22419, len 1500)
  4597	19:42:06.412277 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3605832 502493132> (DF) (ttl 64, id 2240, len 52)
  4598	19:42:06.413947 clusterb.icq.com.http > 172.16.183.2.1112: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502493132 3605734> (DF) (ttl 240, id 22420, len 1500)
  4599	19:42:06.424259 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3605833 502493132> (DF) (ttl 64, id 2241, len 52)
  4600	19:42:06.474858 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502493139 3605832> (DF) (ttl 240, id 22421, len 1477)
  4601	19:42:06.484747 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502493139 3605832> (DF) (ttl 240, id 22422, len 1500)
  4602	19:42:06.496817 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502493141 3605833> (DF) (ttl 240, id 22423, len 1500)
  4603	19:42:06.500336 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3605845 502493139> (DF) (ttl 64, id 2242, len 52)
  4604	19:42:06.504503 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502493141 3605833> (DF) (ttl 240, id 22424, len 1252)
  4605	19:42:06.524906 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3605849 502493141> (DF) (ttl 64, id 2243, len 52)
  4606	19:42:06.558889 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502493147 3605845> (DF) (ttl 240, id 22425, len 1500)
  4607	19:42:06.567770 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502493147 3605845> (DF) (ttl 240, id 22426, len 1500)
  4608	19:42:06.568576 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3605855 502493147> (DF) (ttl 64, id 2244, len 52)
  4609	19:42:06.575445 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502493147 3605845> (DF) (ttl 240, id 22427, len 1252)
  4610	19:42:06.584276 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502493147 3605845> (DF) (ttl 240, id 22428, len 1500)
  4611	19:42:06.593383 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502493148 3605849> (DF) (ttl 240, id 22429, len 1500)
  4612	19:42:06.594067 172.16.183.2.1112 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3605857 502493147> (DF) (ttl 64, id 2245, len 52)
  4613	19:42:06.598870 172.16.183.2.1112 > clusterb.icq.com.http: P [bad tcp cksum feac!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4614	19:42:06.598870 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3605857 502493147> (DF) (ttl 64, id 2246, len 52)
  4615	19:42:06.600553 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502493148 3605849> (DF) (ttl 240, id 22430, len 1252)
  4616	19:42:06.601372 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2247, len 40)
  4617	19:42:06.609626 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502493151 3605855> (DF) (ttl 240, id 22431, len 1500)
  4618	19:42:06.610405 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2248, len 40)
  4619	19:42:06.618254 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502493151 3605855> (DF) (ttl 240, id 22432, len 1500)
  4620	19:42:06.618967 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2249, len 40)
  4621	19:42:06.625695 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502493151 3605855> (DF) (ttl 240, id 22433, len 1252)
  4622	19:42:06.626450 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2250, len 40)
  4623	19:42:06.634514 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502493154 3605857> (DF) (ttl 240, id 22434, len 1500)
  4624	19:42:06.635490 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2251, len 40)
  4625	19:42:06.643619 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502493154 3605857> (DF) (ttl 240, id 22435, len 1500)
  4626	19:42:06.644414 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2252, len 40)
  4627	19:42:06.650823 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502493154 3605857> (DF) (ttl 240, id 22436, len 1252)
  4628	19:42:06.651582 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2253, len 40)
  4629	19:42:06.659887 clusterb.icq.com.http > 172.16.183.2.1112: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502493154 3605857> (DF) (ttl 240, id 22437, len 1500)
  4630	19:42:06.660590 172.16.183.2.1112 > clusterb.icq.com.http: R [tcp sum ok] 1377970969:1377970969(0) win 0 (ttl 255, id 2254, len 40)
  4631	19:42:08.606927 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50810+ A? web.icq.com. [|domain] (ttl 64, id 2255, len 57)
  4632	19:42:08.631827 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50810* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 28102, len 233)
  4633	19:42:08.632975 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3606061 0,nop,wscale 0> (DF) (ttl 64, id 2256, len 60)
  4634	19:42:11.634926 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3606361 0,nop,wscale 0> (DF) (ttl 64, id 2257, len 60)
  4635	19:42:17.655282 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3606961 0,nop,wscale 0> (DF) (ttl 64, id 2258, len 60)
  4636	19:42:29.655389 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3608161 0,nop,wscale 0> (DF) (ttl 64, id 2259, len 60)
  4637	19:42:53.685109 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3610561 0,nop,wscale 0> (DF) (ttl 64, id 2260, len 60)
  4638	19:43:41.675378 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3615361 0,nop,wscale 0> (DF) (ttl 64, id 2261, len 60)
  4639	19:45:17.615093 172.16.183.2.1113 > clusterb.icq.com.http: S [tcp sum ok] 1591118712:1591118712(0) win 32120 <mss 1460,sackOK,timestamp 3624961 0,nop,wscale 0> (DF) (ttl 64, id 2262, len 60)
  4640	19:45:17.635645 clusterb.icq.com.http > 172.16.183.2.1113: S [tcp sum ok] 2065699442:2065699442(0) ack 1591118713 win 33304 <nop,nop,timestamp 140101066 3624961,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 47589, len 64)
  4641	19:45:17.637232 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3624963 140101066> (DF) (ttl 64, id 2263, len 52)
  4642	19:45:18.635769 172.16.183.2.1113 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3625063 140101066> (DF) (ttl 64, id 2264, len 104)
  4643	19:45:18.654153 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 140101167 3625063> (DF) (ttl 49, id 47590, len 52)
  4644	19:45:19.320291 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 140101233 3625063> (DF) (ttl 49, id 47591, len 1500)
  4645	19:45:19.328725 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3625142 140101233> (DF) (ttl 64, id 2265, len 52)
  4646	19:45:19.330390 clusterb.icq.com.http > 172.16.183.2.1113: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 140101233 3625063> (DF) (ttl 49, id 47592, len 1500)
  4647	19:45:19.339982 clusterb.icq.com.http > 172.16.183.2.1113: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 140101233 3625063> (DF) (ttl 49, id 47593, len 1477)
  4648	19:45:19.347392 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3625143 140101233> (DF) (ttl 64, id 2266, len 52)
  4649	19:45:19.352547 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 30408 <nop,nop,timestamp 3625144 140101233> (DF) (ttl 64, id 2267, len 52)
  4650	19:45:19.374498 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 140101238 3625142> (DF) (ttl 49, id 47594, len 1500)
  4651	19:45:19.383853 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 140101238 3625142> (DF) (ttl 49, id 47595, len 1500)
  4652	19:45:19.387362 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3625148 140101238> (DF) (ttl 64, id 2268, len 52)
  4653	19:45:19.421107 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 140101243 3625143> (DF) (ttl 49, id 47596, len 1252)
  4654	19:45:19.430909 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 140101243 3625143> (DF) (ttl 49, id 47597, len 1500)
  4655	19:45:19.448420 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 140101246 3625144> (DF) (ttl 49, id 47598, len 1500)
  4656	19:45:19.449236 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3625155 140101243> (DF) (ttl 64, id 2269, len 52)
  4657	19:45:19.455839 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 140101246 3625144> (DF) (ttl 49, id 47599, len 1252)
  4658	19:45:19.472557 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 140101248 3625148> (DF) (ttl 49, id 47600, len 1500)
  4659	19:45:19.473280 172.16.183.2.1113 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3625157 140101246> (DF) (ttl 64, id 2270, len 52)
  4660	19:45:19.481409 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 140101248 3625148> (DF) (ttl 49, id 47601, len 1500)
  4661	19:45:19.488626 172.16.183.2.1113 > clusterb.icq.com.http: P [bad tcp cksum bfa3!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4662	19:45:19.488626 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3625158 140101248> (DF) (ttl 64, id 2271, len 52)
  4663	19:45:19.488830 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 140101248 3625148> (DF) (ttl 49, id 47602, len 1252)
  4664	19:45:19.490165 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2272, len 40)
  4665	19:45:19.535857 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 140101255 3625155> (DF) (ttl 49, id 47603, len 1500)
  4666	19:45:19.536623 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2273, len 40)
  4667	19:45:19.544962 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 140101255 3625155> (DF) (ttl 49, id 47604, len 1500)
  4668	19:45:19.545758 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2274, len 40)
  4669	19:45:19.552141 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 140101255 3625155> (DF) (ttl 49, id 47605, len 1252)
  4670	19:45:19.552817 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2275, len 40)
  4671	19:45:19.561220 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 140101255 3625157> (DF) (ttl 49, id 47606, len 1500)
  4672	19:45:19.561990 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2276, len 40)
  4673	19:45:19.569869 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 140101255 3625157> (DF) (ttl 49, id 47607, len 1500)
  4674	19:45:19.570627 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2277, len 40)
  4675	19:45:19.577287 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 140101255 3625157> (DF) (ttl 49, id 47608, len 1252)
  4676	19:45:19.577974 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2278, len 40)
  4677	19:45:19.586110 clusterb.icq.com.http > 172.16.183.2.1113: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 140101255 3625157> (DF) (ttl 49, id 47609, len 1500)
  4678	19:45:19.586904 172.16.183.2.1113 > clusterb.icq.com.http: R [tcp sum ok] 1591118765:1591118765(0) win 0 (ttl 255, id 2279, len 40)
  4679	19:45:21.496912 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50811+ A? web.icq.com. [|domain] (ttl 64, id 2280, len 57)
  4680	19:45:21.508272 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50811 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (189) (ttl 61, id 38713, len 217)
  4681	19:45:21.509232 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3625360 0,nop,wscale 0> (DF) (ttl 64, id 2281, len 60)
  4682	19:45:24.515327 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3625660 0,nop,wscale 0> (DF) (ttl 64, id 2282, len 60)
  4683	19:45:30.515375 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3626260 0,nop,wscale 0> (DF) (ttl 64, id 2283, len 60)
  4684	19:45:42.505243 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3627460 0,nop,wscale 0> (DF) (ttl 64, id 2284, len 60)
  4685	19:46:06.595003 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3629860 0,nop,wscale 0> (DF) (ttl 64, id 2285, len 60)
  4686	19:46:54.675114 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3634660 0,nop,wscale 0> (DF) (ttl 64, id 2286, len 60)
  4687	19:48:30.665302 172.16.183.2.1114 > clusterb.icq.com.http: S [tcp sum ok] 1786439494:1786439494(0) win 32120 <mss 1460,sackOK,timestamp 3644260 0,nop,wscale 0> (DF) (ttl 64, id 2287, len 60)
  4688	19:48:30.684595 clusterb.icq.com.http > 172.16.183.2.1114: S [tcp sum ok] 1693384788:1693384788(0) ack 1786439495 win 65535 <nop,nop,timestamp 18607934 3644260,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22637, len 64)
  4689	19:48:30.686472 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3644261 18607934> (DF) (ttl 64, id 2288, len 52)
  4690	19:48:31.685589 172.16.183.2.1114 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3644361 18607934> (DF) (ttl 64, id 2289, len 104)
  4691	19:48:31.703553 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18608036 3644361> (DF) (ttl 240, id 22638, len 52)
  4692	19:48:32.377327 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18608103 3644361> (DF) (ttl 240, id 22639, len 1500)
  4693	19:48:32.385699 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3644453 18608103> (DF) (ttl 64, id 2290, len 52)
  4694	19:48:32.386646 clusterb.icq.com.http > 172.16.183.2.1114: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18608103 3644361> (DF) (ttl 240, id 22640, len 1500)
  4695	19:48:32.400816 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3644454 18608103> (DF) (ttl 64, id 2291, len 52)
  4696	19:48:32.447778 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18608110 3644453> (DF) (ttl 240, id 22641, len 1477)
  4697	19:48:32.456911 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18608110 3644453> (DF) (ttl 240, id 22642, len 1500)
  4698	19:48:32.465538 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18608110 3644454> (DF) (ttl 240, id 22643, len 1500)
  4699	19:48:32.469907 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3644462 18608110> (DF) (ttl 64, id 2292, len 52)
  4700	19:48:32.472969 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18608110 3644454> (DF) (ttl 240, id 22644, len 1252)
  4701	19:48:32.484967 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 3644464 18608110> (DF) (ttl 64, id 2293, len 52)
  4702	19:48:32.550761 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18608120 3644462> (DF) (ttl 240, id 22645, len 1500)
  4703	19:48:32.559652 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18608120 3644462> (DF) (ttl 240, id 22646, len 1500)
  4704	19:48:32.560358 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3644471 18608120> (DF) (ttl 64, id 2294, len 52)
  4705	19:48:32.566858 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18608120 3644462> (DF) (ttl 240, id 22647, len 1252)
  4706	19:48:32.576153 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18608120 3644462> (DF) (ttl 240, id 22648, len 1500)
  4707	19:48:32.584785 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18608122 3644464> (DF) (ttl 240, id 22649, len 1500)
  4708	19:48:32.585653 172.16.183.2.1114 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3644473 18608120> (DF) (ttl 64, id 2295, len 52)
  4709	19:48:32.590953 172.16.183.2.1114 > clusterb.icq.com.http: P [bad tcp cksum 9a64!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4710	19:48:32.590953 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3644474 18608120> (DF) (ttl 64, id 2296, len 52)
  4711	19:48:32.592191 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18608122 3644464> (DF) (ttl 240, id 22650, len 1252)
  4712	19:48:32.592928 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2297, len 40)
  4713	19:48:32.601015 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18608124 3644471> (DF) (ttl 240, id 22651, len 1500)
  4714	19:48:32.601747 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2298, len 40)
  4715	19:48:32.609891 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18608124 3644471> (DF) (ttl 240, id 22652, len 1500)
  4716	19:48:32.610651 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2299, len 40)
  4717	19:48:32.617093 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18608124 3644471> (DF) (ttl 240, id 22653, len 1252)
  4718	19:48:32.617859 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2300, len 40)
  4719	19:48:32.626392 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18608126 3644473> (DF) (ttl 240, id 22654, len 1500)
  4720	19:48:32.627126 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2301, len 40)
  4721	19:48:32.635020 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18608126 3644473> (DF) (ttl 240, id 22655, len 1500)
  4722	19:48:32.635825 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2302, len 40)
  4723	19:48:32.642471 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18608126 3644473> (DF) (ttl 240, id 22656, len 1252)
  4724	19:48:32.643187 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2303, len 40)
  4725	19:48:32.651286 clusterb.icq.com.http > 172.16.183.2.1114: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18608126 3644473> (DF) (ttl 240, id 22657, len 1500)
  4726	19:48:32.652000 172.16.183.2.1114 > clusterb.icq.com.http: R [tcp sum ok] 1786439547:1786439547(0) win 0 (ttl 255, id 2304, len 40)
  4727	19:48:34.587525 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50812+ A? web.icq.com. [|domain] (ttl 64, id 2305, len 57)
  4728	19:48:34.615833 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50812 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 49786, len 244)
  4729	19:48:34.617126 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3644677 0,nop,wscale 0> (DF) (ttl 64, id 2306, len 60)
  4730	19:48:37.625442 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3644977 0,nop,wscale 0> (DF) (ttl 64, id 2307, len 60)
  4731	19:48:43.615512 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3645577 0,nop,wscale 0> (DF) (ttl 64, id 2308, len 60)
  4732	19:48:55.615256 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3646777 0,nop,wscale 0> (DF) (ttl 64, id 2309, len 60)
  4733	19:49:19.635205 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3649177 0,nop,wscale 0> (DF) (ttl 64, id 2310, len 60)
  4734	19:50:07.625297 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3653977 0,nop,wscale 0> (DF) (ttl 64, id 2311, len 60)
  4735	19:51:43.775231 172.16.183.2.1115 > clusterc.icq.com.http: S [tcp sum ok] 1989476994:1989476994(0) win 32120 <mss 1460,sackOK,timestamp 3663577 0,nop,wscale 0> (DF) (ttl 64, id 2312, len 60)
  4736	19:51:43.793586 clusterc.icq.com.http > 172.16.183.2.1115: S [tcp sum ok] 4005068808:4005068808(0) ack 1989476995 win 65535 <nop,nop,timestamp 27182096 3663577,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 43169, len 64)
  4737	19:51:43.795482 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3663578 27182096> (DF) (ttl 64, id 2313, len 52)
  4738	19:51:44.795674 172.16.183.2.1115 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3663678 27182096> (DF) (ttl 64, id 2314, len 104)
  4739	19:51:44.815046 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 27182198 3663678> (DF) (ttl 240, id 43170, len 52)
  4740	19:51:45.292957 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 27182245 3663678> (DF) (ttl 240, id 43171, len 1500)
  4741	19:51:45.301184 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3663751 27182245> (DF) (ttl 64, id 2315, len 52)
  4742	19:51:45.305275 clusterc.icq.com.http > 172.16.183.2.1115: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 27182245 3663678> (DF) (ttl 240, id 43172, len 1500)
  4743	19:51:45.319096 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3663753 27182245> (DF) (ttl 64, id 2316, len 52)
  4744	19:51:45.349847 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 27182250 3663751> (DF) (ttl 240, id 43173, len 1477)
  4745	19:51:45.360953 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 27182250 3663751> (DF) (ttl 240, id 43174, len 1500)
  4746	19:51:45.397426 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 27182255 3663753> (DF) (ttl 240, id 43175, len 1500)
  4747	19:51:45.401828 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3663762 27182250> (DF) (ttl 64, id 2317, len 52)
  4748	19:51:45.406336 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 27182255 3663753> (DF) (ttl 240, id 43176, len 1252)
  4749	19:51:45.429087 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3663765 27182255> (DF) (ttl 64, id 2318, len 52)
  4750	19:51:45.504348 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 27182266 3663762> (DF) (ttl 240, id 43177, len 1500)
  4751	19:51:45.513208 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 27182266 3663762> (DF) (ttl 240, id 43178, len 1500)
  4752	19:51:45.513973 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3663773 27182266> (DF) (ttl 64, id 2319, len 52)
  4753	19:51:45.520888 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 27182266 3663762> (DF) (ttl 240, id 43179, len 1252)
  4754	19:51:45.544248 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 27182270 3663765> (DF) (ttl 240, id 43180, len 1500)
  4755	19:51:45.553368 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 27182270 3663765> (DF) (ttl 240, id 43181, len 1500)
  4756	19:51:45.554116 172.16.183.2.1115 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3663777 27182266> (DF) (ttl 64, id 2320, len 52)
  4757	19:51:45.560809 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 27182270 3663765> (DF) (ttl 240, id 43182, len 1252)
  4758	19:51:45.563396 172.16.183.2.1115 > clusterc.icq.com.http: P [bad tcp cksum f42e!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4759	19:51:45.563396 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3663778 27182270> (DF) (ttl 64, id 2321, len 52)
  4760	19:51:45.570595 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 27182270 3663773> (DF) (ttl 240, id 43183, len 1500)
  4761	19:51:45.571477 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2322, len 40)
  4762	19:51:45.579226 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 27182270 3663773> (DF) (ttl 240, id 43184, len 1500)
  4763	19:51:45.579993 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2323, len 40)
  4764	19:51:45.587148 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 27182270 3663773> (DF) (ttl 240, id 43185, len 1252)
  4765	19:51:45.587873 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2324, len 40)
  4766	19:51:45.596710 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 27182274 3663777> (DF) (ttl 240, id 43186, len 1500)
  4767	19:51:45.597495 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2325, len 40)
  4768	19:51:45.605575 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 27182274 3663777> (DF) (ttl 240, id 43187, len 1500)
  4769	19:51:45.606351 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2326, len 40)
  4770	19:51:45.612765 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 27182274 3663777> (DF) (ttl 240, id 43188, len 1252)
  4771	19:51:45.613458 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2327, len 40)
  4772	19:51:45.621866 clusterc.icq.com.http > 172.16.183.2.1115: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 27182274 3663777> (DF) (ttl 240, id 43189, len 1500)
  4773	19:51:45.622571 172.16.183.2.1115 > clusterc.icq.com.http: R [tcp sum ok] 1989477047:1989477047(0) win 0 (ttl 255, id 2328, len 40)
  4774	19:51:47.637377 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50813+ A? web.icq.com. [|domain] (ttl 64, id 2329, len 57)
  4775	19:51:47.649946 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50813 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 60245, len 233)
  4776	19:51:47.651207 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3663980 0,nop,wscale 0> (DF) (ttl 64, id 2330, len 60)
  4777	19:51:50.645104 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3664280 0,nop,wscale 0> (DF) (ttl 64, id 2331, len 60)
  4778	19:51:56.645136 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3664880 0,nop,wscale 0> (DF) (ttl 64, id 2332, len 60)
  4779	19:52:08.645331 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3666080 0,nop,wscale 0> (DF) (ttl 64, id 2333, len 60)
  4780	19:52:32.675126 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3668480 0,nop,wscale 0> (DF) (ttl 64, id 2334, len 60)
  4781	19:53:20.665179 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3673280 0,nop,wscale 0> (DF) (ttl 64, id 2335, len 60)
  4782	19:54:56.525288 172.16.183.2.1116 > clustera.icq.com.http: S [tcp sum ok] 2188815879:2188815879(0) win 32120 <mss 1460,sackOK,timestamp 3682880 0,nop,wscale 0> (DF) (ttl 64, id 2336, len 60)
  4783	19:54:56.542925 clustera.icq.com.http > 172.16.183.2.1116: S [tcp sum ok] 1655333854:1655333854(0) ack 2188815880 win 24616 <nop,nop,timestamp 253792928 3682880,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 47681, len 64)
  4784	19:54:56.545062 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3682881 253792928> (DF) (ttl 64, id 2337, len 52)
  4785	19:54:57.545788 172.16.183.2.1116 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3682981 253792928> (DF) (ttl 64, id 2338, len 104)
  4786	19:54:57.564360 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 253793030 3682981> (DF) (ttl 49, id 47682, len 52)
  4787	19:54:58.039560 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 253793076 3682981> (DF) (ttl 49, id 47683, len 1500)
  4788	19:54:58.047969 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3683033 253793076> (DF) (ttl 64, id 2339, len 52)
  4789	19:54:58.051637 clustera.icq.com.http > 172.16.183.2.1116: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 253793076 3682981> (DF) (ttl 49, id 47684, len 1500)
  4790	19:54:58.063935 clustera.icq.com.http > 172.16.183.2.1116: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 253793076 3682981> (DF) (ttl 49, id 47685, len 1477)
  4791	19:54:58.071381 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3683035 253793076> (DF) (ttl 64, id 2340, len 52)
  4792	19:54:58.077372 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 30408 <nop,nop,timestamp 3683036 253793076> (DF) (ttl 64, id 2341, len 52)
  4793	19:54:58.115697 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 253793084 3683033> (DF) (ttl 49, id 47686, len 1500)
  4794	19:54:58.126782 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 253793084 3683033> (DF) (ttl 49, id 47687, len 1500)
  4795	19:54:58.130938 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3683040 253793084> (DF) (ttl 64, id 2342, len 52)
  4796	19:54:58.141107 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 253793087 3683035> (DF) (ttl 49, id 47688, len 1252)
  4797	19:54:58.152644 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 253793087 3683035> (DF) (ttl 49, id 47689, len 1500)
  4798	19:54:58.163493 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 253793087 3683036> (DF) (ttl 49, id 47690, len 1500)
  4799	19:54:58.164260 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3683045 253793087> (DF) (ttl 64, id 2343, len 52)
  4800	19:54:58.172648 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 253793087 3683036> (DF) (ttl 49, id 47691, len 1252)
  4801	19:54:58.184924 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3683047 253793087> (DF) (ttl 64, id 2344, len 52)
  4802	19:54:58.211534 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683040> (DF) (ttl 49, id 47692, len 1500)
  4803	19:54:58.221147 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683040> (DF) (ttl 49, id 47693, len 1500)
  4804	19:54:58.221868 172.16.183.2.1116 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3683050 253793094> (DF) (ttl 64, id 2345, len 52)
  4805	19:54:58.227390 172.16.183.2.1116 > clustera.icq.com.http: P [bad tcp cksum be23!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4806	19:54:58.227390 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3683051 253793094> (DF) (ttl 64, id 2346, len 52)
  4807	19:54:58.229542 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 253793094 3683040> (DF) (ttl 49, id 47694, len 1252)
  4808	19:54:58.230262 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2347, len 40)
  4809	19:54:58.239841 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683045> (DF) (ttl 49, id 47695, len 1500)
  4810	19:54:58.240625 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2348, len 40)
  4811	19:54:58.249944 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683045> (DF) (ttl 49, id 47696, len 1500)
  4812	19:54:58.250666 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2349, len 40)
  4813	19:54:58.258121 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 253793094 3683045> (DF) (ttl 49, id 47697, len 1252)
  4814	19:54:58.258833 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2350, len 40)
  4815	19:54:58.268419 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683047> (DF) (ttl 49, id 47698, len 1500)
  4816	19:54:58.269178 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2351, len 40)
  4817	19:54:58.278524 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 253793094 3683047> (DF) (ttl 49, id 47699, len 1500)
  4818	19:54:58.279278 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2352, len 40)
  4819	19:54:58.286453 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 253793094 3683047> (DF) (ttl 49, id 47700, len 1252)
  4820	19:54:58.287148 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2353, len 40)
  4821	19:54:58.296532 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 253793097 3683050> (DF) (ttl 49, id 47701, len 1500)
  4822	19:54:58.297456 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2354, len 40)
  4823	19:54:58.306114 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 253793097 3683050> (DF) (ttl 49, id 47702, len 1500)
  4824	19:54:58.306881 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2355, len 40)
  4825	19:54:58.314043 clustera.icq.com.http > 172.16.183.2.1116: . [tcp sum ok] 27698:28898(1200) ack 53 win 24616 <nop,nop,timestamp 253793097 3683050> (DF) (ttl 49, id 47703, len 1252)
  4826	19:54:58.315245 172.16.183.2.1116 > clustera.icq.com.http: R [tcp sum ok] 2188815932:2188815932(0) win 0 (ttl 255, id 2356, len 40)
  4827	19:55:00.237543 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50814+ A? web.icq.com. [|domain] (ttl 64, id 2357, len 57)
  4828	19:55:00.251959 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50814 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 4738, len 233)
  4829	19:55:00.253330 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3683253 0,nop,wscale 0> (DF) (ttl 64, id 2358, len 60)
  4830	19:55:03.265344 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3683554 0,nop,wscale 0> (DF) (ttl 64, id 2359, len 60)
  4831	19:55:09.265285 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3684154 0,nop,wscale 0> (DF) (ttl 64, id 2360, len 60)
  4832	19:55:21.265186 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3685354 0,nop,wscale 0> (DF) (ttl 64, id 2361, len 60)
  4833	19:55:45.315201 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3687754 0,nop,wscale 0> (DF) (ttl 64, id 2362, len 60)
  4834	19:56:33.355195 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3692554 0,nop,wscale 0> (DF) (ttl 64, id 2363, len 60)
  4835	19:58:09.375034 172.16.183.2.1117 > clusterb.icq.com.http: S [tcp sum ok] 2417000928:2417000928(0) win 32120 <mss 1460,sackOK,timestamp 3702154 0,nop,wscale 0> (DF) (ttl 64, id 2364, len 60)
  4836	19:58:09.392745 clusterb.icq.com.http > 172.16.183.2.1117: S [tcp sum ok] 1911470395:1911470395(0) ack 2417000929 win 33304 <nop,nop,timestamp 140178259 3702154,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 33087, len 64)
  4837	19:58:09.393351 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3702155 140178259> (DF) (ttl 64, id 2365, len 52)
  4838	19:58:10.385442 172.16.183.2.1117 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3702255 140178259> (DF) (ttl 64, id 2366, len 104)
  4839	19:58:10.463725 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 140178366 3702255> (DF) (ttl 49, id 33088, len 52)
  4840	19:58:10.931035 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 140178412 3702255> (DF) (ttl 49, id 33089, len 1500)
  4841	19:58:10.935760 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3702328 140178412> (DF) (ttl 64, id 2367, len 52)
  4842	19:58:10.942867 clusterb.icq.com.http > 172.16.183.2.1117: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 140178412 3702255> (DF) (ttl 49, id 33090, len 1500)
  4843	19:58:10.955156 clusterb.icq.com.http > 172.16.183.2.1117: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 140178412 3702255> (DF) (ttl 49, id 33091, len 1477)
  4844	19:58:10.959124 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3702330 140178412> (DF) (ttl 64, id 2368, len 52)
  4845	19:58:10.975650 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3702332 140178412> (DF) (ttl 64, id 2369, len 52)
  4846	19:58:10.992137 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 140178418 3702328> (DF) (ttl 49, id 33092, len 1500)
  4847	19:58:11.002987 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 140178418 3702328> (DF) (ttl 49, id 33093, len 1500)
  4848	19:58:11.005793 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3702335 140178418> (DF) (ttl 64, id 2370, len 52)
  4849	19:58:11.045153 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 140178423 3702330> (DF) (ttl 49, id 33094, len 1252)
  4850	19:58:11.055454 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 140178423 3702330> (DF) (ttl 49, id 33095, len 1500)
  4851	19:58:11.074672 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 140178426 3702332> (DF) (ttl 49, id 33096, len 1500)
  4852	19:58:11.075689 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3702342 140178423> (DF) (ttl 64, id 2371, len 52)
  4853	19:58:11.082592 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 140178426 3702332> (DF) (ttl 49, id 33097, len 1252)
  4854	19:58:11.094872 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3702344 140178426> (DF) (ttl 64, id 2372, len 52)
  4855	19:58:11.100777 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 140178429 3702335> (DF) (ttl 49, id 33098, len 1500)
  4856	19:58:11.110879 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 140178429 3702335> (DF) (ttl 49, id 33099, len 1500)
  4857	19:58:11.111611 172.16.183.2.1117 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 3702345 140178429> (DF) (ttl 64, id 2373, len 52)
  4858	19:58:11.115059 172.16.183.2.1117 > clusterb.icq.com.http: P [bad tcp cksum 87dd!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4859	19:58:11.115059 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3702345 140178429> (DF) (ttl 64, id 2374, len 52)
  4860	19:58:11.119141 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 140178429 3702335> (DF) (ttl 49, id 33100, len 1252)
  4861	19:58:11.119919 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2375, len 40)
  4862	19:58:11.129349 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 140178429 3702342> (DF) (ttl 49, id 33101, len 1500)
  4863	19:58:11.130090 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2376, len 40)
  4864	19:58:11.138956 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 140178429 3702342> (DF) (ttl 49, id 33102, len 1500)
  4865	19:58:11.139727 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2377, len 40)
  4866	19:58:11.146886 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 140178429 3702342> (DF) (ttl 49, id 33103, len 1252)
  4867	19:58:11.147600 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2378, len 40)
  4868	19:58:11.156453 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 140178429 3702342> (DF) (ttl 49, id 33104, len 1500)
  4869	19:58:11.157266 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2379, len 40)
  4870	19:58:11.165574 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 140178431 3702344> (DF) (ttl 49, id 33105, len 1500)
  4871	19:58:11.166353 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2380, len 40)
  4872	19:58:11.172998 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 140178431 3702344> (DF) (ttl 49, id 33106, len 1252)
  4873	19:58:11.173693 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2381, len 40)
  4874	19:58:11.182558 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 140178433 3702345> (DF) (ttl 49, id 33107, len 1500)
  4875	19:58:11.183330 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2382, len 40)
  4876	19:58:11.191686 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 140178433 3702345> (DF) (ttl 49, id 33108, len 1500)
  4877	19:58:11.192497 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2383, len 40)
  4878	19:58:11.199115 clusterb.icq.com.http > 172.16.183.2.1117: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 140178433 3702345> (DF) (ttl 49, id 33109, len 1252)
  4879	19:58:11.199884 172.16.183.2.1117 > clusterb.icq.com.http: R [tcp sum ok] 2417000981:2417000981(0) win 0 (ttl 255, id 2384, len 40)
  4880	19:58:13.127307 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50815+ A? web.icq.com. [|domain] (ttl 64, id 2385, len 57)
  4881	19:58:13.141201 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50815 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 13463, len 233)
  4882	19:58:13.142153 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3702547 0,nop,wscale 0> (DF) (ttl 64, id 2386, len 60)
  4883	19:58:16.154935 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3702848 0,nop,wscale 0> (DF) (ttl 64, id 2387, len 60)
  4884	19:58:22.145123 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3703448 0,nop,wscale 0> (DF) (ttl 64, id 2388, len 60)
  4885	19:58:34.145162 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3704648 0,nop,wscale 0> (DF) (ttl 64, id 2389, len 60)
  4886	19:58:58.165047 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3707048 0,nop,wscale 0> (DF) (ttl 64, id 2390, len 60)
  4887	19:59:46.155214 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3711848 0,nop,wscale 0> (DF) (ttl 64, id 2391, len 60)
  4888	20:01:22.225030 172.16.183.2.1118 > clustera.icq.com.http: S [tcp sum ok] 2605575941:2605575941(0) win 32120 <mss 1460,sackOK,timestamp 3721448 0,nop,wscale 0> (DF) (ttl 64, id 2392, len 60)
  4889	20:01:22.242831 clustera.icq.com.http > 172.16.183.2.1118: S [tcp sum ok] 3558898624:3558898624(0) ack 2605575942 win 65535 <nop,nop,timestamp 502882342 3721448,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 49533, len 64)
  4890	20:01:22.244316 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3721449 502882342> (DF) (ttl 64, id 2393, len 52)
  4891	20:01:23.245741 172.16.183.2.1118 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3721549 502882342> (DF) (ttl 64, id 2394, len 104)
  4892	20:01:23.264285 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502882444 3721549> (DF) (ttl 240, id 49534, len 52)
  4893	20:01:23.838028 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502882500 3721549> (DF) (ttl 240, id 49535, len 1500)
  4894	20:01:23.842458 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3721624 502882500> (DF) (ttl 64, id 2395, len 52)
  4895	20:01:23.847882 clustera.icq.com.http > 172.16.183.2.1118: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502882500 3721549> (DF) (ttl 240, id 49536, len 1500)
  4896	20:01:23.873928 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3721628 502882500> (DF) (ttl 64, id 2396, len 52)
  4897	20:01:23.890987 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502882506 3721624> (DF) (ttl 240, id 49537, len 1477)
  4898	20:01:23.900129 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502882506 3721624> (DF) (ttl 240, id 49538, len 1500)
  4899	20:01:23.923901 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 3721633 502882506> (DF) (ttl 64, id 2397, len 52)
  4900	20:01:23.940037 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502882511 3721628> (DF) (ttl 240, id 49539, len 1500)
  4901	20:01:23.947962 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502882511 3721628> (DF) (ttl 240, id 49540, len 1252)
  4902	20:01:23.970330 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502882514 3721633> (DF) (ttl 240, id 49541, len 1500)
  4903	20:01:23.971111 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 3721637 502882511> (DF) (ttl 64, id 2398, len 52)
  4904	20:01:23.979208 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502882514 3721633> (DF) (ttl 240, id 49542, len 1500)
  4905	20:01:23.986890 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502882514 3721633> (DF) (ttl 240, id 49543, len 1252)
  4906	20:01:23.993925 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3721640 502882514> (DF) (ttl 64, id 2399, len 52)
  4907	20:01:23.997186 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502882516 3721637> (DF) (ttl 240, id 49544, len 1500)
  4908	20:01:24.006061 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502882516 3721637> (DF) (ttl 240, id 49545, len 1500)
  4909	20:01:24.006742 172.16.183.2.1118 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3721641 502882516> (DF) (ttl 64, id 2400, len 52)
  4910	20:01:24.009445 172.16.183.2.1118 > clustera.icq.com.http: P [bad tcp cksum 8c40!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4911	20:01:24.009445 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3721641 502882516> (DF) (ttl 64, id 2401, len 52)
  4912	20:01:24.013232 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502882516 3721637> (DF) (ttl 240, id 49546, len 1252)
  4913	20:01:24.014024 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2402, len 40)
  4914	20:01:24.022306 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502882516 3721637> (DF) (ttl 240, id 49547, len 1500)
  4915	20:01:24.023082 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2403, len 40)
  4916	20:01:24.031172 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502882519 3721640> (DF) (ttl 240, id 49548, len 1500)
  4917	20:01:24.031962 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2404, len 40)
  4918	20:01:24.038368 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502882519 3721640> (DF) (ttl 240, id 49549, len 1252)
  4919	20:01:24.039096 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2405, len 40)
  4920	20:01:24.047436 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502882519 3721640> (DF) (ttl 240, id 49550, len 1500)
  4921	20:01:24.048161 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2406, len 40)
  4922	20:01:24.056302 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502882520 3721641> (DF) (ttl 240, id 49551, len 1500)
  4923	20:01:24.057040 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2407, len 40)
  4924	20:01:24.063487 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502882520 3721641> (DF) (ttl 240, id 49552, len 1252)
  4925	20:01:24.064174 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2408, len 40)
  4926	20:01:24.072561 clustera.icq.com.http > 172.16.183.2.1118: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502882520 3721641> (DF) (ttl 240, id 49553, len 1500)
  4927	20:01:24.073260 172.16.183.2.1118 > clustera.icq.com.http: R [tcp sum ok] 2605575994:2605575994(0) win 0 (ttl 255, id 2409, len 40)
  4928	20:01:26.006666 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50816+ A? web.icq.com. [|domain] (ttl 64, id 2410, len 57)
  4929	20:01:26.034412 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50816 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 23053, len 244)
  4930	20:01:26.035716 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3721843 0,nop,wscale 0> (DF) (ttl 64, id 2411, len 60)
  4931	20:01:29.045205 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3722143 0,nop,wscale 0> (DF) (ttl 64, id 2412, len 60)
  4932	20:01:35.055410 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3722743 0,nop,wscale 0> (DF) (ttl 64, id 2413, len 60)
  4933	20:01:47.045315 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3723943 0,nop,wscale 0> (DF) (ttl 64, id 2414, len 60)
  4934	20:02:11.145165 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3726343 0,nop,wscale 0> (DF) (ttl 64, id 2415, len 60)
  4935	20:02:59.135211 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3731143 0,nop,wscale 0> (DF) (ttl 64, id 2416, len 60)
  4936	20:04:35.086558 172.16.183.2.1119 > clusterb.icq.com.http: S [tcp sum ok] 2807815712:2807815712(0) win 32120 <mss 1460,sackOK,timestamp 3740743 0,nop,wscale 0> (DF) (ttl 64, id 2417, len 60)
  4937	20:04:35.106584 clusterb.icq.com.http > 172.16.183.2.1119: S [tcp sum ok] 3215056759:3215056759(0) ack 2807815713 win 65535 <nop,nop,timestamp 502090713 3740743,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 63099, len 64)
  4938	20:04:35.107733 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3740745 502090713> (DF) (ttl 64, id 2418, len 52)
  4939	20:04:36.105690 172.16.183.2.1119 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3740845 502090713> (DF) (ttl 64, id 2419, len 104)
  4940	20:04:36.125218 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502090815 3740845> (DF) (ttl 240, id 63100, len 52)
  4941	20:04:36.742564 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502090875 3740845> (DF) (ttl 240, id 63101, len 1500)
  4942	20:04:36.747333 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3740921 502090875> (DF) (ttl 64, id 2420, len 52)
  4943	20:04:36.751692 clusterb.icq.com.http > 172.16.183.2.1119: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502090875 3740845> (DF) (ttl 240, id 63102, len 1500)
  4944	20:04:36.764996 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 3740923 502090875> (DF) (ttl 64, id 2421, len 52)
  4945	20:04:36.799214 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502090881 3740921> (DF) (ttl 240, id 63103, len 1477)
  4946	20:04:36.808342 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502090881 3740921> (DF) (ttl 240, id 63104, len 1500)
  4947	20:04:36.828305 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502090884 3740923> (DF) (ttl 240, id 63105, len 1500)
  4948	20:04:36.830909 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3740929 502090881> (DF) (ttl 64, id 2422, len 52)
  4949	20:04:36.835996 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502090884 3740923> (DF) (ttl 240, id 63106, len 1252)
  4950	20:04:36.862210 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3740933 502090884> (DF) (ttl 64, id 2423, len 52)
  4951	20:04:36.882263 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502090889 3740929> (DF) (ttl 240, id 63107, len 1500)
  4952	20:04:36.891133 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502090889 3740929> (DF) (ttl 240, id 63108, len 1500)
  4953	20:04:36.891855 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3740935 502090889> (DF) (ttl 64, id 2424, len 52)
  4954	20:04:36.898317 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502090889 3740929> (DF) (ttl 240, id 63109, len 1252)
  4955	20:04:36.907398 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502090889 3740929> (DF) (ttl 240, id 63110, len 1500)
  4956	20:04:36.914937 172.16.183.2.1119 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 3740938 502090889> (DF) (ttl 64, id 2425, len 52)
  4957	20:04:36.916014 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502090890 3740933> (DF) (ttl 240, id 63111, len 1500)
  4958	20:04:36.923485 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502090890 3740933> (DF) (ttl 240, id 63112, len 1252)
  4959	20:04:36.924558 172.16.183.2.1119 > clusterb.icq.com.http: P [bad tcp cksum 58f1!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  4960	20:04:36.924558 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3740939 502090890> (DF) (ttl 64, id 2426, len 52)
  4961	20:04:36.932516 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502090893 3740935> (DF) (ttl 240, id 63113, len 1500)
  4962	20:04:36.933354 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2427, len 40)
  4963	20:04:36.941372 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502090893 3740935> (DF) (ttl 240, id 63114, len 1500)
  4964	20:04:36.942289 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2428, len 40)
  4965	20:04:36.948560 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502090893 3740935> (DF) (ttl 240, id 63115, len 1252)
  4966	20:04:36.949285 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2429, len 40)
  4967	20:04:36.957717 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502090896 3740938> (DF) (ttl 240, id 63116, len 1500)
  4968	20:04:36.958474 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2430, len 40)
  4969	20:04:36.966256 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502090896 3740938> (DF) (ttl 240, id 63117, len 1500)
  4970	20:04:36.967026 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2431, len 40)
  4971	20:04:36.973694 clusterb.icq.com.http > 172.16.183.2.1119: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502090896 3740938> (DF) (ttl 240, id 63118, len 1252)
  4972	20:04:36.974352 172.16.183.2.1119 > clusterb.icq.com.http: R [tcp sum ok] 2807815765:2807815765(0) win 0 (ttl 255, id 2432, len 40)
  4973	20:04:38.927581 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50817+ A? web.icq.com. [|domain] (ttl 64, id 2433, len 57)
  4974	20:04:38.947560 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50817* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 33491, len 233)
  4975	20:04:38.948704 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3741141 0,nop,wscale 0> (DF) (ttl 64, id 2434, len 60)
  4976	20:04:41.954931 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3741441 0,nop,wscale 0> (DF) (ttl 64, id 2435, len 60)
  4977	20:04:47.955274 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3742041 0,nop,wscale 0> (DF) (ttl 64, id 2436, len 60)
  4978	20:04:59.955188 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3743241 0,nop,wscale 0> (DF) (ttl 64, id 2437, len 60)
  4979	20:05:23.975237 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3745641 0,nop,wscale 0> (DF) (ttl 64, id 2438, len 60)
  4980	20:06:12.005041 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3750441 0,nop,wscale 0> (DF) (ttl 64, id 2439, len 60)
  4981	20:07:48.055203 172.16.183.2.1120 > clustera.icq.com.http: S [tcp sum ok] 3002411774:3002411774(0) win 32120 <mss 1460,sackOK,timestamp 3760041 0,nop,wscale 0> (DF) (ttl 64, id 2440, len 60)
  4982	20:07:48.070858 clustera.icq.com.http > 172.16.183.2.1120: S [tcp sum ok] 690366979:690366979(0) ack 3002411775 win 65535 <nop,nop,timestamp 502653211 3760041,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 51983, len 64)
  4983	20:07:48.072018 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3760042 502653211> (DF) (ttl 64, id 2441, len 52)
  4984	20:07:49.065523 172.16.183.2.1120 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3760142 502653211> (DF) (ttl 64, id 2442, len 104)
  4985	20:07:49.083452 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502653313 3760142> (DF) (ttl 240, id 51984, len 52)
  4986	20:07:49.657700 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502653369 3760142> (DF) (ttl 240, id 51985, len 1500)
  4987	20:07:49.662185 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3760219 502653369> (DF) (ttl 64, id 2443, len 52)
  4988	20:07:49.666597 clustera.icq.com.http > 172.16.183.2.1120: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502653369 3760142> (DF) (ttl 240, id 51986, len 1500)
  4989	20:07:49.674979 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3760220 502653369> (DF) (ttl 64, id 2444, len 52)
  4990	20:07:49.702016 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502653373 3760219> (DF) (ttl 240, id 51987, len 1477)
  4991	20:07:49.710663 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502653373 3760219> (DF) (ttl 240, id 51988, len 1500)
  4992	20:07:49.719540 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502653375 3760220> (DF) (ttl 240, id 51989, len 1500)
  4993	20:07:49.722213 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3760224 502653373> (DF) (ttl 64, id 2445, len 52)
  4994	20:07:49.726732 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502653375 3760220> (DF) (ttl 240, id 51990, len 1252)
  4995	20:07:49.734941 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 3760226 502653375> (DF) (ttl 64, id 2446, len 52)
  4996	20:07:49.752294 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502653378 3760224> (DF) (ttl 240, id 51991, len 1500)
  4997	20:07:49.760929 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502653378 3760224> (DF) (ttl 240, id 51992, len 1500)
  4998	20:07:49.761716 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3760229 502653378> (DF) (ttl 64, id 2447, len 52)
  4999	20:07:49.768364 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502653378 3760224> (DF) (ttl 240, id 51993, len 1252)
  5000	20:07:49.777182 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502653378 3760224> (DF) (ttl 240, id 51994, len 1500)
  5001	20:07:49.786300 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502653379 3760226> (DF) (ttl 240, id 51995, len 1500)
  5002	20:07:49.787039 172.16.183.2.1120 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3760231 502653378> (DF) (ttl 64, id 2448, len 52)
  5003	20:07:49.791371 172.16.183.2.1120 > clustera.icq.com.http: P [bad tcp cksum 9fe9!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5004	20:07:49.791371 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3760232 502653378> (DF) (ttl 64, id 2449, len 52)
  5005	20:07:49.793232 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502653379 3760226> (DF) (ttl 240, id 51996, len 1252)
  5006	20:07:49.793971 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2450, len 40)
  5007	20:07:49.802542 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502653382 3760229> (DF) (ttl 240, id 51997, len 1500)
  5008	20:07:49.803272 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2451, len 40)
  5009	20:07:49.811172 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502653382 3760229> (DF) (ttl 240, id 51998, len 1500)
  5010	20:07:49.811922 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2452, len 40)
  5011	20:07:49.818607 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502653382 3760229> (DF) (ttl 240, id 51999, len 1252)
  5012	20:07:49.819345 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2453, len 40)
  5013	20:07:49.827424 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502653385 3760231> (DF) (ttl 240, id 52000, len 1500)
  5014	20:07:49.828197 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2454, len 40)
  5015	20:07:49.836532 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502653385 3760231> (DF) (ttl 240, id 52001, len 1500)
  5016	20:07:49.837291 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2455, len 40)
  5017	20:07:49.843497 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502653385 3760231> (DF) (ttl 240, id 52002, len 1252)
  5018	20:07:49.844185 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2456, len 40)
  5019	20:07:49.852802 clustera.icq.com.http > 172.16.183.2.1120: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502653385 3760231> (DF) (ttl 240, id 52003, len 1500)
  5020	20:07:49.853514 172.16.183.2.1120 > clustera.icq.com.http: R [tcp sum ok] 3002411827:3002411827(0) win 0 (ttl 255, id 2457, len 40)
  5021	20:07:51.797107 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50818+ A? web.icq.com. [|domain] (ttl 64, id 2458, len 57)
  5022	20:07:51.811690 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50818 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 43138, len 233)
  5023	20:07:51.812865 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3760433 0,nop,wscale 0> (DF) (ttl 64, id 2459, len 60)
  5024	20:07:54.815265 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3760733 0,nop,wscale 0> (DF) (ttl 64, id 2460, len 60)
  5025	20:08:00.817551 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3761333 0,nop,wscale 0> (DF) (ttl 64, id 2461, len 60)
  5026	20:08:12.815378 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3762533 0,nop,wscale 0> (DF) (ttl 64, id 2462, len 60)
  5027	20:08:36.845327 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3764933 0,nop,wscale 0> (DF) (ttl 64, id 2463, len 60)
  5028	20:09:24.835765 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3769733 0,nop,wscale 0> (DF) (ttl 64, id 2464, len 60)
  5029	20:11:00.835539 172.16.183.2.1121 > clustera.icq.com.http: S [tcp sum ok] 3211169909:3211169909(0) win 32120 <mss 1460,sackOK,timestamp 3779333 0,nop,wscale 0> (DF) (ttl 64, id 2465, len 60)
  5030	20:11:00.851720 clustera.icq.com.http > 172.16.183.2.1121: S [tcp sum ok] 2883470846:2883470846(0) ack 3211169910 win 33304 <nop,nop,timestamp 18482009 3779333,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 8571, len 64)
  5031	20:11:00.852132 172.16.183.2.1121 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3779334 18482009> (DF) (ttl 64, id 2466, len 52)
  5032	20:11:01.845451 172.16.183.2.1121 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3779434 18482009> (DF) (ttl 64, id 2467, len 104)
  5033	20:11:01.967050 clustera.icq.com.http > 172.16.183.2.1121: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18482120 3779434> (DF) (ttl 49, id 8572, len 52)
  5034	20:11:02.262232 clustera.icq.com.http > 172.16.183.2.1121: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 18482150 3779434> (DF) (ttl 49, id 8573, len 391)
  5035	20:11:02.262669 clustera.icq.com.http > 172.16.183.2.1121: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 18482150 3779434> (DF) (ttl 49, id 8574, len 52)
  5036	20:11:02.264945 172.16.183.2.1121 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 3779485 18482150> (DF) (ttl 64, id 2468, len 52)
  5037	20:11:02.265696 172.16.183.2.1121 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 3779485 18482150> (DF) (ttl 64, id 2469, len 52)
  5038	20:11:27.628584 172.16.183.2.1121 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 3782022 18482150> (DF) (ttl 64, id 2470, len 52)
  5039	20:11:27.645322 172.16.183.2.1121 > clustera.icq.com.http: P [bad tcp cksum 360e!] 3967268574:3967268625(51) ack 327699117 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5040	20:11:27.645322 clustera.icq.com.http > 172.16.183.2.1121: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 18484689 3782022> (DF) (ttl 49, id 8575, len 52)
  5041	20:11:28.626867 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50819+ A? web.icq.com. [|domain] (ttl 64, id 2471, len 57)
  5042	20:11:28.656820 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50819 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 55261, len 244)
  5043	20:11:28.659191 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3782125 0,nop,wscale 0> (DF) (ttl 64, id 2472, len 60)
  5044	20:11:31.655013 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3782425 0,nop,wscale 0> (DF) (ttl 64, id 2473, len 60)
  5045	20:11:37.665167 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3783025 0,nop,wscale 0> (DF) (ttl 64, id 2474, len 60)
  5046	20:11:49.725113 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3784225 0,nop,wscale 0> (DF) (ttl 64, id 2475, len 60)
  5047	20:12:13.725193 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3786625 0,nop,wscale 0> (DF) (ttl 64, id 2476, len 60)
  5048	20:13:01.715123 172.16.183.2.1122 > clusterc.icq.com.http: S [tcp sum ok] 3438682831:3438682831(0) win 32120 <mss 1460,sackOK,timestamp 3791425 0,nop,wscale 0> (DF) (ttl 64, id 2477, len 60)
  5049	20:13:01.732916 clusterc.icq.com.http > 172.16.183.2.1122: S [tcp sum ok] 899443733:899443733(0) ack 3438682832 win 65535 <nop,nop,timestamp 27309893 3791425,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 10419, len 64)
  5050	20:13:01.734362 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3791426 27309893> (DF) (ttl 64, id 2478, len 52)
  5051	20:13:02.735718 172.16.183.2.1122 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3791526 27309893> (DF) (ttl 64, id 2479, len 104)
  5052	20:13:02.754120 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 27309995 3791526> (DF) (ttl 240, id 10420, len 52)
  5053	20:13:03.324167 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 27310051 3791526> (DF) (ttl 240, id 10421, len 1500)
  5054	20:13:03.328901 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3791596 27310051> (DF) (ttl 64, id 2480, len 52)
  5055	20:13:03.333034 clusterc.icq.com.http > 172.16.183.2.1122: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 27310051 3791526> (DF) (ttl 240, id 10422, len 1500)
  5056	20:13:03.337709 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3791597 27310051> (DF) (ttl 64, id 2481, len 52)
  5057	20:13:03.374159 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 27310056 3791596> (DF) (ttl 240, id 10423, len 1477)
  5058	20:13:03.383291 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 27310056 3791596> (DF) (ttl 240, id 10424, len 1500)
  5059	20:13:03.399308 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 27310059 3791597> (DF) (ttl 240, id 10425, len 1500)
  5060	20:13:03.401905 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 3791603 27310056> (DF) (ttl 64, id 2482, len 52)
  5061	20:13:03.406491 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 27310059 3791597> (DF) (ttl 240, id 10426, len 1252)
  5062	20:13:03.417699 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 3791605 27310059> (DF) (ttl 64, id 2483, len 52)
  5063	20:13:03.442195 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 27310063 3791603> (DF) (ttl 240, id 10427, len 1500)
  5064	20:13:03.451051 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 27310063 3791603> (DF) (ttl 240, id 10428, len 1500)
  5065	20:13:03.451835 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 3791608 27310063> (DF) (ttl 64, id 2484, len 52)
  5066	20:13:03.458242 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 27310063 3791603> (DF) (ttl 240, id 10429, len 1252)
  5067	20:13:03.467314 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 27310063 3791603> (DF) (ttl 240, id 10430, len 1500)
  5068	20:13:03.476176 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 27310063 3791605> (DF) (ttl 240, id 10431, len 1500)
  5069	20:13:03.476883 172.16.183.2.1122 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3791610 27310063> (DF) (ttl 64, id 2485, len 52)
  5070	20:13:03.483613 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 27310063 3791605> (DF) (ttl 240, id 10432, len 1252)
  5071	20:13:03.485982 172.16.183.2.1122 > clusterc.icq.com.http: P [bad tcp cksum 5184!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5072	20:13:03.485982 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 3791611 27310063> (DF) (ttl 64, id 2486, len 52)
  5073	20:13:03.492432 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 27310066 3791608> (DF) (ttl 240, id 10433, len 1500)
  5074	20:13:03.493243 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2487, len 40)
  5075	20:13:03.501288 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 27310066 3791608> (DF) (ttl 240, id 10434, len 1500)
  5076	20:13:03.501994 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2488, len 40)
  5077	20:13:03.508481 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 27310066 3791608> (DF) (ttl 240, id 10435, len 1252)
  5078	20:13:03.509210 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2489, len 40)
  5079	20:13:03.517562 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 27310069 3791610> (DF) (ttl 240, id 10436, len 1500)
  5080	20:13:03.518296 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2490, len 40)
  5081	20:13:03.526413 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 27310069 3791610> (DF) (ttl 240, id 10437, len 1500)
  5082	20:13:03.527206 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2491, len 40)
  5083	20:13:03.533853 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 27310069 3791610> (DF) (ttl 240, id 10438, len 1252)
  5084	20:13:03.534841 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2492, len 40)
  5085	20:13:03.542683 clusterc.icq.com.http > 172.16.183.2.1122: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 27310069 3791610> (DF) (ttl 240, id 10439, len 1500)
  5086	20:13:03.543367 172.16.183.2.1122 > clusterc.icq.com.http: R [tcp sum ok] 3438682884:3438682884(0) win 0 (ttl 255, id 2493, len 40)
  5087	20:13:05.486618 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50820+ A? web.icq.com. [|domain] (ttl 64, id 2494, len 57)
  5088	20:13:05.499348 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50820 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 59967, len 233)
  5089	20:13:05.500338 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3791812 0,nop,wscale 0> (DF) (ttl 64, id 2495, len 60)
  5090	20:13:08.505273 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3792112 0,nop,wscale 0> (DF) (ttl 64, id 2496, len 60)
  5091	20:13:14.505207 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3792712 0,nop,wscale 0> (DF) (ttl 64, id 2497, len 60)
  5092	20:13:26.505265 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3793912 0,nop,wscale 0> (DF) (ttl 64, id 2498, len 60)
  5093	20:13:50.495338 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3796312 0,nop,wscale 0> (DF) (ttl 64, id 2499, len 60)
  5094	20:14:38.485233 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3801112 0,nop,wscale 0> (DF) (ttl 64, id 2500, len 60)
  5095	20:16:14.475068 172.16.183.2.1123 > clusterc.icq.com.http: S [tcp sum ok] 3541266902:3541266902(0) win 32120 <mss 1460,sackOK,timestamp 3810712 0,nop,wscale 0> (DF) (ttl 64, id 2501, len 60)
  5096	20:16:14.492057 clusterc.icq.com.http > 172.16.183.2.1123: S [tcp sum ok] 1617865516:1617865516(0) ack 3541266903 win 33304 <nop,nop,timestamp 216216205 3810712,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 63875, len 64)
  5097	20:16:14.492438 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3810713 216216205> (DF) (ttl 64, id 2502, len 52)
  5098	20:16:15.485365 172.16.183.2.1123 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3810813 216216205> (DF) (ttl 64, id 2503, len 104)
  5099	20:16:15.604930 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 216216317 3810813> (DF) (ttl 49, id 63876, len 52)
  5100	20:16:16.085793 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 216216363 3810813> (DF) (ttl 49, id 63877, len 1500)
  5101	20:16:16.090232 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3810877 216216363> (DF) (ttl 64, id 2504, len 52)
  5102	20:16:16.096639 clusterc.icq.com.http > 172.16.183.2.1123: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 216216363 3810813> (DF) (ttl 49, id 63878, len 1500)
  5103	20:16:16.107704 clusterc.icq.com.http > 172.16.183.2.1123: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 216216363 3810813> (DF) (ttl 49, id 63879, len 1477)
  5104	20:16:16.124953 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 3810881 216216363> (DF) (ttl 64, id 2505, len 52)
  5105	20:16:16.139755 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 216216369 3810877> (DF) (ttl 49, id 63880, len 1500)
  5106	20:16:16.149865 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 216216369 3810877> (DF) (ttl 49, id 63881, len 1500)
  5107	20:16:16.152436 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3810883 216216369> (DF) (ttl 64, id 2506, len 52)
  5108	20:16:16.186852 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 216216374 3810881> (DF) (ttl 49, id 63882, len 1252)
  5109	20:16:16.196419 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 216216374 3810881> (DF) (ttl 49, id 63883, len 1500)
  5110	20:16:16.206271 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 216216374 3810881> (DF) (ttl 49, id 63884, len 1500)
  5111	20:16:16.206974 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 3810889 216216374> (DF) (ttl 64, id 2507, len 52)
  5112	20:16:16.213704 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 216216374 3810883> (DF) (ttl 49, id 63885, len 1252)
  5113	20:16:16.223766 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 216216374 3810883> (DF) (ttl 49, id 63886, len 1500)
  5114	20:16:16.224561 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 3810891 216216374> (DF) (ttl 64, id 2508, len 52)
  5115	20:16:16.232644 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 216216374 3810883> (DF) (ttl 49, id 63887, len 1500)
  5116	20:16:16.233564 172.16.183.2.1123 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 30408 <nop,nop,timestamp 3810891 216216374> (DF) (ttl 64, id 2509, len 52)
  5117	20:16:16.237952 172.16.183.2.1123 > clusterc.icq.com.http: P [bad tcp cksum f1c9!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5118	20:16:16.237952 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 3810892 216216374> (DF) (ttl 64, id 2510, len 52)
  5119	20:16:16.240792 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 216216378 3810889> (DF) (ttl 49, id 63888, len 1252)
  5120	20:16:16.241573 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2511, len 40)
  5121	20:16:16.250353 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 216216378 3810889> (DF) (ttl 49, id 63889, len 1500)
  5122	20:16:16.251094 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2512, len 40)
  5123	20:16:16.259224 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 216216378 3810889> (DF) (ttl 49, id 63890, len 1500)
  5124	20:16:16.259988 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2513, len 40)
  5125	20:16:16.266911 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 216216378 3810889> (DF) (ttl 49, id 63891, len 1252)
  5126	20:16:16.267702 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2514, len 40)
  5127	20:16:16.276462 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 216216380 3810891> (DF) (ttl 49, id 63892, len 1500)
  5128	20:16:16.277190 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2515, len 40)
  5129	20:16:16.285339 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 216216380 3810891> (DF) (ttl 49, id 63893, len 1500)
  5130	20:16:16.286116 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2516, len 40)
  5131	20:16:16.293021 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 216216383 3810891> (DF) (ttl 49, id 63894, len 1252)
  5132	20:16:16.293733 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2517, len 40)
  5133	20:16:16.302093 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 216216383 3810891> (DF) (ttl 49, id 63895, len 1500)
  5134	20:16:16.302841 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2518, len 40)
  5135	20:16:16.311208 clusterc.icq.com.http > 172.16.183.2.1123: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 216216383 3810891> (DF) (ttl 49, id 63896, len 1500)
  5136	20:16:16.312028 172.16.183.2.1123 > clusterc.icq.com.http: R [tcp sum ok] 3541266955:3541266955(0) win 0 (ttl 255, id 2519, len 40)
  5137	20:16:18.277660 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50821+ A? web.icq.com. [|domain] (ttl 64, id 2520, len 57)
  5138	20:16:18.297931 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50821* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 4621, len 233)
  5139	20:16:18.299137 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3811095 0,nop,wscale 0> (DF) (ttl 64, id 2521, len 60)
  5140	20:16:21.294963 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3811395 0,nop,wscale 0> (DF) (ttl 64, id 2522, len 60)
  5141	20:16:27.295242 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3811995 0,nop,wscale 0> (DF) (ttl 64, id 2523, len 60)
  5142	20:16:39.285238 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3813195 0,nop,wscale 0> (DF) (ttl 64, id 2524, len 60)
  5143	20:17:03.355082 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3815595 0,nop,wscale 0> (DF) (ttl 64, id 2525, len 60)
  5144	20:17:51.345211 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3820395 0,nop,wscale 0> (DF) (ttl 64, id 2526, len 60)
  5145	20:19:27.335235 172.16.183.2.1124 > clusterb.icq.com.http: S [tcp sum ok] 3743977787:3743977787(0) win 32120 <mss 1460,sackOK,timestamp 3829995 0,nop,wscale 0> (DF) (ttl 64, id 2527, len 60)
  5146	20:19:27.352017 clusterb.icq.com.http > 172.16.183.2.1124: S [tcp sum ok] 2821391994:2821391994(0) ack 3743977788 win 65535 <nop,nop,timestamp 502179940 3829995,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 37865, len 64)
  5147	20:19:27.353477 172.16.183.2.1124 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3829996 502179940> (DF) (ttl 64, id 2528, len 52)
  5148	20:19:28.355396 172.16.183.2.1124 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3830096 502179940> (DF) (ttl 64, id 2529, len 104)
  5149	20:19:28.373955 clusterb.icq.com.http > 172.16.183.2.1124: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502180042 3830096> (DF) (ttl 240, id 37866, len 52)
  5150	20:19:28.637605 clusterb.icq.com.http > 172.16.183.2.1124: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 502180068 3830096> (DF) (ttl 240, id 37867, len 391)
  5151	20:19:28.638053 clusterb.icq.com.http > 172.16.183.2.1124: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 502180069 3830096> (DF) (ttl 240, id 37868, len 52)
  5152	20:19:28.640023 172.16.183.2.1124 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 3830137 502180068> (DF) (ttl 64, id 2530, len 52)
  5153	20:19:28.640760 172.16.183.2.1124 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 3830137 502180069> (DF) (ttl 64, id 2531, len 52)
  5154	20:19:53.464062 172.16.183.2.1124 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 3832622 502180069> (DF) (ttl 64, id 2532, len 52)
  5155	20:19:53.481125 172.16.183.2.1124 > clusterb.icq.com.http: P [bad tcp cksum bf30!] 3372381844:3372381895(51) ack 922585847 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5156	20:19:53.481125 clusterb.icq.com.http > 172.16.183.2.1124: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 502182553 3832622> (DF) (ttl 240, id 37869, len 52)
  5157	20:19:54.467101 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50822+ A? web.icq.com. [|domain] (ttl 64, id 2533, len 57)
  5158	20:19:54.479826 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50822 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 15443, len 233)
  5159	20:19:54.481775 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3832723 0,nop,wscale 0> (DF) (ttl 64, id 2534, len 60)
  5160	20:19:57.474921 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3833023 0,nop,wscale 0> (DF) (ttl 64, id 2535, len 60)
  5161	20:20:03.485255 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3833623 0,nop,wscale 0> (DF) (ttl 64, id 2536, len 60)
  5162	20:20:15.485253 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3834823 0,nop,wscale 0> (DF) (ttl 64, id 2537, len 60)
  5163	20:20:39.475267 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3837223 0,nop,wscale 0> (DF) (ttl 64, id 2538, len 60)
  5164	20:21:27.585133 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3842023 0,nop,wscale 0> (DF) (ttl 64, id 2539, len 60)
  5165	20:23:03.605076 172.16.183.2.1125 > clusterc.icq.com.http: S [tcp sum ok] 3981693874:3981693874(0) win 32120 <mss 1460,sackOK,timestamp 3851623 0,nop,wscale 0> (DF) (ttl 64, id 2540, len 60)
  5166	20:23:03.621363 clusterc.icq.com.http > 172.16.183.2.1125: S [tcp sum ok] 110827714:110827714(0) ack 3981693875 win 33304 <nop,nop,timestamp 216257128 3851623,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 63897, len 64)
  5167	20:23:03.622529 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 3851624 216257128> (DF) (ttl 64, id 2541, len 52)
  5168	20:23:04.615440 172.16.183.2.1125 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 3851724 216257128> (DF) (ttl 64, id 2542, len 104)
  5169	20:23:04.632977 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 216257229 3851724> (DF) (ttl 49, id 63898, len 52)
  5170	20:23:05.205724 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 216257285 3851724> (DF) (ttl 49, id 63899, len 1500)
  5171	20:23:05.210215 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 3851803 216257285> (DF) (ttl 64, id 2543, len 52)
  5172	20:23:05.214355 clusterc.icq.com.http > 172.16.183.2.1125: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 216257285 3851724> (DF) (ttl 49, id 63900, len 1500)
  5173	20:23:05.222351 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 30408 <nop,nop,timestamp 3851804 216257285> (DF) (ttl 64, id 2544, len 52)
  5174	20:23:05.223209 clusterc.icq.com.http > 172.16.183.2.1125: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 216257285 3851724> (DF) (ttl 49, id 63901, len 1477)
  5175	20:23:05.232319 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 30408 <nop,nop,timestamp 3851805 216257285> (DF) (ttl 64, id 2545, len 52)
  5176	20:23:05.250088 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 216257290 3851803> (DF) (ttl 49, id 63902, len 1500)
  5177	20:23:05.259201 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 216257290 3851803> (DF) (ttl 49, id 63903, len 1500)
  5178	20:23:05.261568 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 3851807 216257290> (DF) (ttl 64, id 2546, len 52)
  5179	20:23:05.266381 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 216257291 3851804> (DF) (ttl 49, id 63904, len 1252)
  5180	20:23:05.275453 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 216257291 3851804> (DF) (ttl 49, id 63905, len 1500)
  5181	20:23:05.282324 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 30408 <nop,nop,timestamp 3851810 216257291> (DF) (ttl 64, id 2547, len 52)
  5182	20:23:05.284086 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 216257292 3851805> (DF) (ttl 49, id 63906, len 1500)
  5183	20:23:05.291545 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 216257292 3851805> (DF) (ttl 49, id 63907, len 1252)
  5184	20:23:05.300349 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 216257295 3851807> (DF) (ttl 49, id 63908, len 1500)
  5185	20:23:05.301114 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 30408 <nop,nop,timestamp 3851811 216257292> (DF) (ttl 64, id 2548, len 52)
  5186	20:23:05.309453 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 216257295 3851807> (DF) (ttl 49, id 63909, len 1500)
  5187	20:23:05.316402 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 216257295 3851807> (DF) (ttl 49, id 63910, len 1252)
  5188	20:23:05.326959 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 216257296 3851810> (DF) (ttl 49, id 63911, len 1500)
  5189	20:23:05.327739 172.16.183.2.1125 > clusterc.icq.com.http: . [tcp sum ok] ack 18058 win 30408 <nop,nop,timestamp 3851814 216257295> (DF) (ttl 64, id 2549, len 52)
  5190	20:23:05.328967 172.16.183.2.1125 > clusterc.icq.com.http: P [bad tcp cksum b72f!] 53:104(51) ack 18058 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  5191	20:23:05.328967 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 18058 win 31856 <nop,nop,timestamp 3851814 216257295> (DF) (ttl 64, id 2550, len 52)
  5192	20:23:05.334320 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 216257296 3851810> (DF) (ttl 49, id 63912, len 1500)
  5193	20:23:05.335392 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2551, len 40)
  5194	20:23:05.341747 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 216257296 3851810> (DF) (ttl 49, id 63913, len 1252)
  5195	20:23:05.342405 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2552, len 40)
  5196	20:23:05.350583 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 216257298 3851811> (DF) (ttl 49, id 63914, len 1500)
  5197	20:23:05.351372 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2553, len 40)
  5198	20:23:05.359712 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 216257298 3851811> (DF) (ttl 49, id 63915, len 1500)
  5199	20:23:05.360943 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2554, len 40)
  5200	20:23:05.366645 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 216257298 3851811> (DF) (ttl 49, id 63916, len 1252)
  5201	20:23:05.367369 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2555, len 40)
  5202	20:23:05.375952 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 216257298 3851811> (DF) (ttl 49, id 63917, len 1500)
  5203	20:23:05.376727 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2556, len 40)
  5204	20:23:05.384593 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 216257300 3851814> (DF) (ttl 49, id 63918, len 1500)
  5205	20:23:05.385524 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2557, len 40)
  5206	20:23:05.392008 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 216257300 3851814> (DF) (ttl 49, id 63919, len 1252)
  5207	20:23:05.392712 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2558, len 40)
  5208	20:23:05.400849 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 28898:30346(1448) ack 53 win 33304 <nop,nop,timestamp 216257300 3851814> (DF) (ttl 49, id 63920, len 1500)
  5209	20:23:05.401659 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2559, len 40)
  5210	20:23:05.409965 clusterc.icq.com.http > 172.16.183.2.1125: . [tcp sum ok] 30346:31794(1448) ack 53 win 33304 <nop,nop,timestamp 216257300 3851814> (DF) (ttl 49, id 63921, len 1500)
  5211	20:23:05.410737 172.16.183.2.1125 > clusterc.icq.com.http: R [tcp sum ok] 3981693927:3981693927(0) win 0 (ttl 255, id 2560, len 40)