1	09:45:02.732909 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 19, len 84, bad cksum 950c!)
     2	09:45:02.896713 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62373, len 84, bad cksum a979!)
     3	09:45:03.776579 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 21, len 84, bad cksum 950a!)
     4	09:45:03.849188 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62474, len 84, bad cksum a914!)
     5	09:45:04.755226 172.16.183.2 > 10.10.10.10: icmp: echo request (ttl 64, id 23, len 84, bad cksum 9508!)
     6	09:45:04.768159 10.10.10.10 > 172.16.183.2: icmp: echo reply (ttl 56, id 62666, len 84, bad cksum a854!)
     7	11:09:13.557615 94.0.146.98 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 58832, len 422)
     8	11:10:34.876658 192.146.201.172 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 40092, len 422)
     9	11:10:34.991246 172.16.183.2 > 175.44.57.180:  ip-proto-11 512 (ttl 250, id 49658, len 532)
    10	11:10:34.992379 172.16.183.2 > 57.35.28.126:  ip-proto-11 512 (ttl 250, id 15445, len 532)
    11	11:10:34.995320 172.16.183.2 > 22.23.166.235:  ip-proto-11 512 (ttl 250, id 61203, len 532)
    12	11:10:35.005093 172.16.183.2 > p50-tnt7.syd.ihug.com.au:  ip-proto-11 512 (ttl 250, id 40978, len 532)
    13	11:10:35.015220 172.16.183.2 > 31.223.48.171:  ip-proto-11 512 (ttl 250, id 8444, len 532)
    14	11:10:35.035260 172.16.183.2 > 55.247.104.208:  ip-proto-11 512 (ttl 250, id 22833, len 532)
    15	11:10:35.045154 172.16.183.2 > 73.195.64.167:  ip-proto-11 512 (ttl 250, id 22491, len 532)
    16	11:10:35.055188 172.16.183.2 > 122.114.160.41:  ip-proto-11 512 (ttl 250, id 46639, len 532)
    17	11:10:35.065122 172.16.183.2 > 158.217.222.215:  ip-proto-11 512 (ttl 250, id 5340, len 532)
    18	11:10:35.475587 172.16.183.2 > 175.44.57.180:  ip-proto-11 463 (ttl 250, id 37092, len 483)
    19	11:10:35.475758 158.217.209.2 > 172.16.183.2: icmp: host 158.217.222.215 unreachable (ttl 231, id 59554, len 56)
    20	11:10:35.480562 172.16.183.2 > 57.35.28.126:  ip-proto-11 463 (ttl 250, id 26714, len 483)
    21	11:10:35.485063 172.16.183.2 > 22.23.166.235:  ip-proto-11 463 (ttl 250, id 48914, len 483)
    22	11:10:35.495194 172.16.183.2 > p50-tnt7.syd.ihug.com.au:  ip-proto-11 463 (ttl 250, id 57627, len 483)
    23	11:10:35.500389 core-1-fe1-0-0.oldcity.dca.net > 172.16.183.2: icmp: host 175.44.57.180 unreachable (ttl 253, id 44638, len 56)
    24	11:10:35.505081 172.16.183.2 > 31.223.48.171:  ip-proto-11 463 (ttl 250, id 38993, len 483)
    25	11:10:35.525031 172.16.183.2 > 55.247.104.208:  ip-proto-11 463 (ttl 250, id 18411, len 483)
    26	11:10:35.535120 172.16.183.2 > 73.195.64.167:  ip-proto-11 463 (ttl 250, id 59291, len 483)
    27	11:10:35.545099 172.16.183.2 > 122.114.160.41:  ip-proto-11 463 (ttl 250, id 62525, len 483)
    28	11:10:35.555174 172.16.183.2 > 158.217.222.215:  ip-proto-11 463 (ttl 250, id 12843, len 483)
    29	12:31:23.472051 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: S [tcp sum ok] 548969690:548969690(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17871, len 48)
    30	12:31:23.485414 AOrleans-102-1-2-201.abo.wanadoo.fr.1856 > 172.16.183.8.ftp: S [tcp sum ok] 549063379:549063379(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17873, len 48)
    31	12:31:23.491425 172.16.183.8.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1856: R [tcp sum ok] 0:0(0) ack 549063380 win 0 (DF) (ttl 255, id 0, len 40)
    32	12:31:23.493411 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: S [tcp sum ok] 62479013:62479013(0) ack 548969691 win 32120 <mss 1460> (DF) (ttl 64, id 25, len 44)
    33	12:31:23.769686 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: . [tcp sum ok] ack 1 win 17520 (DF) (ttl 105, id 17927, len 40)
    34	12:31:24.092218 AOrleans-102-1-2-201.abo.wanadoo.fr.1856 > 172.16.183.8.ftp: S [tcp sum ok] 549063379:549063379(0) win 16384 <mss 1460,nop,nop,eol> (DF) (ttl 105, id 17930, len 48)
    35	12:31:24.104404 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52402+ PTR? 201.184.14.80.in-addr.arpa. [|domain] (ttl 64, id 26, len 72)
    36	12:31:24.109156 172.16.183.8.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1856: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
    37	12:31:24.119612 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52402 1/2/2 201.184.14.80.in-addr.arpa. PTR AOrleans-102-1-2-201.abo.wanadoo.fr. (160) (ttl 61, id 56298, len 188)
    38	12:31:24.124458 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52403+ A? AOrleans-102-1-2-201.abo.wanadoo.fr. [|domain] (ttl 64, id 27, len 81)
    39	12:31:24.138320 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52403 1/2/2 AOrleans-102-1-2-201.abo.wanadoo.fr. A AOrleans-102-1-2-201.abo.wanadoo.fr (136) (ttl 61, id 56299, len 164)
    40	12:31:24.144245 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52404+ PTR? 201.184.14.80.in-addr.arpa. [|domain] (ttl 64, id 28, len 72)
    41	12:31:24.158130 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52404 1/2/2 201.184.14.80.in-addr.arpa. PTR AOrleans-102-1-2-201.abo.wanadoo.fr. (160) (ttl 61, id 56300, len 188)
    42	12:31:24.180954 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52405+ PTR? 2.183.16.172.in-addr.arpa. [|domain] (ttl 64, id 29, len 71)
    43	12:31:24.204579 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52405 NXDomain* 0/1/0 (120) (ttl 61, id 56303, len 148)
    44	12:31:24.207667 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 30, len 120)
    45	12:31:24.406049 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: P [tcp sum ok] 1:17(16) ack 81 win 17440 (DF) (ttl 105, id 17938, len 56)
    46	12:31:24.410490 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: . [tcp sum ok] ack 17 win 32120 (DF) [tos 0x10]  (ttl 64, id 31, len 40)
    47	12:31:24.462990 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 81:149(68) ack 17 win 32120 (DF) [tos 0x10]  (ttl 64, id 32, len 108)
    48	12:31:24.619679 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: P [tcp sum ok] 17:40(23) ack 149 win 17372 (DF) (ttl 105, id 17940, len 63)
    49	12:31:24.620892 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 149:171(22) ack 40 win 32120 (DF) [tos 0x10]  (ttl 64, id 33, len 62)
    50	12:31:24.781762 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: F [tcp sum ok] 40:40(0) ack 171 win 17350 (DF) (ttl 105, id 17942, len 40)
    51	12:31:24.782443 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: . [tcp sum ok] ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 34, len 40)
    52	12:31:24.783353 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: P [tcp sum ok] 171:208(37) ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 35, len 77)
    53	12:31:24.785876 172.16.183.2.ftp > AOrleans-102-1-2-201.abo.wanadoo.fr.1854: F [tcp sum ok] 208:208(0) ack 41 win 32120 (DF) [tos 0x10]  (ttl 64, id 36, len 40)
    54	12:31:24.946578 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: R [tcp sum ok] 548969731:548969731(0) win 0 (DF) (ttl 105, id 17943, len 40)
    55	12:31:24.953968 AOrleans-102-1-2-201.abo.wanadoo.fr.1854 > 172.16.183.2.ftp: R [tcp sum ok] 548969731:548969731(0) win 0 (ttl 105, id 17944, len 40)
    56	14:57:22.260915 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    57	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    58	TrnID=0xA5B5
    59	OpCode=0
    60	NmFlags=0x0
    61	Rcode=0
    62	QueryCount=1
    63	AnswerCount=0
    64	AuthorityCount=0
    65	AddressRecCount=0
    66	QuestionRecords:
    67	Name=*               NameType=0x00 (Workstation)
    68	QuestionType=0x21
    69	QuestionClass=0x1
       

    70	 (ttl 111, id 31959, len 78)
    71	14:57:22.264983 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 180, len 106)
    72	14:57:23.761037 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    73	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    74	TrnID=0xA5BF
    75	OpCode=0
    76	NmFlags=0x0
    77	Rcode=0
    78	QueryCount=1
    79	AnswerCount=0
    80	AuthorityCount=0
    81	AddressRecCount=0
    82	QuestionRecords:
    83	Name=*               NameType=0x00 (Workstation)
    84	QuestionType=0x21
    85	QuestionClass=0x1
       

    86	 (ttl 111, id 32433, len 78)
    87	14:57:23.761669 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 181, len 106)
    88	14:57:25.261685 escuser8.esc.state.nc.us.netbios-ns > 172.16.183.8.netbios-ns:  [udp sum ok]
    89	>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
    90	TrnID=0xA5C5
    91	OpCode=0
    92	NmFlags=0x0
    93	Rcode=0
    94	QueryCount=1
    95	AnswerCount=0
    96	AuthorityCount=0
    97	AddressRecCount=0
    98	QuestionRecords:
    99	Name=*               NameType=0x00 (Workstation)
   100	QuestionType=0x21
   101	QuestionClass=0x1
       

   102	 (ttl 111, id 32728, len 78)
   103	14:57:25.262160 172.16.183.8 > escuser8.esc.state.nc.us: icmp: 216.158.2.205 udp port netbios-ns unreachable [tos 0xc0]  (ttl 255, id 182, len 106)
   104	15:35:00.285126 168.148.27.14 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 60428, len 422)
   105	15:35:56.667243 10.39.81.89 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 41688, len 422)
   106	15:40:23.804323 3D72F7E5.osaka.meta.ne.jp.3673 > 172.16.183.2.sunrpc: S [tcp sum ok] 1673438256:1673438256(0) win 32120 <mss 1460,sackOK,timestamp 404000327 0,nop,wscale 0> (DF) (ttl 45, id 35948, len 60)
   107	15:40:23.808741 3D72F7E5.osaka.meta.ne.jp.3675 > 172.16.183.8.sunrpc: S [tcp sum ok] 1676823404:1676823404(0) win 32120 <mss 1460,sackOK,timestamp 404000327 0,nop,wscale 0> (DF) (ttl 45, id 35950, len 60)
   108	15:40:23.817653 172.16.183.8.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3675: S [tcp sum ok] 1103499552:1103499552(0) ack 1676823405 win 5792 <mss 1460,sackOK,timestamp 10555925 404000327,nop,wscale 0> (DF) (ttl 64, id 0, len 60)
   109	15:40:23.824450 172.16.183.2.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3673: S [tcp sum ok] 3444177268:3444177268(0) ack 1673438257 win 32120 <mss 1460,sackOK,timestamp 2154221 404000327,nop,wscale 0> (DF) (ttl 64, id 37, len 60)
   110	15:40:27.335420 172.16.183.2.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3673: S [tcp sum ok] 3444177268:3444177268(0) ack 1673438257 win 32120 <mss 1460,sackOK,timestamp 2154572 404000327,nop,wscale 0> (DF) (ttl 64, id 38, len 60)
   111	15:40:27.537352 3D72F7E5.osaka.meta.ne.jp.3673 > 172.16.183.2.sunrpc: R [tcp sum ok] 1673438257:1673438257(0) win 0 (ttl 236, id 39589, len 40)
   112	15:40:27.825398 172.16.183.8.sunrpc > 3D72F7E5.osaka.meta.ne.jp.3675: S [tcp sum ok] 1103499552:1103499552(0) ack 1676823405 win 5792 <mss 1460,sackOK,timestamp 10556326 404000327,nop,wscale 0> (DF) (ttl 64, id 0, len 60)
   113	15:40:28.025654 3D72F7E5.osaka.meta.ne.jp.3675 > 172.16.183.8.sunrpc: R [tcp sum ok] 1676823405:1676823405(0) win 0 (ttl 236, id 39592, len 40)
   114	15:57:37.983480 58.248.76.90 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 4308, len 422)
   115	15:57:39.114395 172.16.183.2.1025 > 11.11.11.11.8882: S [bad tcp cksum df29!] 240028091:240028091(0) win 32120 <mss 1460,sackOK,timestamp 2257780 0,nop,wscale 0> (DF) (ttl 64, id 39, len 60, bad cksum 978d!)
   116	15:57:39.181019 11.11.11.11.8882 > 172.16.183.2.1025: S [bad tcp cksum df29!] 138504693:138504693(0) ack 240028092 win 32120 <mss 1460,sackOK,timestamp 181750773 2257780,nop,wscale 0> (DF) (ttl 53, id 524, len 60, bad cksum a0a8!)
   117	15:57:39.186541 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 1 win 32120 <nop,nop,timestamp 2257788 181750773> (DF) (ttl 64, id 40, len 52, bad cksum 9794!)
   118	15:57:39.191581 172.16.183.2.1025 > 11.11.11.11.8882: P [bad tcp cksum df29!] 1:546(545) ack 1 win 32120 <nop,nop,timestamp 2257788 181750773> (DF) (ttl 64, id 41, len 597, bad cksum 9572!)
   119	15:57:39.287189 11.11.11.11.8882 > 172.16.183.2.1025: . [bad tcp cksum df29!] ack 546 win 31856 <nop,nop,timestamp 181750784 2257788> (DF) (ttl 53, id 527, len 52, bad cksum a0ad!)
   120	15:57:39.290486 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 1:115(114) ack 546 win 31856 <nop,nop,timestamp 181750784 2257788> (DF) (ttl 53, id 528, len 166, bad cksum a03a!)
   121	15:57:39.291603 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 115 win 32120 <nop,nop,timestamp 2257799 181750784> (DF) (ttl 64, id 42, len 52, bad cksum 9792!)
   122	15:57:39.307966 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 115:839(724) ack 546 win 31856 <nop,nop,timestamp 181750785 2257788> (DF) (ttl 53, id 529, len 776, bad cksum 9dd7!)
   123	15:57:39.334972 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 839 win 32120 <nop,nop,timestamp 2257807 181750785> (DF) (ttl 64, id 43, len 52, bad cksum 9791!)
   124	15:57:39.375334 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 839:2287(1448) ack 546 win 31856 <nop,nop,timestamp 181750790 2257799> (DF) (ttl 53, id 531, len 1500, bad cksum 9b01!)
   125	15:57:39.389619 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 2287:3735(1448) ack 546 win 31856 <nop,nop,timestamp 181750790 2257799> (DF) (ttl 53, id 532, len 1500, bad cksum 9b00!)
   126	15:57:39.390451 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 3735 win 31856 <nop,nop,timestamp 2257812 181750790> (DF) (ttl 64, id 44, len 52, bad cksum 9790!)
   127	15:57:39.414498 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 3735:5183(1448) ack 546 win 31856 <nop,nop,timestamp 181750794 2257807> (DF) (ttl 53, id 533, len 1500, bad cksum 9aff!)
   128	15:57:39.427797 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 5183:6631(1448) ack 546 win 31856 <nop,nop,timestamp 181750794 2257807> (DF) (ttl 53, id 534, len 1500, bad cksum 9afe!)
   129	15:57:39.428475 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 6631 win 31856 <nop,nop,timestamp 2257816 181750794> (DF) (ttl 64, id 45, len 52, bad cksum 978f!)
   130	15:57:39.470699 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 6631:8079(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 536, len 1500, bad cksum 9afc!)
   131	15:57:39.483229 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 8079:9527(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 537, len 1500, bad cksum 9afb!)
   132	15:57:39.483900 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 9527 win 31856 <nop,nop,timestamp 2257821 181750800> (DF) (ttl 64, id 46, len 52, bad cksum 978e!)
   133	15:57:39.495078 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 9527:10975(1448) ack 546 win 31856 <nop,nop,timestamp 181750800 2257812> (DF) (ttl 53, id 538, len 1500, bad cksum 9afa!)
   134	15:57:39.510347 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 10975:12423(1448) ack 546 win 31856 <nop,nop,timestamp 181750804 2257816> (DF) (ttl 53, id 540, len 1500, bad cksum 9af8!)
   135	15:57:39.511089 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 12423 win 31856 <nop,nop,timestamp 2257824 181750800> (DF) (ttl 64, id 47, len 52, bad cksum 978d!)
   136	15:57:39.517776 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 12423:13316(893) ack 546 win 31856 <nop,nop,timestamp 181750804 2257816> (DF) (ttl 53, id 541, len 945, bad cksum 9d22!)
   137	15:57:39.534945 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 13316 win 31856 <nop,nop,timestamp 2257827 181750804> (DF) (ttl 64, id 48, len 52, bad cksum 978c!)
   138	15:57:39.563961 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 13316:14040(724) ack 546 win 31856 <nop,nop,timestamp 181750810 2257821> (DF) (ttl 53, id 542, len 776, bad cksum 9dca!)
   139	15:57:39.572822 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 14040:14764(724) ack 546 win 31856 <nop,nop,timestamp 181750811 2257821> (DF) (ttl 53, id 543, len 776, bad cksum 9dc9!)
   140	15:57:39.573479 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 14764 win 31856 <nop,nop,timestamp 2257829 181750810> (DF) (ttl 64, id 49, len 52, bad cksum 978b!)
   141	15:57:39.587613 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 14764:15488(724) ack 546 win 31856 <nop,nop,timestamp 181750812 2257824> (DF) (ttl 53, id 545, len 776, bad cksum 9dc7!)
   142	15:57:39.595250 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 15488:16212(724) ack 546 win 31856 <nop,nop,timestamp 181750813 2257824> (DF) (ttl 53, id 546, len 776, bad cksum 9dc6!)
   143	15:57:39.595900 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 16212 win 31856 <nop,nop,timestamp 2257833 181750812> (DF) (ttl 64, id 50, len 52, bad cksum 978a!)
   144	15:57:39.600919 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 16212:16936(724) ack 546 win 31856 <nop,nop,timestamp 181750814 2257827> (DF) (ttl 53, id 547, len 776, bad cksum 9dc5!)
   145	15:57:39.604915 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 16936 win 31856 <nop,nop,timestamp 2257835 181750814> (DF) (ttl 64, id 51, len 52, bad cksum 9789!)
   146	15:57:39.611753 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 16936:17660(724) ack 546 win 31856 <nop,nop,timestamp 181750815 2257827> (DF) (ttl 53, id 548, len 776, bad cksum 9dc4!)
   147	15:57:39.623828 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 17660:18384(724) ack 546 win 31856 <nop,nop,timestamp 181750817 2257827> (DF) (ttl 53, id 549, len 776, bad cksum 9dc3!)
   148	15:57:39.624464 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 18384 win 31856 <nop,nop,timestamp 2257836 181750815> (DF) (ttl 64, id 52, len 52, bad cksum 9788!)
   149	15:57:39.634659 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 18384:19108(724) ack 546 win 31856 <nop,nop,timestamp 181750818 2257827> (DF) (ttl 53, id 550, len 776, bad cksum 9dc2!)
   150	15:57:39.643048 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 19108:19832(724) ack 546 win 31856 <nop,nop,timestamp 181750819 2257829> (DF) (ttl 53, id 551, len 776, bad cksum 9dc1!)
   151	15:57:39.643738 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 19832 win 31856 <nop,nop,timestamp 2257837 181750818> (DF) (ttl 64, id 53, len 52, bad cksum 9787!)
   152	15:57:39.658817 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 19832:20556(724) ack 546 win 31856 <nop,nop,timestamp 181750819 2257829> (DF) (ttl 53, id 552, len 776, bad cksum 9dc0!)
   153	15:57:39.666200 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 20556:21280(724) ack 546 win 31856 <nop,nop,timestamp 181750820 2257829> (DF) (ttl 53, id 553, len 776, bad cksum 9dbf!)
   154	15:57:39.666858 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 21280 win 31856 <nop,nop,timestamp 2257841 181750819> (DF) (ttl 64, id 54, len 52, bad cksum 9786!)
   155	15:57:39.676054 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 21280:22004(724) ack 546 win 31856 <nop,nop,timestamp 181750821 2257835> (DF) (ttl 53, id 555, len 776, bad cksum 9dbd!)
   156	15:57:39.687887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 22004:22728(724) ack 546 win 31856 <nop,nop,timestamp 181750822 2257835> (DF) (ttl 53, id 556, len 776, bad cksum 9dbc!)
   157	15:57:39.688515 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 22728 win 31856 <nop,nop,timestamp 2257843 181750821> (DF) (ttl 64, id 55, len 52, bad cksum 9785!)
   158	15:57:39.693054 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 22728:23452(724) ack 546 win 31856 <nop,nop,timestamp 181750823 2257836> (DF) (ttl 53, id 557, len 776, bad cksum 9dbb!)
   159	15:57:39.694982 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 23452 win 31856 <nop,nop,timestamp 2257845 181750823> (DF) (ttl 64, id 56, len 52, bad cksum 9784!)
   160	15:57:39.702907 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 23452:24176(724) ack 546 win 31856 <nop,nop,timestamp 181750824 2257836> (DF) (ttl 53, id 558, len 776, bad cksum 9dba!)
   161	15:57:39.715238 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 24176:24900(724) ack 546 win 31856 <nop,nop,timestamp 181750826 2257837> (DF) (ttl 53, id 559, len 776, bad cksum 9db9!)
   162	15:57:39.716238 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 24900 win 31856 <nop,nop,timestamp 2257847 181750824> (DF) (ttl 64, id 57, len 52, bad cksum 9783!)
   163	15:57:39.728286 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 24900:25624(724) ack 546 win 31856 <nop,nop,timestamp 181750827 2257837> (DF) (ttl 53, id 560, len 776, bad cksum 9db8!)
   164	15:57:39.733470 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 25624:26348(724) ack 546 win 31856 <nop,nop,timestamp 181750828 2257841> (DF) (ttl 53, id 561, len 776, bad cksum 9db7!)
   165	15:57:39.734134 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 26348 win 31856 <nop,nop,timestamp 2257848 181750827> (DF) (ttl 64, id 58, len 52, bad cksum 9782!)
   166	15:57:39.745284 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 26348:27072(724) ack 546 win 31856 <nop,nop,timestamp 181750829 2257841> (DF) (ttl 53, id 562, len 776, bad cksum 9db6!)
   167	15:57:39.762784 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 27072:27796(724) ack 546 win 31856 <nop,nop,timestamp 181750830 2257841> (DF) (ttl 53, id 564, len 776, bad cksum 9db4!)
   168	15:57:39.763444 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 27796 win 31856 <nop,nop,timestamp 2257851 181750829> (DF) (ttl 64, id 59, len 52, bad cksum 9781!)
   169	15:57:39.835708 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 27796:28520(724) ack 546 win 31856 <nop,nop,timestamp 181750837 2257848> (DF) (ttl 53, id 565, len 776, bad cksum 9db3!)
   170	15:57:39.848771 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 28520:29244(724) ack 546 win 31856 <nop,nop,timestamp 181750838 2257851> (DF) (ttl 53, id 567, len 776, bad cksum 9db1!)
   171	15:57:39.849435 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 29244 win 31856 <nop,nop,timestamp 2257860 181750837> (DF) (ttl 64, id 60, len 52, bad cksum 9780!)
   172	15:57:39.853203 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 29244:29968(724) ack 546 win 31856 <nop,nop,timestamp 181750839 2257851> (DF) (ttl 53, id 568, len 776, bad cksum 9db0!)
   173	15:57:39.864996 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 29968 win 31856 <nop,nop,timestamp 2257863 181750839> (DF) (ttl 64, id 61, len 52, bad cksum 977f!)
   174	15:57:39.866261 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 29968:30692(724) ack 546 win 31856 <nop,nop,timestamp 181750840 2257851> (DF) (ttl 53, id 569, len 776, bad cksum 9daf!)
   175	15:57:39.873647 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 30692:31416(724) ack 546 win 31856 <nop,nop,timestamp 181750841 2257851> (DF) (ttl 53, id 570, len 776, bad cksum 9dae!)
   176	15:57:39.874355 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 31416 win 31856 <nop,nop,timestamp 2257863 181750840> (DF) (ttl 64, id 62, len 52, bad cksum 977e!)
   177	15:57:39.885719 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 31416:32140(724) ack 546 win 31856 <nop,nop,timestamp 181750842 2257851> (DF) (ttl 53, id 571, len 776, bad cksum 9dad!)
   178	15:57:39.890405 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 32140:32864(724) ack 546 win 31856 <nop,nop,timestamp 181750843 2257851> (DF) (ttl 53, id 572, len 776, bad cksum 9dac!)
   179	15:57:39.891049 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 32864 win 31856 <nop,nop,timestamp 2257865 181750842> (DF) (ttl 64, id 63, len 52, bad cksum 977d!)
   180	15:57:39.897058 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 32864:33588(724) ack 546 win 31856 <nop,nop,timestamp 181750844 2257851> (DF) (ttl 53, id 573, len 776, bad cksum 9dab!)
   181	15:57:39.924977 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 33588 win 31856 <nop,nop,timestamp 2257870 181750844> (DF) (ttl 64, id 64, len 52, bad cksum 977c!)
   182	15:57:39.940663 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 33588:34312(724) ack 546 win 31856 <nop,nop,timestamp 181750848 2257863> (DF) (ttl 53, id 575, len 776, bad cksum 9da9!)
   183	15:57:39.949282 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 34312:35036(724) ack 546 win 31856 <nop,nop,timestamp 181750849 2257863> (DF) (ttl 53, id 576, len 776, bad cksum 9da8!)
   184	15:57:39.949901 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 35036 win 31856 <nop,nop,timestamp 2257872 181750848> (DF) (ttl 64, id 65, len 52, bad cksum 977b!)
   185	15:57:39.959869 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 35036:35760(724) ack 546 win 31856 <nop,nop,timestamp 181750850 2257865> (DF) (ttl 53, id 577, len 776, bad cksum 9da7!)
   186	15:57:39.971462 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 35760:36484(724) ack 546 win 31856 <nop,nop,timestamp 181750851 2257865> (DF) (ttl 53, id 578, len 776, bad cksum 9da6!)
   187	15:57:39.972102 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 36484 win 31856 <nop,nop,timestamp 2257874 181750850> (DF) (ttl 64, id 66, len 52, bad cksum 977a!)
   188	15:57:39.980333 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 36484:37208(724) ack 546 win 31856 <nop,nop,timestamp 181750852 2257865> (DF) (ttl 53, id 579, len 776, bad cksum 9da5!)
   189	15:57:39.994948 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 37208 win 31856 <nop,nop,timestamp 2257877 181750852> (DF) (ttl 64, id 67, len 52, bad cksum 9779!)
   190	15:57:39.995090 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 37208:37932(724) ack 546 win 31856 <nop,nop,timestamp 181750853 2257865> (DF) (ttl 53, id 580, len 776, bad cksum 9da4!)
   191	15:57:40.002748 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 37932:38656(724) ack 546 win 31856 <nop,nop,timestamp 181750854 2257870> (DF) (ttl 53, id 581, len 776, bad cksum 9da3!)
   192	15:57:40.003354 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 38656 win 31856 <nop,nop,timestamp 2257877 181750853> (DF) (ttl 64, id 68, len 52, bad cksum 9778!)
   193	15:57:40.014580 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 38656:39380(724) ack 546 win 31856 <nop,nop,timestamp 181750855 2257870> (DF) (ttl 53, id 583, len 776, bad cksum 9da1!)
   194	15:57:40.019753 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 39380:40104(724) ack 546 win 31856 <nop,nop,timestamp 181750856 2257872> (DF) (ttl 53, id 584, len 776, bad cksum 9da0!)
   195	15:57:40.020384 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 40104 win 31856 <nop,nop,timestamp 2257879 181750855> (DF) (ttl 64, id 69, len 52, bad cksum 9777!)
   196	15:57:40.027887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 40104:40828(724) ack 546 win 31856 <nop,nop,timestamp 181750857 2257872> (DF) (ttl 53, id 585, len 776, bad cksum 9d9f!)
   197	15:57:40.038491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 40828:41552(724) ack 546 win 31856 <nop,nop,timestamp 181750858 2257874> (DF) (ttl 53, id 586, len 776, bad cksum 9d9e!)
   198	15:57:40.039112 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 41552 win 31856 <nop,nop,timestamp 2257882 181750857> (DF) (ttl 64, id 70, len 52, bad cksum 9776!)
   199	15:57:40.052508 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 41552:42276(724) ack 546 win 31856 <nop,nop,timestamp 181750859 2257874> (DF) (ttl 53, id 587, len 776, bad cksum 9d9d!)
   200	15:57:40.061887 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 42276:43000(724) ack 546 win 31856 <nop,nop,timestamp 181750860 2257874> (DF) (ttl 53, id 588, len 776, bad cksum 9d9c!)
   201	15:57:40.062507 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 43000 win 31856 <nop,nop,timestamp 2257884 181750859> (DF) (ttl 64, id 71, len 52, bad cksum 9775!)
   202	15:57:40.069510 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 43000:43724(724) ack 546 win 31856 <nop,nop,timestamp 181750861 2257877> (DF) (ttl 53, id 589, len 776, bad cksum 9d9b!)
   203	15:57:40.077899 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 43724:44448(724) ack 546 win 31856 <nop,nop,timestamp 181750862 2257877> (DF) (ttl 53, id 590, len 776, bad cksum 9d9a!)
   204	15:57:40.078522 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 44448 win 31856 <nop,nop,timestamp 2257886 181750861> (DF) (ttl 64, id 72, len 52, bad cksum 9774!)
   205	15:57:40.089227 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 44448:45172(724) ack 546 win 31856 <nop,nop,timestamp 181750863 2257879> (DF) (ttl 53, id 591, len 776, bad cksum 9d99!)
   206	15:57:40.104883 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 45172 win 31856 <nop,nop,timestamp 2257889 181750863> (DF) (ttl 64, id 73, len 52, bad cksum 9773!)
   207	15:57:40.104977 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 45172:45896(724) ack 546 win 31856 <nop,nop,timestamp 181750864 2257879> (DF) (ttl 53, id 593, len 776, bad cksum 9d97!)
   208	15:57:40.109675 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 45896:46620(724) ack 546 win 31856 <nop,nop,timestamp 181750865 2257882> (DF) (ttl 53, id 594, len 776, bad cksum 9d96!)
   209	15:57:40.110285 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 46620 win 31856 <nop,nop,timestamp 2257889 181750864> (DF) (ttl 64, id 74, len 52, bad cksum 9772!)
   210	15:57:40.117312 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 46620:47344(724) ack 546 win 31856 <nop,nop,timestamp 181750866 2257882> (DF) (ttl 53, id 595, len 776, bad cksum 9d95!)
   211	15:57:40.127407 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 47344:48068(724) ack 546 win 31856 <nop,nop,timestamp 181750867 2257884> (DF) (ttl 53, id 596, len 776, bad cksum 9d94!)
   212	15:57:40.128020 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 48068 win 31856 <nop,nop,timestamp 2257892 181750866> (DF) (ttl 64, id 75, len 52, bad cksum 9771!)
   213	15:57:40.136530 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 48068:48792(724) ack 546 win 31856 <nop,nop,timestamp 181750868 2257884> (DF) (ttl 53, id 597, len 776, bad cksum 9d93!)
   214	15:57:40.149350 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 48792:49516(724) ack 546 win 31856 <nop,nop,timestamp 181750869 2257886> (DF) (ttl 53, id 598, len 776, bad cksum 9d92!)
   215	15:57:40.150015 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 49516 win 31856 <nop,nop,timestamp 2257894 181750868> (DF) (ttl 64, id 76, len 52, bad cksum 9770!)
   216	15:57:40.159196 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 49516:50240(724) ack 546 win 31856 <nop,nop,timestamp 181750870 2257886> (DF) (ttl 53, id 599, len 776, bad cksum 9d91!)
   217	15:57:40.171025 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 50240:50964(724) ack 546 win 31856 <nop,nop,timestamp 181750871 2257886> (DF) (ttl 53, id 600, len 776, bad cksum 9d90!)
   218	15:57:40.171645 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 50964 win 31856 <nop,nop,timestamp 2257896 181750870> (DF) (ttl 64, id 77, len 52, bad cksum 976f!)
   219	15:57:40.183087 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 50964:51688(724) ack 546 win 31856 <nop,nop,timestamp 181750872 2257889> (DF) (ttl 53, id 602, len 776, bad cksum 9d8e!)
   220	15:57:40.189748 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 51688:52412(724) ack 546 win 31856 <nop,nop,timestamp 181750873 2257889> (DF) (ttl 53, id 603, len 776, bad cksum 9d8d!)
   221	15:57:40.190368 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 52412 win 31856 <nop,nop,timestamp 2257898 181750872> (DF) (ttl 64, id 78, len 52, bad cksum 976e!)
   222	15:57:40.197634 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 52412:53136(724) ack 546 win 31856 <nop,nop,timestamp 181750874 2257892> (DF) (ttl 53, id 604, len 776, bad cksum 9d8c!)
   223	15:57:40.207983 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 53136:53860(724) ack 546 win 31856 <nop,nop,timestamp 181750875 2257892> (DF) (ttl 53, id 605, len 776, bad cksum 9d8b!)
   224	15:57:40.208629 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 53860 win 31856 <nop,nop,timestamp 2257900 181750874> (DF) (ttl 64, id 79, len 52, bad cksum 976d!)
   225	15:57:40.217093 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 53860:54584(724) ack 546 win 31856 <nop,nop,timestamp 181750876 2257894> (DF) (ttl 53, id 606, len 776, bad cksum 9d8a!)
   226	15:57:40.227687 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 54584:55308(724) ack 546 win 31856 <nop,nop,timestamp 181750877 2257894> (DF) (ttl 53, id 607, len 776, bad cksum 9d89!)
   227	15:57:40.228313 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 55308 win 31856 <nop,nop,timestamp 2257903 181750876> (DF) (ttl 64, id 80, len 52, bad cksum 976c!)
   228	15:57:40.237303 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 55308:56032(724) ack 546 win 31856 <nop,nop,timestamp 181750878 2257896> (DF) (ttl 53, id 608, len 776, bad cksum 9d88!)
   229	15:57:40.247890 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 56032:56756(724) ack 546 win 31856 <nop,nop,timestamp 181750879 2257896> (DF) (ttl 53, id 609, len 776, bad cksum 9d87!)
   230	15:57:40.248511 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 56756 win 31856 <nop,nop,timestamp 2257905 181750878> (DF) (ttl 64, id 81, len 52, bad cksum 976b!)
   231	15:57:40.257504 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 56756:57480(724) ack 546 win 31856 <nop,nop,timestamp 181750880 2257898> (DF) (ttl 53, id 610, len 776, bad cksum 9d86!)
   232	15:57:40.270564 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 57480:58204(724) ack 546 win 31856 <nop,nop,timestamp 181750881 2257898> (DF) (ttl 53, id 612, len 776, bad cksum 9d84!)
   233	15:57:40.271190 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 58204 win 31856 <nop,nop,timestamp 2257907 181750880> (DF) (ttl 64, id 82, len 52, bad cksum 976a!)
   234	15:57:40.276968 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 58204:58928(724) ack 546 win 31856 <nop,nop,timestamp 181750882 2257900> (DF) (ttl 53, id 613, len 776, bad cksum 9d83!)
   235	15:57:40.286334 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 58928:59652(724) ack 546 win 31856 <nop,nop,timestamp 181750883 2257900> (DF) (ttl 53, id 614, len 776, bad cksum 9d82!)
   236	15:57:40.286955 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 59652 win 31856 <nop,nop,timestamp 2257909 181750882> (DF) (ttl 64, id 83, len 52, bad cksum 9769!)
   237	15:57:40.296916 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 59652:60376(724) ack 546 win 31856 <nop,nop,timestamp 181750884 2257903> (DF) (ttl 53, id 615, len 776, bad cksum 9d81!)
   238	15:57:40.306036 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 60376:61100(724) ack 546 win 31856 <nop,nop,timestamp 181750885 2257903> (DF) (ttl 53, id 616, len 776, bad cksum 9d80!)
   239	15:57:40.306665 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 61100 win 31856 <nop,nop,timestamp 2257911 181750884> (DF) (ttl 64, id 84, len 52, bad cksum 9768!)
   240	15:57:40.316882 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 61100:61824(724) ack 546 win 31856 <nop,nop,timestamp 181750886 2257905> (DF) (ttl 53, id 617, len 776, bad cksum 9d7f!)
   241	15:57:40.327720 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 61824:62548(724) ack 546 win 31856 <nop,nop,timestamp 181750887 2257905> (DF) (ttl 53, id 618, len 776, bad cksum 9d7e!)
   242	15:57:40.328329 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 62548 win 31856 <nop,nop,timestamp 2257913 181750886> (DF) (ttl 64, id 85, len 52, bad cksum 9767!)
   243	15:57:40.339287 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 62548:63272(724) ack 546 win 31856 <nop,nop,timestamp 181750888 2257907> (DF) (ttl 53, id 619, len 776, bad cksum 9d7d!)
   244	15:57:40.353835 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 63272:63996(724) ack 546 win 31856 <nop,nop,timestamp 181750889 2257907> (DF) (ttl 53, id 621, len 776, bad cksum 9d7b!)
   245	15:57:40.354448 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 63996 win 31856 <nop,nop,timestamp 2257915 181750888> (DF) (ttl 64, id 86, len 52, bad cksum 9766!)
   246	15:57:40.359266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 63996:64720(724) ack 546 win 31856 <nop,nop,timestamp 181750890 2257909> (DF) (ttl 53, id 622, len 776, bad cksum 9d7a!)
   247	15:57:40.364920 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 64720 win 31856 <nop,nop,timestamp 2257917 181750890> (DF) (ttl 64, id 87, len 52, bad cksum 9765!)
   248	15:57:40.366161 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 64720:65444(724) ack 546 win 31856 <nop,nop,timestamp 181750891 2257909> (DF) (ttl 53, id 623, len 776, bad cksum 9d79!)
   249	15:57:40.376750 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 65444:66168(724) ack 546 win 31856 <nop,nop,timestamp 181750892 2257911> (DF) (ttl 53, id 624, len 776, bad cksum 9d78!)
   250	15:57:40.377360 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 66168 win 31856 <nop,nop,timestamp 2257918 181750891> (DF) (ttl 64, id 88, len 52, bad cksum 9764!)
   251	15:57:40.384641 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 66168:66892(724) ack 546 win 31856 <nop,nop,timestamp 181750893 2257911> (DF) (ttl 53, id 625, len 776, bad cksum 9d77!)
   252	15:57:40.395197 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 66892 win 31856 <nop,nop,timestamp 2257920 181750893> (DF) (ttl 64, id 89, len 52, bad cksum 9763!)
   253	15:57:40.396456 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 66892:67616(724) ack 546 win 31856 <nop,nop,timestamp 181750894 2257911> (DF) (ttl 53, id 626, len 776, bad cksum 9d76!)
   254	15:57:40.404099 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 67616:68340(724) ack 546 win 31856 <nop,nop,timestamp 181750895 2257913> (DF) (ttl 53, id 627, len 776, bad cksum 9d75!)
   255	15:57:40.404947 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 68340 win 31856 <nop,nop,timestamp 2257921 181750894> (DF) (ttl 64, id 90, len 52, bad cksum 9762!)
   256	15:57:40.415911 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 68340:69064(724) ack 546 win 31856 <nop,nop,timestamp 181750896 2257913> (DF) (ttl 53, id 628, len 776, bad cksum 9d74!)
   257	15:57:40.425279 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 69064:69788(724) ack 546 win 31856 <nop,nop,timestamp 181750897 2257915> (DF) (ttl 53, id 629, len 776, bad cksum 9d73!)
   258	15:57:40.425886 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 69788 win 31856 <nop,nop,timestamp 2257923 181750896> (DF) (ttl 64, id 91, len 52, bad cksum 9761!)
   259	15:57:40.439819 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 69788:70512(724) ack 546 win 31856 <nop,nop,timestamp 181750898 2257917> (DF) (ttl 53, id 631, len 776, bad cksum 9d71!)
   260	15:57:40.445731 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 70512:71236(724) ack 546 win 31856 <nop,nop,timestamp 181750899 2257918> (DF) (ttl 53, id 632, len 776, bad cksum 9d70!)
   261	15:57:40.446349 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 71236 win 31856 <nop,nop,timestamp 2257925 181750898> (DF) (ttl 64, id 92, len 52, bad cksum 9760!)
   262	15:57:40.454614 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 71236:71960(724) ack 546 win 31856 <nop,nop,timestamp 181750900 2257918> (DF) (ttl 53, id 633, len 776, bad cksum 9d6f!)
   263	15:57:40.464721 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 71960:72684(724) ack 546 win 31856 <nop,nop,timestamp 181750901 2257920> (DF) (ttl 53, id 634, len 776, bad cksum 9d6e!)
   264	15:57:40.465512 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 72684 win 31856 <nop,nop,timestamp 2257926 181750900> (DF) (ttl 64, id 93, len 52, bad cksum 975f!)
   265	15:57:40.474548 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 72684:73408(724) ack 546 win 31856 <nop,nop,timestamp 181750902 2257921> (DF) (ttl 53, id 635, len 776, bad cksum 9d6d!)
   266	15:57:40.484913 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 73408:74132(724) ack 546 win 31856 <nop,nop,timestamp 181750903 2257921> (DF) (ttl 53, id 636, len 776, bad cksum 9d6c!)
   267	15:57:40.485591 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 73408 win 31856 <nop,nop,timestamp 2257928 181750902> (DF) (ttl 64, id 94, len 52, bad cksum 975e!)
   268	15:57:40.494575 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 74132:74856(724) ack 546 win 31856 <nop,nop,timestamp 181750904 2257923> (DF) (ttl 53, id 637, len 776, bad cksum 9d6b!)
   269	15:57:40.495474 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 74856 win 31856 <nop,nop,timestamp 2257928 181750903> (DF) (ttl 64, id 95, len 52, bad cksum 975d!)
   270	15:57:40.504854 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 74856:75580(724) ack 546 win 31856 <nop,nop,timestamp 181750905 2257923> (DF) (ttl 53, id 638, len 776, bad cksum 9d6a!)
   271	15:57:40.515703 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 75580:76304(724) ack 546 win 31856 <nop,nop,timestamp 181750906 2257925> (DF) (ttl 53, id 639, len 776, bad cksum 9d69!)
   272	15:57:40.516308 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 76304 win 31856 <nop,nop,timestamp 2257931 181750905> (DF) (ttl 64, id 96, len 52, bad cksum 975c!)
   273	15:57:40.527766 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 76304:77028(724) ack 546 win 31856 <nop,nop,timestamp 181750907 2257925> (DF) (ttl 53, id 641, len 776, bad cksum 9d67!)
   274	15:57:40.534931 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 77028:77752(724) ack 546 win 31856 <nop,nop,timestamp 181750908 2257926> (DF) (ttl 53, id 642, len 776, bad cksum 9d66!)
   275	15:57:40.535593 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 77752 win 31856 <nop,nop,timestamp 2257933 181750907> (DF) (ttl 64, id 97, len 52, bad cksum 975b!)
   276	15:57:40.544792 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 77752:78476(724) ack 546 win 31856 <nop,nop,timestamp 181750909 2257926> (DF) (ttl 53, id 643, len 776, bad cksum 9d65!)
   277	15:57:40.553638 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 78476:79200(724) ack 546 win 31856 <nop,nop,timestamp 181750910 2257928> (DF) (ttl 53, id 644, len 776, bad cksum 9d64!)
   278	15:57:40.554309 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 79200 win 31856 <nop,nop,timestamp 2257934 181750909> (DF) (ttl 64, id 98, len 52, bad cksum 975a!)
   279	15:57:40.563250 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 79200:79924(724) ack 546 win 31856 <nop,nop,timestamp 181750911 2257928> (DF) (ttl 53, id 645, len 776, bad cksum 9d63!)
   280	15:57:40.564887 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 79924 win 31856 <nop,nop,timestamp 2257936 181750911> (DF) (ttl 64, id 99, len 52, bad cksum 9759!)
   281	15:57:40.573836 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 79924:80648(724) ack 546 win 31856 <nop,nop,timestamp 181750912 2257928> (DF) (ttl 53, id 646, len 776, bad cksum 9d62!)
   282	15:57:40.583696 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 80648:81372(724) ack 546 win 31856 <nop,nop,timestamp 181750913 2257931> (DF) (ttl 53, id 647, len 776, bad cksum 9d61!)
   283	15:57:40.584314 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 81372 win 31856 <nop,nop,timestamp 2257936 181750912> (DF) (ttl 64, id 100, len 52, bad cksum 9758!)
   284	15:57:40.600459 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 81372:82096(724) ack 546 win 31856 <nop,nop,timestamp 181750914 2257931> (DF) (ttl 53, id 649, len 776, bad cksum 9d5f!)
   285	15:57:40.612052 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 82096:82820(724) ack 546 win 31856 <nop,nop,timestamp 181750915 2257933> (DF) (ttl 53, id 651, len 776, bad cksum 9d5d!)
   286	15:57:40.612667 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 82820 win 31856 <nop,nop,timestamp 2257939 181750914> (DF) (ttl 64, id 101, len 52, bad cksum 9757!)
   287	15:57:40.617442 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 82820:83544(724) ack 546 win 31856 <nop,nop,timestamp 181750916 2257933> (DF) (ttl 53, id 652, len 776, bad cksum 9d5c!)
   288	15:57:40.623614 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 83544:84268(724) ack 546 win 31856 <nop,nop,timestamp 181750917 2257934> (DF) (ttl 53, id 653, len 776, bad cksum 9d5b!)
   289	15:57:40.624263 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 84268 win 31856 <nop,nop,timestamp 2257940 181750916> (DF) (ttl 64, id 102, len 52, bad cksum 9756!)
   290	15:57:40.632512 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 84268:84992(724) ack 546 win 31856 <nop,nop,timestamp 181750918 2257936> (DF) (ttl 53, id 654, len 776, bad cksum 9d5a!)
   291	15:57:40.642345 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 84992:85716(724) ack 546 win 31856 <nop,nop,timestamp 181750918 2257936> (DF) (ttl 53, id 655, len 776, bad cksum 9d59!)
   292	15:57:40.642975 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 85716 win 31856 <nop,nop,timestamp 2257942 181750918> (DF) (ttl 64, id 103, len 52, bad cksum 9755!)
   293	15:57:40.651446 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 85716:86440(724) ack 546 win 31856 <nop,nop,timestamp 181750919 2257936> (DF) (ttl 53, id 656, len 776, bad cksum 9d58!)
   294	15:57:40.660815 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 86440:87164(724) ack 546 win 31856 <nop,nop,timestamp 181750920 2257936> (DF) (ttl 53, id 657, len 776, bad cksum 9d57!)
   295	15:57:40.661428 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 87164 win 31856 <nop,nop,timestamp 2257944 181750919> (DF) (ttl 64, id 104, len 52, bad cksum 9754!)
   296	15:57:40.669433 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 87164:87888(724) ack 546 win 31856 <nop,nop,timestamp 181750921 2257936> (DF) (ttl 53, id 658, len 776, bad cksum 9d56!)
   297	15:57:40.680030 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 87888:88612(724) ack 546 win 31856 <nop,nop,timestamp 181750922 2257939> (DF) (ttl 53, id 659, len 776, bad cksum 9d55!)
   298	15:57:40.680640 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 88612 win 31856 <nop,nop,timestamp 2257946 181750921> (DF) (ttl 64, id 105, len 52, bad cksum 9753!)
   299	15:57:40.692848 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 88612:89336(724) ack 546 win 31856 <nop,nop,timestamp 181750923 2257940> (DF) (ttl 53, id 661, len 776, bad cksum 9d53!)
   300	15:57:40.700232 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 89336:90060(724) ack 546 win 31856 <nop,nop,timestamp 181750924 2257940> (DF) (ttl 53, id 662, len 776, bad cksum 9d52!)
   301	15:57:40.700846 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 90060 win 31856 <nop,nop,timestamp 2257948 181750923> (DF) (ttl 64, id 106, len 52, bad cksum 9752!)
   302	15:57:40.709835 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 90060:90784(724) ack 546 win 31856 <nop,nop,timestamp 181750925 2257942> (DF) (ttl 53, id 663, len 776, bad cksum 9d51!)
   303	15:57:40.719703 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 90784:91508(724) ack 546 win 31856 <nop,nop,timestamp 181750926 2257942> (DF) (ttl 53, id 664, len 776, bad cksum 9d50!)
   304	15:57:40.720318 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 91508 win 31856 <nop,nop,timestamp 2257950 181750925> (DF) (ttl 64, id 107, len 52, bad cksum 9751!)
   305	15:57:40.729302 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 91508:92232(724) ack 546 win 31856 <nop,nop,timestamp 181750927 2257944> (DF) (ttl 53, id 665, len 776, bad cksum 9d4f!)
   306	15:57:40.739181 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 92232:92956(724) ack 546 win 31856 <nop,nop,timestamp 181750928 2257944> (DF) (ttl 53, id 666, len 776, bad cksum 9d4e!)
   307	15:57:40.739793 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 92956 win 31856 <nop,nop,timestamp 2257952 181750927> (DF) (ttl 64, id 108, len 52, bad cksum 9750!)
   308	15:57:40.749504 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 92956:93680(724) ack 546 win 31856 <nop,nop,timestamp 181750929 2257946> (DF) (ttl 53, id 667, len 776, bad cksum 9d4d!)
   309	15:57:40.757639 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 93680:94404(724) ack 546 win 31856 <nop,nop,timestamp 181750930 2257946> (DF) (ttl 53, id 668, len 776, bad cksum 9d4c!)
   310	15:57:40.758243 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 94404 win 31856 <nop,nop,timestamp 2257954 181750929> (DF) (ttl 64, id 109, len 52, bad cksum 974f!)
   311	15:57:40.767249 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 94404:95128(724) ack 546 win 31856 <nop,nop,timestamp 181750931 2257948> (DF) (ttl 53, id 669, len 776, bad cksum 9d4b!)
   312	15:57:40.779808 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 95128:95852(724) ack 546 win 31856 <nop,nop,timestamp 181750932 2257948> (DF) (ttl 53, id 671, len 776, bad cksum 9d49!)
   313	15:57:40.780434 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 95852 win 31856 <nop,nop,timestamp 2257956 181750931> (DF) (ttl 64, id 110, len 52, bad cksum 974e!)
   314	15:57:40.787447 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 95852:96576(724) ack 546 win 31856 <nop,nop,timestamp 181750933 2257948> (DF) (ttl 53, id 672, len 776, bad cksum 9d48!)
   315	15:57:40.796403 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 96576:97300(724) ack 546 win 31856 <nop,nop,timestamp 181750934 2257950> (DF) (ttl 53, id 673, len 776, bad cksum 9d47!)
   316	15:57:40.797011 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 97300 win 31856 <nop,nop,timestamp 2257958 181750933> (DF) (ttl 64, id 111, len 52, bad cksum 974d!)
   317	15:57:40.806419 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 97300:98024(724) ack 546 win 31856 <nop,nop,timestamp 181750935 2257952> (DF) (ttl 53, id 674, len 776, bad cksum 9d46!)
   318	15:57:40.819253 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 98024:98748(724) ack 546 win 31856 <nop,nop,timestamp 181750936 2257952> (DF) (ttl 53, id 675, len 776, bad cksum 9d45!)
   319	15:57:40.819855 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 98748 win 31856 <nop,nop,timestamp 2257960 181750935> (DF) (ttl 64, id 112, len 52, bad cksum 974c!)
   320	15:57:40.827108 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 98748:99472(724) ack 546 win 31856 <nop,nop,timestamp 181750937 2257954> (DF) (ttl 53, id 676, len 776, bad cksum 9d44!)
   321	15:57:40.835009 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 99472:100196(724) ack 546 win 31856 <nop,nop,timestamp 181750938 2257954> (DF) (ttl 53, id 677, len 776, bad cksum 9d43!)
   322	15:57:40.835660 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 100196 win 31856 <nop,nop,timestamp 2257962 181750937> (DF) (ttl 64, id 113, len 52, bad cksum 974b!)
   323	15:57:40.844369 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 100196:100920(724) ack 546 win 31856 <nop,nop,timestamp 181750939 2257954> (DF) (ttl 53, id 678, len 776, bad cksum 9d42!)
   324	15:57:40.854974 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 100920 win 31856 <nop,nop,timestamp 2257964 181750939> (DF) (ttl 64, id 114, len 52, bad cksum 974a!)
   325	15:57:40.857422 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 100920:101644(724) ack 546 win 31856 <nop,nop,timestamp 181750940 2257956> (DF) (ttl 53, id 679, len 776, bad cksum 9d41!)
   326	15:57:40.877146 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 101644:102368(724) ack 546 win 31856 <nop,nop,timestamp 181750941 2257958> (DF) (ttl 53, id 682, len 776, bad cksum 9d3e!)
   327	15:57:40.880243 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 102368 win 31856 <nop,nop,timestamp 2257965 181750940> (DF) (ttl 64, id 115, len 52, bad cksum 9749!)
   328	15:57:40.881803 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 102368:103092(724) ack 546 win 31856 <nop,nop,timestamp 181750942 2257958> (DF) (ttl 53, id 683, len 776, bad cksum 9d3d!)
   329	15:57:40.884923 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 103092 win 31856 <nop,nop,timestamp 2257967 181750942> (DF) (ttl 64, id 116, len 52, bad cksum 9748!)
   330	15:57:40.886823 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 103092:103816(724) ack 546 win 31856 <nop,nop,timestamp 181750943 2257958> (DF) (ttl 53, id 684, len 776, bad cksum 9d3c!)
   331	15:57:40.895355 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 103816:104540(724) ack 546 win 31856 <nop,nop,timestamp 181750944 2257960> (DF) (ttl 53, id 685, len 776, bad cksum 9d3b!)
   332	15:57:40.895970 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 104540 win 31856 <nop,nop,timestamp 2257968 181750943> (DF) (ttl 64, id 117, len 52, bad cksum 9747!)
   333	15:57:40.914324 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 104540:105264(724) ack 546 win 31856 <nop,nop,timestamp 181750945 2257962> (DF) (ttl 53, id 686, len 776, bad cksum 9d3a!)
   334	15:57:40.919252 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 105264:105988(724) ack 546 win 31856 <nop,nop,timestamp 181750946 2257962> (DF) (ttl 53, id 687, len 776, bad cksum 9d39!)
   335	15:57:40.919853 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 105988 win 31856 <nop,nop,timestamp 2257969 181750945> (DF) (ttl 64, id 118, len 52, bad cksum 9746!)
   336	15:57:40.927629 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 105988:106712(724) ack 546 win 31856 <nop,nop,timestamp 181750947 2257964> (DF) (ttl 53, id 688, len 776, bad cksum 9d38!)
   337	15:57:40.937978 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 106712:107436(724) ack 546 win 31856 <nop,nop,timestamp 181750948 2257964> (DF) (ttl 53, id 689, len 776, bad cksum 9d37!)
   338	15:57:40.938593 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 107436 win 31856 <nop,nop,timestamp 2257972 181750947> (DF) (ttl 64, id 119, len 52, bad cksum 9745!)
   339	15:57:40.956956 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 107436:108160(724) ack 546 win 31856 <nop,nop,timestamp 181750949 2257964> (DF) (ttl 53, id 691, len 776, bad cksum 9d35!)
   340	15:57:40.961636 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 108160:108884(724) ack 546 win 31856 <nop,nop,timestamp 181750950 2257967> (DF) (ttl 53, id 692, len 776, bad cksum 9d34!)
   341	15:57:40.962233 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 108884 win 31856 <nop,nop,timestamp 2257974 181750949> (DF) (ttl 64, id 120, len 52, bad cksum 9744!)
   342	15:57:40.966067 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 108884:109608(724) ack 546 win 31856 <nop,nop,timestamp 181750950 2257968> (DF) (ttl 53, id 693, len 776, bad cksum 9d33!)
   343	15:57:40.976179 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 109608:110332(724) ack 546 win 31856 <nop,nop,timestamp 181750951 2257968> (DF) (ttl 53, id 694, len 776, bad cksum 9d32!)
   344	15:57:40.976783 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 110332 win 31856 <nop,nop,timestamp 2257977 181750950> (DF) (ttl 64, id 121, len 52, bad cksum 9743!)
   345	15:57:40.991686 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 110332:111056(724) ack 546 win 31856 <nop,nop,timestamp 181750952 2257968> (DF) (ttl 53, id 695, len 776, bad cksum 9d31!)
   346	15:57:40.997618 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 111056:111780(724) ack 546 win 31856 <nop,nop,timestamp 181750953 2257969> (DF) (ttl 53, id 696, len 776, bad cksum 9d30!)
   347	15:57:40.998226 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 111780 win 31856 <nop,nop,timestamp 2257979 181750952> (DF) (ttl 64, id 122, len 52, bad cksum 9742!)
   348	15:57:41.005491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 111780:112504(724) ack 546 win 31856 <nop,nop,timestamp 181750954 2257969> (DF) (ttl 53, id 697, len 776, bad cksum 9d2f!)
   349	15:57:41.018802 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 112504:113228(724) ack 546 win 31856 <nop,nop,timestamp 181750955 2257972> (DF) (ttl 53, id 698, len 776, bad cksum 9d2e!)
   350	15:57:41.019433 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 113228 win 31856 <nop,nop,timestamp 2257982 181750954> (DF) (ttl 64, id 123, len 52, bad cksum 9741!)
   351	15:57:41.028150 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 113228:113952(724) ack 546 win 31856 <nop,nop,timestamp 181750956 2257972> (DF) (ttl 53, id 699, len 776, bad cksum 9d2d!)
   352	15:57:41.039981 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 113952:114676(724) ack 546 win 31856 <nop,nop,timestamp 181750957 2257974> (DF) (ttl 53, id 701, len 776, bad cksum 9d2b!)
   353	15:57:41.040597 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 114676 win 31856 <nop,nop,timestamp 2257984 181750956> (DF) (ttl 64, id 124, len 52, bad cksum 9740!)
   354	15:57:41.044659 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 114676:115400(724) ack 546 win 31856 <nop,nop,timestamp 181750958 2257974> (DF) (ttl 53, id 702, len 776, bad cksum 9d2a!)
   355	15:57:41.050827 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 115400:116124(724) ack 546 win 31856 <nop,nop,timestamp 181750959 2257977> (DF) (ttl 53, id 703, len 776, bad cksum 9d29!)
   356	15:57:41.051442 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 116124 win 31856 <nop,nop,timestamp 2257985 181750958> (DF) (ttl 64, id 125, len 52, bad cksum 973f!)
   357	15:57:41.059930 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 116124:116848(724) ack 546 win 31856 <nop,nop,timestamp 181750960 2257977> (DF) (ttl 53, id 704, len 776, bad cksum 9d28!)
   358	15:57:41.069064 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 116848:117572(724) ack 546 win 31856 <nop,nop,timestamp 181750961 2257979> (DF) (ttl 53, id 705, len 776, bad cksum 9d27!)
   359	15:57:41.069681 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 117572 win 31856 <nop,nop,timestamp 2257987 181750960> (DF) (ttl 64, id 126, len 52, bad cksum 973e!)
   360	15:57:41.077429 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 117572:118296(724) ack 546 win 31856 <nop,nop,timestamp 181750962 2257979> (DF) (ttl 53, id 706, len 776, bad cksum 9d26!)
   361	15:57:41.088756 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 118296:119020(724) ack 546 win 31856 <nop,nop,timestamp 181750963 2257982> (DF) (ttl 53, id 707, len 776, bad cksum 9d25!)
   362	15:57:41.089372 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 119020 win 31856 <nop,nop,timestamp 2257989 181750962> (DF) (ttl 64, id 127, len 52, bad cksum 973d!)
   363	15:57:41.098627 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 119020:119744(724) ack 546 win 31856 <nop,nop,timestamp 181750964 2257982> (DF) (ttl 53, id 708, len 776, bad cksum 9d24!)
   364	15:57:41.107981 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 119744:120468(724) ack 546 win 31856 <nop,nop,timestamp 181750965 2257982> (DF) (ttl 53, id 709, len 776, bad cksum 9d23!)
   365	15:57:41.108617 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 120468 win 31856 <nop,nop,timestamp 2257991 181750964> (DF) (ttl 64, id 128, len 52, bad cksum 973c!)
   366	15:57:41.124487 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 120468:121192(724) ack 546 win 31856 <nop,nop,timestamp 181750966 2257985> (DF) (ttl 53, id 711, len 776, bad cksum 9d21!)
   367	15:57:41.131631 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 121192:121916(724) ack 546 win 31856 <nop,nop,timestamp 181750967 2257985> (DF) (ttl 53, id 712, len 776, bad cksum 9d20!)
   368	15:57:41.132237 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 121916 win 31856 <nop,nop,timestamp 2257992 181750966> (DF) (ttl 64, id 129, len 52, bad cksum 973b!)
   369	15:57:41.136798 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 121916:122640(724) ack 546 win 31856 <nop,nop,timestamp 181750968 2257987> (DF) (ttl 53, id 713, len 776, bad cksum 9d1f!)
   370	15:57:41.146421 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 122640:123364(724) ack 546 win 31856 <nop,nop,timestamp 181750969 2257987> (DF) (ttl 53, id 714, len 776, bad cksum 9d1e!)
   371	15:57:41.147034 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 123364 win 31856 <nop,nop,timestamp 2257995 181750968> (DF) (ttl 64, id 130, len 52, bad cksum 973a!)
   372	15:57:41.156762 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 123364:124088(724) ack 546 win 31856 <nop,nop,timestamp 181750970 2257989> (DF) (ttl 53, id 715, len 776, bad cksum 9d1d!)
   373	15:57:41.167362 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 124088:124812(724) ack 546 win 31856 <nop,nop,timestamp 181750971 2257989> (DF) (ttl 53, id 716, len 776, bad cksum 9d1c!)
   374	15:57:41.167979 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 124812 win 31856 <nop,nop,timestamp 2257997 181750970> (DF) (ttl 64, id 131, len 52, bad cksum 9739!)
   375	15:57:41.176219 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 124812:125536(724) ack 546 win 31856 <nop,nop,timestamp 181750972 2257991> (DF) (ttl 53, id 717, len 776, bad cksum 9d1b!)
   376	15:57:41.187066 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 125536:126260(724) ack 546 win 31856 <nop,nop,timestamp 181750973 2257991> (DF) (ttl 53, id 718, len 776, bad cksum 9d1a!)
   377	15:57:41.187702 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 126260 win 31856 <nop,nop,timestamp 2257999 181750972> (DF) (ttl 64, id 132, len 52, bad cksum 9738!)
   378	15:57:41.199147 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 126260:126984(724) ack 546 win 31856 <nop,nop,timestamp 181750974 2257991> (DF) (ttl 53, id 719, len 776, bad cksum 9d19!)
   379	15:57:41.211707 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 126984:127708(724) ack 546 win 31856 <nop,nop,timestamp 181750975 2257992> (DF) (ttl 53, id 721, len 776, bad cksum 9d17!)
   380	15:57:41.212344 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 127708 win 31856 <nop,nop,timestamp 2258001 181750974> (DF) (ttl 64, id 133, len 52, bad cksum 9737!)
   381	15:57:41.218353 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 127708:128432(724) ack 546 win 31856 <nop,nop,timestamp 181750976 2257995> (DF) (ttl 53, id 722, len 776, bad cksum 9d16!)
   382	15:57:41.226974 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 128432:129156(724) ack 546 win 31856 <nop,nop,timestamp 181750977 2257995> (DF) (ttl 53, id 723, len 776, bad cksum 9d15!)
   383	15:57:41.227586 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 129156 win 31856 <nop,nop,timestamp 2258004 181750976> (DF) (ttl 64, id 134, len 52, bad cksum 9736!)
   384	15:57:41.237317 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 129156:129880(724) ack 546 win 31856 <nop,nop,timestamp 181750978 2257997> (DF) (ttl 53, id 724, len 776, bad cksum 9d14!)
   385	15:57:41.245458 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 129880:130604(724) ack 546 win 31856 <nop,nop,timestamp 181750979 2257997> (DF) (ttl 53, id 725, len 776, bad cksum 9d13!)
   386	15:57:41.246085 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 130604 win 31856 <nop,nop,timestamp 2258006 181750978> (DF) (ttl 64, id 135, len 52, bad cksum 9735!)
   387	15:57:41.256300 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 130604:131328(724) ack 546 win 31856 <nop,nop,timestamp 181750980 2257999> (DF) (ttl 53, id 726, len 776, bad cksum 9d12!)
   388	15:57:41.266648 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 131328:132052(724) ack 546 win 31856 <nop,nop,timestamp 181750981 2257999> (DF) (ttl 53, id 727, len 776, bad cksum 9d11!)
   389	15:57:41.267265 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 132052 win 31856 <nop,nop,timestamp 2258008 181750980> (DF) (ttl 64, id 136, len 52, bad cksum 9734!)
   390	15:57:41.275509 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 132052:132776(724) ack 546 win 31856 <nop,nop,timestamp 181750982 2257999> (DF) (ttl 53, id 728, len 776, bad cksum 9d10!)
   391	15:57:41.289316 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 132776:133500(724) ack 546 win 31856 <nop,nop,timestamp 181750983 2258001> (DF) (ttl 53, id 730, len 776, bad cksum 9d0e!)
   392	15:57:41.289937 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 133500 win 31856 <nop,nop,timestamp 2258010 181750982> (DF) (ttl 64, id 137, len 52, bad cksum 9733!)
   393	15:57:41.295712 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 133500:134224(724) ack 546 win 31856 <nop,nop,timestamp 181750984 2258004> (DF) (ttl 53, id 731, len 776, bad cksum 9d0d!)
   394	15:57:41.304095 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 134224:134948(724) ack 546 win 31856 <nop,nop,timestamp 181750985 2258004> (DF) (ttl 53, id 732, len 776, bad cksum 9d0c!)
   395	15:57:41.304942 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 134948 win 31856 <nop,nop,timestamp 2258011 181750984> (DF) (ttl 64, id 138, len 52, bad cksum 9732!)
   396	15:57:41.314201 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 134948:135672(724) ack 546 win 31856 <nop,nop,timestamp 181750986 2258006> (DF) (ttl 53, id 733, len 776, bad cksum 9d0b!)
   397	15:57:41.326515 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 135672:136396(724) ack 546 win 31856 <nop,nop,timestamp 181750987 2258006> (DF) (ttl 53, id 734, len 776, bad cksum 9d0a!)
   398	15:57:41.327127 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 136396 win 31856 <nop,nop,timestamp 2258013 181750986> (DF) (ttl 64, id 139, len 52, bad cksum 9731!)
   399	15:57:41.333409 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 136396:137120(724) ack 546 win 31856 <nop,nop,timestamp 181750988 2258008> (DF) (ttl 53, id 735, len 776, bad cksum 9d09!)
   400	15:57:41.334986 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 137120 win 31856 <nop,nop,timestamp 2258015 181750988> (DF) (ttl 64, id 140, len 52, bad cksum 9730!)
   401	15:57:41.344499 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 137120:137844(724) ack 546 win 31856 <nop,nop,timestamp 181750989 2258008> (DF) (ttl 53, id 736, len 776, bad cksum 9d08!)
   402	15:57:41.354852 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 137844:138568(724) ack 546 win 31856 <nop,nop,timestamp 181750990 2258008> (DF) (ttl 53, id 737, len 776, bad cksum 9d07!)
   403	15:57:41.355518 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 138568 win 31856 <nop,nop,timestamp 2258015 181750989> (DF) (ttl 64, id 141, len 52, bad cksum 972f!)
   404	15:57:41.363720 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 138568:139292(724) ack 546 win 31856 <nop,nop,timestamp 181750991 2258010> (DF) (ttl 53, id 738, len 776, bad cksum 9d06!)
   405	15:57:41.373814 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 139292:140016(724) ack 546 win 31856 <nop,nop,timestamp 181750992 2258011> (DF) (ttl 53, id 739, len 776, bad cksum 9d05!)
   406	15:57:41.374439 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 140016 win 31856 <nop,nop,timestamp 2258017 181750991> (DF) (ttl 64, id 142, len 52, bad cksum 972e!)
   407	15:57:41.382674 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 140016:140740(724) ack 546 win 31856 <nop,nop,timestamp 181750993 2258011> (DF) (ttl 53, id 740, len 776, bad cksum 9d04!)
   408	15:57:41.384919 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 140740 win 31856 <nop,nop,timestamp 2258019 181750993> (DF) (ttl 64, id 143, len 52, bad cksum 972d!)
   409	15:57:41.392542 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 140740:141464(724) ack 546 win 31856 <nop,nop,timestamp 181750994 2258011> (DF) (ttl 53, id 741, len 776, bad cksum 9d03!)
   410	15:57:41.403402 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 141464:142188(724) ack 546 win 31856 <nop,nop,timestamp 181750995 2258015> (DF) (ttl 53, id 742, len 776, bad cksum 9d02!)
   411	15:57:41.404054 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 142188 win 31856 <nop,nop,timestamp 2258020 181750994> (DF) (ttl 64, id 144, len 52, bad cksum 972c!)
   412	15:57:41.412989 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 142188:142912(724) ack 546 win 31856 <nop,nop,timestamp 181750996 2258015> (DF) (ttl 53, id 743, len 776, bad cksum 9d01!)
   413	15:57:41.414979 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 142912 win 31856 <nop,nop,timestamp 2258022 181750996> (DF) (ttl 64, id 145, len 52, bad cksum 972b!)
   414	15:57:41.422593 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 142912:143636(724) ack 546 win 31856 <nop,nop,timestamp 181750997 2258015> (DF) (ttl 53, id 744, len 776, bad cksum 9d00!)
   415	15:57:41.432209 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 143636:144360(724) ack 546 win 31856 <nop,nop,timestamp 181750998 2258015> (DF) (ttl 53, id 745, len 776, bad cksum 9cff!)
   416	15:57:41.432830 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 144360 win 31856 <nop,nop,timestamp 2258024 181750997> (DF) (ttl 64, id 146, len 52, bad cksum 972a!)
   417	15:57:41.441564 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 144360:145084(724) ack 546 win 31856 <nop,nop,timestamp 181750999 2258015> (DF) (ttl 53, id 746, len 776, bad cksum 9cfe!)
   418	15:57:41.452160 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 145084:145808(724) ack 546 win 31856 <nop,nop,timestamp 181751000 2258019> (DF) (ttl 53, id 747, len 776, bad cksum 9cfd!)
   419	15:57:41.452773 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 145808 win 31856 <nop,nop,timestamp 2258026 181750999> (DF) (ttl 64, id 147, len 52, bad cksum 9729!)
   420	15:57:41.461535 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 145808:146532(724) ack 546 win 31856 <nop,nop,timestamp 181751001 2258019> (DF) (ttl 53, id 748, len 776, bad cksum 9cfc!)
   421	15:57:41.467652 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 146532 win 31856 <nop,nop,timestamp 2258029 181751001> (DF) (ttl 64, id 148, len 52, bad cksum 9728!)
   422	15:57:41.474851 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 146532:147256(724) ack 546 win 31856 <nop,nop,timestamp 181751002 2258020> (DF) (ttl 53, id 749, len 776, bad cksum 9cfb!)
   423	15:57:41.482218 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 147256:147980(724) ack 546 win 31856 <nop,nop,timestamp 181751003 2258022> (DF) (ttl 53, id 750, len 776, bad cksum 9cfa!)
   424	15:57:41.482840 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 147980 win 31856 <nop,nop,timestamp 2258029 181751002> (DF) (ttl 64, id 149, len 52, bad cksum 9727!)
   425	15:57:41.490603 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 147980:148704(724) ack 546 win 31856 <nop,nop,timestamp 181751003 2258022> (DF) (ttl 53, id 751, len 776, bad cksum 9cf9!)
   426	15:57:41.502426 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 148704:149428(724) ack 546 win 31856 <nop,nop,timestamp 181751004 2258024> (DF) (ttl 53, id 752, len 776, bad cksum 9cf8!)
   427	15:57:41.503047 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 149428 win 31856 <nop,nop,timestamp 2258032 181751003> (DF) (ttl 64, id 150, len 52, bad cksum 9726!)
   428	15:57:41.510052 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 149428:150152(724) ack 546 win 31856 <nop,nop,timestamp 181751005 2258024> (DF) (ttl 53, id 753, len 776, bad cksum 9cf7!)
   429	15:57:41.521150 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 150152:150876(724) ack 546 win 31856 <nop,nop,timestamp 181751006 2258026> (DF) (ttl 53, id 754, len 776, bad cksum 9cf6!)
   430	15:57:41.521777 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 150876 win 31856 <nop,nop,timestamp 2258034 181751005> (DF) (ttl 64, id 151, len 52, bad cksum 9725!)
   431	15:57:41.529520 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 150876:151600(724) ack 546 win 31856 <nop,nop,timestamp 181751007 2258026> (DF) (ttl 53, id 755, len 776, bad cksum 9cf5!)
   432	15:57:41.540117 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 151600:152324(724) ack 546 win 31856 <nop,nop,timestamp 181751008 2258029> (DF) (ttl 53, id 756, len 776, bad cksum 9cf4!)
   433	15:57:41.540741 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 152324 win 31856 <nop,nop,timestamp 2258036 181751007> (DF) (ttl 64, id 152, len 52, bad cksum 9724!)
   434	15:57:41.549974 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 152324:153048(724) ack 546 win 31856 <nop,nop,timestamp 181751009 2258029> (DF) (ttl 53, id 757, len 776, bad cksum 9cf3!)
   435	15:57:41.559836 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 153048:153772(724) ack 546 win 31856 <nop,nop,timestamp 181751010 2258029> (DF) (ttl 53, id 758, len 776, bad cksum 9cf2!)
   436	15:57:41.560454 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 153772 win 31856 <nop,nop,timestamp 2258038 181751009> (DF) (ttl 64, id 153, len 52, bad cksum 9723!)
   437	15:57:41.571175 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 153772:154496(724) ack 546 win 31856 <nop,nop,timestamp 181751011 2258032> (DF) (ttl 53, id 759, len 776, bad cksum 9cf1!)
   438	15:57:41.579286 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 154496:155220(724) ack 546 win 31856 <nop,nop,timestamp 181751012 2258032> (DF) (ttl 53, id 760, len 776, bad cksum 9cf0!)
   439	15:57:41.579923 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 155220 win 31856 <nop,nop,timestamp 2258040 181751011> (DF) (ttl 64, id 154, len 52, bad cksum 9722!)
   440	15:57:41.589387 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 155220:155944(724) ack 546 win 31856 <nop,nop,timestamp 181751013 2258034> (DF) (ttl 53, id 761, len 776, bad cksum 9cef!)
   441	15:57:41.600479 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 155944:156668(724) ack 546 win 31856 <nop,nop,timestamp 181751014 2258034> (DF) (ttl 53, id 762, len 776, bad cksum 9cee!)
   442	15:57:41.601107 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 156668 win 31856 <nop,nop,timestamp 2258042 181751013> (DF) (ttl 64, id 155, len 52, bad cksum 9721!)
   443	15:57:41.609843 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 156668:157392(724) ack 546 win 31856 <nop,nop,timestamp 181751015 2258036> (DF) (ttl 53, id 763, len 776, bad cksum 9ced!)
   444	15:57:41.619719 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 157392:158116(724) ack 546 win 31856 <nop,nop,timestamp 181751016 2258036> (DF) (ttl 53, id 764, len 776, bad cksum 9cec!)
   445	15:57:41.620368 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 158116 win 31856 <nop,nop,timestamp 2258044 181751015> (DF) (ttl 64, id 156, len 52, bad cksum 9720!)
   446	15:57:41.628325 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 158116:158840(724) ack 546 win 31856 <nop,nop,timestamp 181751017 2258038> (DF) (ttl 53, id 765, len 776, bad cksum 9ceb!)
   447	15:57:41.640633 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 158840:159564(724) ack 546 win 31856 <nop,nop,timestamp 181751018 2258038> (DF) (ttl 53, id 766, len 776, bad cksum 9cea!)
   448	15:57:41.641257 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 159564 win 31856 <nop,nop,timestamp 2258046 181751017> (DF) (ttl 64, id 157, len 52, bad cksum 971f!)
   449	15:57:41.649266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 159564:160288(724) ack 546 win 31856 <nop,nop,timestamp 181751019 2258040> (DF) (ttl 53, id 767, len 776, bad cksum 9ce9!)
   450	15:57:41.657888 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 160288:161012(724) ack 546 win 31856 <nop,nop,timestamp 181751020 2258040> (DF) (ttl 53, id 768, len 776, bad cksum 9ce8!)
   451	15:57:41.658510 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 161012 win 31856 <nop,nop,timestamp 2258048 181751019> (DF) (ttl 64, id 158, len 52, bad cksum 971e!)
   452	15:57:41.668486 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 161012:161736(724) ack 546 win 31856 <nop,nop,timestamp 181751021 2258042> (DF) (ttl 53, id 769, len 776, bad cksum 9ce7!)
   453	15:57:41.677598 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 161736:162460(724) ack 546 win 31856 <nop,nop,timestamp 181751022 2258042> (DF) (ttl 53, id 770, len 776, bad cksum 9ce6!)
   454	15:57:41.678238 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 162460 win 31856 <nop,nop,timestamp 2258050 181751021> (DF) (ttl 64, id 159, len 52, bad cksum 971d!)
   455	15:57:41.689179 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 162460:163184(724) ack 546 win 31856 <nop,nop,timestamp 181751023 2258044> (DF) (ttl 53, id 771, len 776, bad cksum 9ce5!)
   456	15:57:41.699276 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 163184:163908(724) ack 546 win 31856 <nop,nop,timestamp 181751024 2258044> (DF) (ttl 53, id 772, len 776, bad cksum 9ce4!)
   457	15:57:41.699904 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 163908 win 31856 <nop,nop,timestamp 2258052 181751023> (DF) (ttl 64, id 160, len 52, bad cksum 971c!)
   458	15:57:41.708876 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 163908:164632(724) ack 546 win 31856 <nop,nop,timestamp 181751025 2258044> (DF) (ttl 53, id 773, len 776, bad cksum 9ce3!)
   459	15:57:41.718497 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 164632:165356(724) ack 546 win 31856 <nop,nop,timestamp 181751026 2258046> (DF) (ttl 53, id 774, len 776, bad cksum 9ce2!)
   460	15:57:41.719122 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 165356 win 31856 <nop,nop,timestamp 2258054 181751025> (DF) (ttl 64, id 161, len 52, bad cksum 971b!)
   461	15:57:41.729824 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 165356:166080(724) ack 546 win 31856 <nop,nop,timestamp 181751027 2258048> (DF) (ttl 53, id 775, len 776, bad cksum 9ce1!)
   462	15:57:41.737221 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 166080:166804(724) ack 546 win 31856 <nop,nop,timestamp 181751028 2258048> (DF) (ttl 53, id 776, len 776, bad cksum 9ce0!)
   463	15:57:41.737842 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 166804 win 31856 <nop,nop,timestamp 2258056 181751027> (DF) (ttl 64, id 162, len 52, bad cksum 971a!)
   464	15:57:41.747815 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 166804:167528(724) ack 546 win 31856 <nop,nop,timestamp 181751029 2258050> (DF) (ttl 53, id 777, len 776, bad cksum 9cdf!)
   465	15:57:41.756922 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 167528:168252(724) ack 546 win 31856 <nop,nop,timestamp 181751030 2258050> (DF) (ttl 53, id 778, len 776, bad cksum 9cde!)
   466	15:57:41.757606 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 168252 win 31856 <nop,nop,timestamp 2258058 181751029> (DF) (ttl 64, id 163, len 52, bad cksum 9719!)
   467	15:57:41.767272 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 168252:168976(724) ack 546 win 31856 <nop,nop,timestamp 181751031 2258052> (DF) (ttl 53, id 779, len 776, bad cksum 9cdd!)
   468	15:57:41.778357 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 168976:169700(724) ack 546 win 31856 <nop,nop,timestamp 181751032 2258052> (DF) (ttl 53, id 780, len 776, bad cksum 9cdc!)
   469	15:57:41.778980 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 169700 win 31856 <nop,nop,timestamp 2258060 181751031> (DF) (ttl 64, id 164, len 52, bad cksum 9718!)
   470	15:57:41.786491 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 169700:170424(724) ack 546 win 31856 <nop,nop,timestamp 181751033 2258054> (DF) (ttl 53, id 781, len 776, bad cksum 9cdb!)
   471	15:57:41.797338 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 170424:171148(724) ack 546 win 31856 <nop,nop,timestamp 181751034 2258054> (DF) (ttl 53, id 782, len 776, bad cksum 9cda!)
   472	15:57:41.797957 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 171148 win 31856 <nop,nop,timestamp 2258062 181751033> (DF) (ttl 64, id 165, len 52, bad cksum 9717!)
   473	15:57:41.805708 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 171148:171872(724) ack 546 win 31856 <nop,nop,timestamp 181751035 2258056> (DF) (ttl 53, id 783, len 776, bad cksum 9cd9!)
   474	15:57:41.816055 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 171872:172596(724) ack 546 win 31856 <nop,nop,timestamp 181751036 2258056> (DF) (ttl 53, id 784, len 776, bad cksum 9cd8!)
   475	15:57:41.816708 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 172596 win 31856 <nop,nop,timestamp 2258064 181751035> (DF) (ttl 64, id 166, len 52, bad cksum 9716!)
   476	15:57:41.828622 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 172596:173320(724) ack 546 win 31856 <nop,nop,timestamp 181751037 2258058> (DF) (ttl 53, id 785, len 776, bad cksum 9cd7!)
   477	15:57:41.837496 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 173320:174044(724) ack 546 win 31856 <nop,nop,timestamp 181751038 2258058> (DF) (ttl 53, id 786, len 776, bad cksum 9cd6!)
   478	15:57:41.838120 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 174044 win 31856 <nop,nop,timestamp 2258066 181751037> (DF) (ttl 64, id 167, len 52, bad cksum 9715!)
   479	15:57:41.845652 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 174044:174768(724) ack 546 win 31856 <nop,nop,timestamp 181751039 2258060> (DF) (ttl 53, id 787, len 776, bad cksum 9cd5!)
   480	15:57:41.854480 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 174768:175492(724) ack 546 win 31856 <nop,nop,timestamp 181751040 2258060> (DF) (ttl 53, id 788, len 776, bad cksum 9cd4!)
   481	15:57:41.855365 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 175492 win 31856 <nop,nop,timestamp 2258067 181751039> (DF) (ttl 64, id 168, len 52, bad cksum 9714!)
   482	15:57:41.868801 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 175492:176216(724) ack 546 win 31856 <nop,nop,timestamp 181751041 2258062> (DF) (ttl 53, id 789, len 776, bad cksum 9cd3!)
   483	15:57:41.875194 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 176216:176940(724) ack 546 win 31856 <nop,nop,timestamp 181751042 2258062> (DF) (ttl 53, id 790, len 776, bad cksum 9cd2!)
   484	15:57:41.875821 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 176940 win 31856 <nop,nop,timestamp 2258070 181751041> (DF) (ttl 64, id 169, len 52, bad cksum 9713!)
   485	15:57:41.884548 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 176940:177664(724) ack 546 win 31856 <nop,nop,timestamp 181751043 2258064> (DF) (ttl 53, id 791, len 776, bad cksum 9cd1!)
   486	15:57:41.894980 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 177664 win 31856 <nop,nop,timestamp 2258072 181751043> (DF) (ttl 64, id 170, len 52, bad cksum 9712!)
   487	15:57:41.896130 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 177664:178388(724) ack 546 win 31856 <nop,nop,timestamp 181751044 2258064> (DF) (ttl 53, id 792, len 776, bad cksum 9cd0!)
   488	15:57:41.904515 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 178388:179112(724) ack 546 win 31856 <nop,nop,timestamp 181751045 2258066> (DF) (ttl 53, id 793, len 776, bad cksum 9ccf!)
   489	15:57:41.905353 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 179112 win 31856 <nop,nop,timestamp 2258072 181751044> (DF) (ttl 64, id 171, len 52, bad cksum 9711!)
   490	15:57:41.913368 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 179112:179836(724) ack 546 win 31856 <nop,nop,timestamp 181751046 2258066> (DF) (ttl 53, id 794, len 776, bad cksum 9cce!)
   491	15:57:41.914982 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 179836 win 31856 <nop,nop,timestamp 2258075 181751046> (DF) (ttl 64, id 172, len 52, bad cksum 9710!)
   492	15:57:41.924743 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 179836:180560(724) ack 546 win 31856 <nop,nop,timestamp 181751047 2258067> (DF) (ttl 53, id 795, len 776, bad cksum 9ccd!)
   493	15:57:41.933336 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 180560:181284(724) ack 546 win 31856 <nop,nop,timestamp 181751048 2258067> (DF) (ttl 53, id 796, len 776, bad cksum 9ccc!)
   494	15:57:41.933938 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 181284 win 31856 <nop,nop,timestamp 2258075 181751047> (DF) (ttl 64, id 173, len 52, bad cksum 970f!)
   495	15:57:41.942718 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 181284:182008(724) ack 546 win 31856 <nop,nop,timestamp 181751049 2258070> (DF) (ttl 53, id 797, len 776, bad cksum 9ccb!)
   496	15:57:41.944915 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 182008 win 31856 <nop,nop,timestamp 2258078 181751049> (DF) (ttl 64, id 174, len 52, bad cksum 970e!)
   497	15:57:41.952539 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 182008:182732(724) ack 546 win 31856 <nop,nop,timestamp 181751050 2258070> (DF) (ttl 53, id 798, len 776, bad cksum 9cca!)
   498	15:57:41.966599 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 182732:183456(724) ack 546 win 31856 <nop,nop,timestamp 181751051 2258070> (DF) (ttl 53, id 799, len 776, bad cksum 9cc9!)
   499	15:57:41.967555 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 183456 win 31856 <nop,nop,timestamp 2258079 181751050> (DF) (ttl 64, id 175, len 52, bad cksum 970d!)
   500	15:57:41.976709 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 183456:184180(724) ack 546 win 31856 <nop,nop,timestamp 181751052 2258072> (DF) (ttl 53, id 800, len 776, bad cksum 9cc8!)
   501	15:57:41.982858 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 184180:184904(724) ack 546 win 31856 <nop,nop,timestamp 181751053 2258075> (DF) (ttl 53, id 801, len 776, bad cksum 9cc7!)
   502	15:57:41.983469 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 184904 win 31856 <nop,nop,timestamp 2258080 181751052> (DF) (ttl 64, id 176, len 52, bad cksum 970c!)
   503	15:57:41.994458 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 184904:185628(724) ack 546 win 31856 <nop,nop,timestamp 181751054 2258075> (DF) (ttl 53, id 802, len 776, bad cksum 9cc6!)
   504	15:57:42.002068 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 185628:186352(724) ack 546 win 31856 <nop,nop,timestamp 181751055 2258075> (DF) (ttl 53, id 803, len 776, bad cksum 9cc5!)
   505	15:57:42.002640 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 186352 win 31856 <nop,nop,timestamp 2258082 181751054> (DF) (ttl 64, id 177, len 52, bad cksum 970b!)
   506	15:57:42.011929 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 186352:187076(724) ack 546 win 31856 <nop,nop,timestamp 181751056 2258078> (DF) (ttl 53, id 804, len 776, bad cksum 9cc4!)
   507	15:57:42.020558 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 187076:187800(724) ack 546 win 31856 <nop,nop,timestamp 181751056 2258078> (DF) (ttl 53, id 805, len 776, bad cksum 9cc3!)
   508	15:57:42.021145 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 187800 win 31856 <nop,nop,timestamp 2258085 181751056> (DF) (ttl 64, id 178, len 52, bad cksum 970a!)
   509	15:57:42.030882 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 187800:188524(724) ack 546 win 31856 <nop,nop,timestamp 181751057 2258078> (DF) (ttl 53, id 806, len 776, bad cksum 9cc2!)
   510	15:57:42.040747 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 188524:189248(724) ack 546 win 31856 <nop,nop,timestamp 181751058 2258079> (DF) (ttl 53, id 807, len 776, bad cksum 9cc1!)
   511	15:57:42.041396 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 189248 win 31856 <nop,nop,timestamp 2258087 181751057> (DF) (ttl 64, id 179, len 52, bad cksum 9709!)
   512	15:57:42.050112 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 189248:189972(724) ack 546 win 31856 <nop,nop,timestamp 181751059 2258080> (DF) (ttl 53, id 808, len 776, bad cksum 9cc0!)
   513	15:57:42.059971 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 189972:190696(724) ack 546 win 31856 <nop,nop,timestamp 181751060 2258080> (DF) (ttl 53, id 809, len 776, bad cksum 9cbf!)
   514	15:57:42.060538 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 190696 win 31856 <nop,nop,timestamp 2258089 181751059> (DF) (ttl 64, id 180, len 52, bad cksum 9708!)
   515	15:57:42.070065 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 190696:191420(724) ack 546 win 31856 <nop,nop,timestamp 181751061 2258082> (DF) (ttl 53, id 810, len 776, bad cksum 9cbe!)
   516	15:57:42.079700 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 191420:192144(724) ack 546 win 31856 <nop,nop,timestamp 181751062 2258082> (DF) (ttl 53, id 811, len 776, bad cksum 9cbd!)
   517	15:57:42.080322 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 192144 win 31856 <nop,nop,timestamp 2258091 181751061> (DF) (ttl 64, id 181, len 52, bad cksum 9707!)
   518	15:57:42.090266 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 192144:192868(724) ack 546 win 31856 <nop,nop,timestamp 181751063 2258085> (DF) (ttl 53, id 812, len 776, bad cksum 9cbc!)
   519	15:57:42.100385 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 192868:193592(724) ack 546 win 31856 <nop,nop,timestamp 181751064 2258085> (DF) (ttl 53, id 813, len 776, bad cksum 9cbb!)
   520	15:57:42.101011 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 193592 win 31856 <nop,nop,timestamp 2258093 181751063> (DF) (ttl 64, id 182, len 52, bad cksum 9706!)
   521	15:57:42.109730 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 193592:194316(724) ack 546 win 31856 <nop,nop,timestamp 181751065 2258087> (DF) (ttl 53, id 814, len 776, bad cksum 9cba!)
   522	15:57:42.119340 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 194316:195040(724) ack 546 win 31856 <nop,nop,timestamp 181751066 2258087> (DF) (ttl 53, id 815, len 776, bad cksum 9cb9!)
   523	15:57:42.119966 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 195040 win 31856 <nop,nop,timestamp 2258095 181751065> (DF) (ttl 64, id 183, len 52, bad cksum 9705!)
   524	15:57:42.128454 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 195040:195764(724) ack 546 win 31856 <nop,nop,timestamp 181751067 2258089> (DF) (ttl 53, id 816, len 776, bad cksum 9cb8!)
   525	15:57:42.136855 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 195764:196488(724) ack 546 win 31856 <nop,nop,timestamp 181751068 2258089> (DF) (ttl 53, id 817, len 776, bad cksum 9cb7!)
   526	15:57:42.137484 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 196488 win 31856 <nop,nop,timestamp 2258097 181751067> (DF) (ttl 64, id 184, len 52, bad cksum 9704!)
   527	15:57:42.147691 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 196488:197212(724) ack 546 win 31856 <nop,nop,timestamp 181751069 2258091> (DF) (ttl 53, id 818, len 776, bad cksum 9cb6!)
   528	15:57:42.156795 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 197212:197936(724) ack 546 win 31856 <nop,nop,timestamp 181751070 2258091> (DF) (ttl 53, id 819, len 776, bad cksum 9cb5!)
   529	15:57:42.157470 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 197936 win 31856 <nop,nop,timestamp 2258099 181751069> (DF) (ttl 64, id 185, len 52, bad cksum 9703!)
   530	15:57:42.166161 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 197936:198660(724) ack 546 win 31856 <nop,nop,timestamp 181751071 2258093> (DF) (ttl 53, id 820, len 776, bad cksum 9cb4!)
   531	15:57:42.176254 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 198660:199384(724) ack 546 win 31856 <nop,nop,timestamp 181751072 2258093> (DF) (ttl 53, id 821, len 776, bad cksum 9cb3!)
   532	15:57:42.176885 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 199384 win 31856 <nop,nop,timestamp 2258101 181751071> (DF) (ttl 64, id 186, len 52, bad cksum 9702!)
   533	15:57:42.190787 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 199384:200108(724) ack 546 win 31856 <nop,nop,timestamp 181751073 2258093> (DF) (ttl 53, id 822, len 776, bad cksum 9cb2!)
   534	15:57:42.197446 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 200108:200832(724) ack 546 win 31856 <nop,nop,timestamp 181751074 2258095> (DF) (ttl 53, id 823, len 776, bad cksum 9cb1!)
   535	15:57:42.198092 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 200832 win 31856 <nop,nop,timestamp 2258103 181751073> (DF) (ttl 64, id 187, len 52, bad cksum 9701!)
   536	15:57:42.204846 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 200832:201556(724) ack 546 win 31856 <nop,nop,timestamp 181751075 2258097> (DF) (ttl 53, id 824, len 776, bad cksum 9cb0!)
   537	15:57:42.214985 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 201556 win 31856 <nop,nop,timestamp 2258105 181751075> (DF) (ttl 64, id 188, len 52, bad cksum 9700!)
   538	15:57:42.218128 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 201556:202280(724) ack 546 win 31856 <nop,nop,timestamp 181751076 2258097> (DF) (ttl 53, id 825, len 776, bad cksum 9caf!)
   539	15:57:42.224809 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 202280:203004(724) ack 546 win 31856 <nop,nop,timestamp 181751077 2258097> (DF) (ttl 53, id 826, len 776, bad cksum 9cae!)
   540	15:57:42.225570 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 203004 win 31856 <nop,nop,timestamp 2258105 181751076> (DF) (ttl 64, id 189, len 52, bad cksum 96ff!)
   541	15:57:42.234156 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 203004:203728(724) ack 546 win 31856 <nop,nop,timestamp 181751078 2258099> (DF) (ttl 53, id 827, len 776, bad cksum 9cad!)
   542	15:57:42.244377 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 203728:204452(724) ack 546 win 31856 <nop,nop,timestamp 181751079 2258101> (DF) (ttl 53, id 828, len 776, bad cksum 9cac!)
   543	15:57:42.245228 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 204452 win 31856 <nop,nop,timestamp 2258107 181751078> (DF) (ttl 64, id 190, len 52, bad cksum 96fe!)
   544	15:57:42.257303 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 204452:205176(724) ack 546 win 31856 <nop,nop,timestamp 181751080 2258101> (DF) (ttl 53, id 829, len 776, bad cksum 9cab!)
   545	15:57:42.265688 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 205176:205900(724) ack 546 win 31856 <nop,nop,timestamp 181751081 2258103> (DF) (ttl 53, id 830, len 776, bad cksum 9caa!)
   546	15:57:42.266285 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 205900 win 31856 <nop,nop,timestamp 2258109 181751080> (DF) (ttl 64, id 191, len 52, bad cksum 96fd!)
   547	15:57:42.274057 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 205900:206624(724) ack 546 win 31856 <nop,nop,timestamp 181751082 2258103> (DF) (ttl 53, id 831, len 776, bad cksum 9ca9!)
   548	15:57:42.284873 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 206624 win 31856 <nop,nop,timestamp 2258111 181751082> (DF) (ttl 64, id 192, len 52, bad cksum 96fc!)
   549	15:57:42.287613 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 206624:207348(724) ack 546 win 31856 <nop,nop,timestamp 181751083 2258105> (DF) (ttl 53, id 832, len 776, bad cksum 9ca8!)
   550	15:57:42.293783 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 207348:208072(724) ack 546 win 31856 <nop,nop,timestamp 181751084 2258105> (DF) (ttl 53, id 833, len 776, bad cksum 9ca7!)
   551	15:57:42.294375 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 208072 win 31856 <nop,nop,timestamp 2258111 181751083> (DF) (ttl 64, id 193, len 52, bad cksum 96fb!)
   552	15:57:42.306588 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 208072:208796(724) ack 546 win 31856 <nop,nop,timestamp 181751085 2258105> (DF) (ttl 53, id 834, len 776, bad cksum 9ca6!)
   553	15:57:42.312509 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 208796:209520(724) ack 546 win 31856 <nop,nop,timestamp 181751086 2258107> (DF) (ttl 53, id 835, len 776, bad cksum 9ca5!)
   554	15:57:42.313087 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 209520 win 31856 <nop,nop,timestamp 2258113 181751085> (DF) (ttl 64, id 194, len 52, bad cksum 96fa!)
   555	15:57:42.321859 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 209520:210244(724) ack 546 win 31856 <nop,nop,timestamp 181751087 2258107> (DF) (ttl 53, id 836, len 776, bad cksum 9ca4!)
   556	15:57:42.334667 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 210244:210968(724) ack 546 win 31856 <nop,nop,timestamp 181751088 2258109> (DF) (ttl 53, id 837, len 776, bad cksum 9ca3!)
   557	15:57:42.335455 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 210968 win 31856 <nop,nop,timestamp 2258116 181751087> (DF) (ttl 64, id 195, len 52, bad cksum 96f9!)
   558	15:57:42.341337 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 210968:211692(724) ack 546 win 31856 <nop,nop,timestamp 181751089 2258109> (DF) (ttl 53, id 838, len 776, bad cksum 9ca2!)
   559	15:57:42.344888 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 211692 win 31856 <nop,nop,timestamp 2258118 181751089> (DF) (ttl 64, id 196, len 52, bad cksum 96f8!)
   560	15:57:42.351419 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 211692:212416(724) ack 546 win 31856 <nop,nop,timestamp 181751090 2258111> (DF) (ttl 53, id 839, len 776, bad cksum 9ca1!)
   561	15:57:42.360542 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 212416:213140(724) ack 546 win 31856 <nop,nop,timestamp 181751091 2258111> (DF) (ttl 53, id 840, len 776, bad cksum 9ca0!)
   562	15:57:42.361216 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 213140 win 31856 <nop,nop,timestamp 2258119 181751090> (DF) (ttl 64, id 197, len 52, bad cksum 96f7!)
   563	15:57:42.370645 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 213140:213864(724) ack 546 win 31856 <nop,nop,timestamp 181751092 2258111> (DF) (ttl 53, id 841, len 776, bad cksum 9c9f!)
   564	15:57:42.382218 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 213864:214588(724) ack 546 win 31856 <nop,nop,timestamp 181751093 2258113> (DF) (ttl 53, id 842, len 776, bad cksum 9c9e!)
   565	15:57:42.382856 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 214588 win 31856 <nop,nop,timestamp 2258121 181751092> (DF) (ttl 64, id 198, len 52, bad cksum 96f6!)
   566	15:57:42.390597 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 214588:215312(724) ack 546 win 31856 <nop,nop,timestamp 181751093 2258113> (DF) (ttl 53, id 843, len 776, bad cksum 9c9d!)
   567	15:57:42.404859 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 215312 win 31856 <nop,nop,timestamp 2258124 181751093> (DF) (ttl 64, id 199, len 52, bad cksum 96f5!)
   568	15:57:42.464652 11.11.11.11.8882 > 172.16.183.2.1025: P [bad tcp cksum df29!] 215312:215579(267) ack 546 win 31856 <nop,nop,timestamp 181751101 2258124> (DF) (ttl 53, id 844, len 319, bad cksum 9e65!)
   569	15:57:42.484853 172.16.183.2.1025 > 11.11.11.11.8882: . [bad tcp cksum df29!] ack 215579 win 31856 <nop,nop,timestamp 2258131 181751101> (DF) (ttl 64, id 200, len 52, bad cksum 96f4!)
   570	15:57:52.376036 11.11.11.11.8882 > 172.16.183.2.1025: R [bad tcp cksum df29!] 215579:215579(0) ack 546 win 31856 <nop,nop,timestamp 181752094 2258131> (DF) (ttl 53, id 852, len 52, bad cksum 9f68!)
   571	15:57:55.439307 172.16.183.2.1025 > 11.11.11.11.53413:  [bad udp cksum df29!] udp 3 (ttl 64, id 201, len 31, bad cksum d6fd!)
   572	15:57:55.493471 11.11.11.11.53413 > 172.16.183.2.1025:  [bad udp cksum df29!] udp 10 (ttl 53, id 867, len 38, bad cksum df5c!)
   573	15:58:05.406445 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50723+ A? web.icq.com. [|domain] (ttl 64, id 202, len 57)
   574	15:58:05.429792 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50723* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 24510, len 233)
   575	15:58:05.433078 172.16.183.2.1026 > clustera.icq.com.http: S [tcp sum ok] 254898872:254898872(0) win 32120 <mss 1460,sackOK,timestamp 2260448 0,nop,wscale 0> (DF) (ttl 64, id 203, len 60)
   576	15:58:05.451837 clustera.icq.com.http > 172.16.183.2.1026: S [tcp sum ok] 1276441227:1276441227(0) ack 254898873 win 65535 <nop,nop,timestamp 200303873 2260448,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 61963, len 64)
   577	15:58:05.452439 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2260450 200303873> (DF) (ttl 64, id 204, len 52)
   578	15:58:06.455233 172.16.183.2.1026 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2260550 200303873> (DF) (ttl 64, id 205, len 104)
   579	15:58:06.482173 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200303976 2260550> (DF) (ttl 240, id 61964, len 52)
   580	15:58:07.099276 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200304036 2260550> (DF) (ttl 240, id 61965, len 1500)
   581	15:58:07.100091 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2260646 200304036> (DF) (ttl 64, id 206, len 52)
   582	15:58:07.107889 clustera.icq.com.http > 172.16.183.2.1026: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200304036 2260550> (DF) (ttl 240, id 61966, len 1500)
   583	15:58:07.115019 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2260650 200304036> (DF) (ttl 64, id 207, len 52)
   584	15:58:07.125854 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200304039 2260646> (DF) (ttl 240, id 61967, len 1477)
   585	15:58:07.134747 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200304039 2260646> (DF) (ttl 240, id 61968, len 1500)
   586	15:58:07.143619 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200304041 2260650> (DF) (ttl 240, id 61969, len 1500)
   587	15:58:07.144454 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 30408 <nop,nop,timestamp 2260654 200304039> (DF) (ttl 64, id 208, len 52)
   588	15:58:07.150812 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200304041 2260650> (DF) (ttl 240, id 61970, len 1252)
   589	15:58:07.155013 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2260656 200304041> (DF) (ttl 64, id 209, len 52)
   590	15:58:07.170467 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61971, len 1500)
   591	15:58:07.179090 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61972, len 1500)
   592	15:58:07.179838 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2260659 200304044> (DF) (ttl 64, id 210, len 52)
   593	15:58:07.186524 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61973, len 1252)
   594	15:58:07.195351 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200304044 2260654> (DF) (ttl 240, id 61974, len 1500)
   595	15:58:07.204089 172.16.183.2.1026 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2260664 200304044> (DF) (ttl 64, id 211, len 52)
   596	15:58:07.204187 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200304045 2260656> (DF) (ttl 240, id 61975, len 1500)
   597	15:58:07.211413 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200304045 2260656> (DF) (ttl 240, id 61976, len 1252)
   598	15:58:07.216747 172.16.183.2.1026 > clustera.icq.com.http: P [bad tcp cksum e55e!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   599	15:58:07.216747 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2260665 200304045> (DF) (ttl 64, id 212, len 52)
   600	15:58:07.220710 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61977, len 1500)
   601	15:58:07.225125 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 213, len 40)
   602	15:58:07.229337 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61978, len 1500)
   603	15:58:07.233123 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 214, len 40)
   604	15:58:07.236772 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200304047 2260659> (DF) (ttl 240, id 61979, len 1252)
   605	15:58:07.237571 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 215, len 40)
   606	15:58:07.245596 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61980, len 1500)
   607	15:58:07.246418 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 216, len 40)
   608	15:58:07.254467 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61981, len 1500)
   609	15:58:07.255552 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 217, len 40)
   610	15:58:07.261656 clustera.icq.com.http > 172.16.183.2.1026: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200304050 2260664> (DF) (ttl 240, id 61982, len 1252)
   611	15:58:07.262399 172.16.183.2.1026 > clustera.icq.com.http: R [tcp sum ok] 254898925:254898925(0) win 0 (ttl 255, id 218, len 40)
   612	15:58:09.196239 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50724+ A? web.icq.com. [|domain] (ttl 64, id 219, len 57)
   613	15:58:09.226430 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50724 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 24794, len 244)
   614	15:58:09.234260 172.16.183.2.1027 > clusterc.icq.com.http: S [tcp sum ok] 266039804:266039804(0) win 32120 <mss 1460,sackOK,timestamp 2260871 0,nop,wscale 0> (DF) (ttl 64, id 220, len 60)
   615	15:58:09.252140 clusterc.icq.com.http > 172.16.183.2.1027: S [tcp sum ok] 3152951843:3152951843(0) ack 266039805 win 65535 <nop,nop,timestamp 19651147 2260871,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34543, len 64)
   616	15:58:09.255151 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2260873 19651147> (DF) (ttl 64, id 221, len 52)
   617	15:58:10.256300 172.16.183.2.1027 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2260974 19651147> (DF) (ttl 64, id 222, len 104)
   618	15:58:10.283206 clusterc.icq.com.http > 172.16.183.2.1027: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 19651250 2260974> (DF) (ttl 240, id 34544, len 52)
   619	15:58:10.557953 clusterc.icq.com.http > 172.16.183.2.1027: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 19651277 2260974> (DF) (ttl 240, id 34545, len 391)
   620	15:58:10.558386 clusterc.icq.com.http > 172.16.183.2.1027: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 19651277 2260974> (DF) (ttl 240, id 34546, len 52)
   621	15:58:10.559376 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2261020 19651277> (DF) (ttl 64, id 223, len 52)
   622	15:58:10.559864 172.16.183.2.1027 > clusterc.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2261020 19651277> (DF) (ttl 64, id 224, len 52)
   623	15:58:27.474391 172.16.183.2.1027 > clusterc.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2263522 19651277> (DF) (ttl 64, id 225, len 52)
   624	15:58:27.491393 172.16.183.2.1027 > clusterc.icq.com.http: P [bad tcp cksum 27e1!] 2886912380:2886912431(51) ack 1408055311 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   625	15:58:27.491393 clusterc.icq.com.http > 172.16.183.2.1027: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 19652971 2263522> (DF) (ttl 240, id 34547, len 52)
   626	15:58:28.475978 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50725+ A? web.icq.com. [|domain] (ttl 64, id 226, len 57)
   627	15:58:28.489116 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50725 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27239, len 233)
   628	15:58:28.490024 172.16.183.2.1028 > clustera.icq.com.http: S [tcp sum ok] 300477277:300477277(0) win 32120 <mss 1460,sackOK,timestamp 2263624 0,nop,wscale 0> (DF) (ttl 64, id 227, len 60)
   629	15:58:28.506960 clustera.icq.com.http > 172.16.183.2.1028: S [tcp sum ok] 1964720785:1964720785(0) ack 300477278 win 65535 <nop,nop,timestamp 500573950 2263624,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34285, len 64)
   630	15:58:28.507417 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2263626 500573950> (DF) (ttl 64, id 228, len 52)
   631	15:58:29.506557 172.16.183.2.1028 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2263726 500573950> (DF) (ttl 64, id 229, len 104)
   632	15:58:29.524244 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500574052 2263726> (DF) (ttl 240, id 34286, len 52)
   633	15:58:30.029019 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500574101 2263726> (DF) (ttl 240, id 34287, len 1500)
   634	15:58:30.029825 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2263777 500574101> (DF) (ttl 64, id 230, len 52)
   635	15:58:30.042307 clustera.icq.com.http > 172.16.183.2.1028: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500574101 2263726> (DF) (ttl 240, id 34288, len 1500)
   636	15:58:30.043938 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2263779 500574101> (DF) (ttl 64, id 231, len 52)
   637	15:58:30.062975 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500574104 2263777> (DF) (ttl 240, id 34289, len 1477)
   638	15:58:30.076298 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500574104 2263777> (DF) (ttl 240, id 34290, len 1500)
   639	15:58:30.089604 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500574106 2263779> (DF) (ttl 240, id 34291, len 1500)
   640	15:58:30.090397 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2263783 500574104> (DF) (ttl 64, id 232, len 52)
   641	15:58:30.100741 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500574106 2263779> (DF) (ttl 240, id 34292, len 1252)
   642	15:58:30.120902 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34293, len 1500)
   643	15:58:30.133224 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34294, len 1500)
   644	15:58:30.133991 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2263787 500574106> (DF) (ttl 64, id 233, len 52)
   645	15:58:30.142861 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34295, len 1252)
   646	15:58:30.154923 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500574110 2263783> (DF) (ttl 240, id 34296, len 1500)
   647	15:58:30.155698 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2263790 500574110> (DF) (ttl 64, id 234, len 52)
   648	15:58:30.167211 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34297, len 1500)
   649	15:58:30.167947 172.16.183.2.1028 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2263791 500574110> (DF) (ttl 64, id 235, len 52)
   650	15:58:30.170250 172.16.183.2.1028 > clustera.icq.com.http: P [bad tcp cksum 286f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   651	15:58:30.170250 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2263791 500574110> (DF) (ttl 64, id 236, len 52)
   652	15:58:30.177103 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34298, len 1252)
   653	15:58:30.177876 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 237, len 40)
   654	15:58:30.189133 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34299, len 1500)
   655	15:58:30.189882 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 238, len 40)
   656	15:58:30.201694 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500574115 2263787> (DF) (ttl 240, id 34300, len 1500)
   657	15:58:30.202467 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 239, len 40)
   658	15:58:30.210857 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500574117 2263790> (DF) (ttl 240, id 34301, len 1252)
   659	15:58:30.211591 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 240, len 40)
   660	15:58:30.222141 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500574117 2263790> (DF) (ttl 240, id 34302, len 1500)
   661	15:58:30.222857 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 241, len 40)
   662	15:58:30.232983 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34303, len 1500)
   663	15:58:30.233717 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 242, len 40)
   664	15:58:30.241648 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34304, len 1252)
   665	15:58:30.242322 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 243, len 40)
   666	15:58:30.252943 clustera.icq.com.http > 172.16.183.2.1028: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500574118 2263791> (DF) (ttl 240, id 34305, len 1500)
   667	15:58:30.253729 172.16.183.2.1028 > clustera.icq.com.http: R [tcp sum ok] 300477330:300477330(0) win 0 (ttl 255, id 244, len 40)
   668	15:58:32.166574 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50726+ A? web.icq.com. [|domain] (ttl 64, id 245, len 57)
   669	15:58:32.180777 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50726 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27639, len 233)
   670	15:58:32.181793 172.16.183.2.1029 > clustera.icq.com.http: S [tcp sum ok] 304003451:304003451(0) win 32120 <mss 1460,sackOK,timestamp 2263993 0,nop,wscale 0> (DF) (ttl 64, id 246, len 60)
   671	15:58:32.199123 clustera.icq.com.http > 172.16.183.2.1029: S [tcp sum ok] 1246240099:1246240099(0) ack 304003452 win 33304 <nop,nop,timestamp 16966795 2263993,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 60783, len 64)
   672	15:58:32.199646 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2263994 16966795> (DF) (ttl 64, id 247, len 52)
   673	15:58:33.196108 172.16.183.2.1029 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2264094 16966795> (DF) (ttl 64, id 248, len 104)
   674	15:58:33.215659 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 16966896 2264094> (DF) (ttl 49, id 60784, len 52)
   675	15:58:34.396227 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60785, len 1500)
   676	15:58:34.397050 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2264215 16967012> (DF) (ttl 64, id 249, len 52)
   677	15:58:34.417412 clustera.icq.com.http > 172.16.183.2.1029: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60786, len 1500)
   678	15:58:34.433827 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2264219 16967012> (DF) (ttl 64, id 250, len 52)
   679	15:58:34.437099 clustera.icq.com.http > 172.16.183.2.1029: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 16967012 2264094> (DF) (ttl 49, id 60787, len 1477)
   680	15:58:34.457342 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 16967016 2264215> (DF) (ttl 49, id 60788, len 1500)
   681	15:58:34.463832 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2264222 16967012> (DF) (ttl 64, id 251, len 52)
   682	15:58:34.476535 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 16967016 2264215> (DF) (ttl 49, id 60789, len 1500)
   683	15:58:34.491115 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 16967020 2264219> (DF) (ttl 49, id 60790, len 1252)
   684	15:58:34.503839 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2264226 16967016> (DF) (ttl 64, id 252, len 52)
   685	15:58:34.508320 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 16967020 2264219> (DF) (ttl 49, id 60791, len 1500)
   686	15:58:34.526307 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60792, len 1500)
   687	15:58:34.527038 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2264228 16967020> (DF) (ttl 64, id 253, len 52)
   688	15:58:34.540650 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60793, len 1252)
   689	15:58:34.553822 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2264231 16967023> (DF) (ttl 64, id 254, len 52)
   690	15:58:34.558094 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 16967023 2264222> (DF) (ttl 49, id 60794, len 1500)
   691	15:58:34.574106 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60795, len 1500)
   692	15:58:34.575016 172.16.183.2.1029 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2264233 16967023> (DF) (ttl 64, id 255, len 52)
   693	15:58:34.577681 172.16.183.2.1029 > clustera.icq.com.http: P [bad tcp cksum d3f0!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   694	15:58:34.577681 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2264233 16967023> (DF) (ttl 64, id 256, len 52)
   695	15:58:34.586945 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60796, len 1252)
   696	15:58:34.587698 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 257, len 40)
   697	15:58:34.601924 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 16967027 2264226> (DF) (ttl 49, id 60797, len 1500)
   698	15:58:34.602652 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 258, len 40)
   699	15:58:34.617454 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60798, len 1500)
   700	15:58:34.618174 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 259, len 40)
   701	15:58:34.629814 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60799, len 1252)
   702	15:58:34.630541 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 260, len 40)
   703	15:58:34.645290 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 16967029 2264228> (DF) (ttl 49, id 60800, len 1500)
   704	15:58:34.646042 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 261, len 40)
   705	15:58:34.660327 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 16967032 2264231> (DF) (ttl 49, id 60801, len 1500)
   706	15:58:34.661095 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 262, len 40)
   707	15:58:34.671709 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 16967032 2264231> (DF) (ttl 49, id 60802, len 1252)
   708	15:58:34.672444 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 263, len 40)
   709	15:58:34.684967 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60803, len 1500)
   710	15:58:34.685776 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 264, len 40)
   711	15:58:34.698258 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60804, len 1500)
   712	15:58:34.698999 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 265, len 40)
   713	15:58:34.709641 clustera.icq.com.http > 172.16.183.2.1029: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 16967034 2264233> (DF) (ttl 49, id 60805, len 1252)
   714	15:58:34.710344 172.16.183.2.1029 > clustera.icq.com.http: R [tcp sum ok] 304003504:304003504(0) win 0 (ttl 255, id 266, len 40)
   715	15:58:36.586486 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50727+ A? web.icq.com. [|domain] (ttl 64, id 267, len 57)
   716	15:58:36.600726 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50727 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 27968, len 233)
   717	15:58:36.601717 172.16.183.2.1030 > clustera.icq.com.http: S [tcp sum ok] 304796124:304796124(0) win 32120 <mss 1460,sackOK,timestamp 2264435 0,nop,wscale 0> (DF) (ttl 64, id 268, len 60)
   718	15:58:36.618571 clustera.icq.com.http > 172.16.183.2.1030: S [tcp sum ok] 3786313445:3786313445(0) ack 304796125 win 65535 <nop,nop,timestamp 501158035 2264435,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 42431, len 64)
   719	15:58:36.619128 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2264436 501158035> (DF) (ttl 64, id 269, len 52)
   720	15:58:37.646070 172.16.183.2.1030 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2264536 501158035> (DF) (ttl 64, id 270, len 104)
   721	15:58:37.665654 clustera.icq.com.http > 172.16.183.2.1030: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501158139 2264536> (DF) (ttl 240, id 42432, len 52)
   722	15:58:37.930302 clustera.icq.com.http > 172.16.183.2.1030: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501158165 2264536> (DF) (ttl 240, id 42433, len 391)
   723	15:58:37.931004 clustera.icq.com.http > 172.16.183.2.1030: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501158166 2264536> (DF) (ttl 240, id 42434, len 52)
   724	15:58:37.931475 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2264568 501158165> (DF) (ttl 64, id 271, len 52)
   725	15:58:37.931947 172.16.183.2.1030 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2264568 501158166> (DF) (ttl 64, id 272, len 52)
   726	15:59:03.453603 172.16.183.2.1030 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2267122 501158166> (DF) (ttl 64, id 273, len 52)
   727	15:59:03.471298 172.16.183.2.1030 > clustera.icq.com.http: P [bad tcp cksum b004!] 3481517662:3481517713(51) ack 813450029 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   728	15:59:03.471298 clustera.icq.com.http > 172.16.183.2.1030: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501160720 2267122> (DF) (ttl 240, id 42435, len 52)
   729	15:59:04.456666 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50728+ A? web.icq.com. [|domain] (ttl 64, id 274, len 57)
   730	15:59:04.471487 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50728 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 30793, len 233)
   731	15:59:04.472796 172.16.183.2.1031 > clusterb.icq.com.http: S [tcp sum ok] 335649146:335649146(0) win 32120 <mss 1460,sackOK,timestamp 2267223 0,nop,wscale 0> (DF) (ttl 64, id 275, len 60)
   732	15:59:04.489845 clusterb.icq.com.http > 172.16.183.2.1031: S [tcp sum ok] 3782308872:3782308872(0) ack 335649147 win 65535 <nop,nop,timestamp 501154927 2267223,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 11351, len 64)
   733	15:59:04.490443 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2267225 501154927> (DF) (ttl 64, id 276, len 52)
   734	15:59:05.486638 172.16.183.2.1031 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2267325 501154927> (DF) (ttl 64, id 277, len 104)
   735	15:59:05.504661 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501155029 2267325> (DF) (ttl 240, id 11352, len 52)
   736	15:59:06.439817 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501155121 2267325> (DF) (ttl 240, id 11353, len 1500)
   737	15:59:06.440556 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2267420 501155121> (DF) (ttl 64, id 278, len 52)
   738	15:59:06.452618 clusterb.icq.com.http > 172.16.183.2.1031: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501155121 2267325> (DF) (ttl 240, id 11354, len 1500)
   739	15:59:06.473061 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501155124 2267420> (DF) (ttl 240, id 11355, len 1477)
   740	15:59:06.483545 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2267424 501155121> (DF) (ttl 64, id 279, len 52)
   741	15:59:06.485141 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501155124 2267420> (DF) (ttl 240, id 11356, len 1500)
   742	15:59:06.494938 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2267426 501155124> (DF) (ttl 64, id 280, len 52)
   743	15:59:06.514240 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11357, len 1500)
   744	15:59:06.523864 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11358, len 1252)
   745	15:59:06.535155 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501155128 2267424> (DF) (ttl 240, id 11359, len 1500)
   746	15:59:06.535921 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2267430 501155128> (DF) (ttl 64, id 281, len 52)
   747	15:59:06.546000 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501155130 2267426> (DF) (ttl 240, id 11360, len 1500)
   748	15:59:06.554900 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501155130 2267426> (DF) (ttl 240, id 11361, len 1252)
   749	15:59:06.563539 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2267433 501155130> (DF) (ttl 64, id 282, len 52)
   750	15:59:06.566436 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11362, len 1500)
   751	15:59:06.577280 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11363, len 1500)
   752	15:59:06.578015 172.16.183.2.1031 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2267434 501155134> (DF) (ttl 64, id 283, len 52)
   753	15:59:06.580181 172.16.183.2.1031 > clusterb.icq.com.http: P [bad tcp cksum ff20!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   754	15:59:06.580181 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2267434 501155134> (DF) (ttl 64, id 284, len 52)
   755	15:59:06.585949 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11364, len 1252)
   756	15:59:06.586728 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 285, len 40)
   757	15:59:06.596984 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501155134 2267430> (DF) (ttl 240, id 11365, len 1500)
   758	15:59:06.597728 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 286, len 40)
   759	15:59:06.607825 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11366, len 1500)
   760	15:59:06.608556 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 287, len 40)
   761	15:59:06.616984 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11367, len 1252)
   762	15:59:06.617733 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 288, len 40)
   763	15:59:06.627278 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501155136 2267433> (DF) (ttl 240, id 11368, len 1500)
   764	15:59:06.628033 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 289, len 40)
   765	15:59:06.636920 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11369, len 1500)
   766	15:59:06.637701 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 290, len 40)
   767	15:59:06.645070 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11370, len 1252)
   768	15:59:06.645757 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 291, len 40)
   769	15:59:06.655617 clusterb.icq.com.http > 172.16.183.2.1031: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501155138 2267434> (DF) (ttl 240, id 11371, len 1500)
   770	15:59:06.656317 172.16.183.2.1031 > clusterb.icq.com.http: R [tcp sum ok] 335649199:335649199(0) win 0 (ttl 255, id 292, len 40)
   771	15:59:08.585356 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50729+ A? web.icq.com. [|domain] (ttl 64, id 293, len 57)
   772	15:59:08.596507 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50729 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 31241, len 233)
   773	15:59:08.597279 172.16.183.2.1032 > clusterb.icq.com.http: S [tcp sum ok] 328275828:328275828(0) win 32120 <mss 1460,sackOK,timestamp 2267635 0,nop,wscale 0> (DF) (ttl 64, id 294, len 60)
   774	15:59:08.613137 clusterb.icq.com.http > 172.16.183.2.1032: S [tcp sum ok] 2553383892:2553383892(0) ack 328275829 win 65535 <nop,nop,timestamp 502584542 2267635,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 20653, len 64)
   775	15:59:08.613685 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2267636 502584542> (DF) (ttl 64, id 295, len 52)
   776	15:59:09.606039 172.16.183.2.1032 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2267736 502584542> (DF) (ttl 64, id 296, len 104)
   777	15:59:09.622776 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502584643 2267736> (DF) (ttl 240, id 20654, len 52)
   778	15:59:10.236943 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502584703 2267736> (DF) (ttl 240, id 20655, len 1500)
   779	15:59:10.237683 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2267800 502584703> (DF) (ttl 64, id 297, len 52)
   780	15:59:10.245546 clusterb.icq.com.http > 172.16.183.2.1032: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502584703 2267736> (DF) (ttl 240, id 20656, len 1500)
   781	15:59:10.253516 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2267802 502584703> (DF) (ttl 64, id 298, len 52)
   782	15:59:10.264742 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502584706 2267800> (DF) (ttl 240, id 20657, len 1477)
   783	15:59:10.273878 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502584706 2267800> (DF) (ttl 240, id 20658, len 1500)
   784	15:59:10.282496 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502584708 2267802> (DF) (ttl 240, id 20659, len 1500)
   785	15:59:10.283290 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2267805 502584706> (DF) (ttl 64, id 299, len 52)
   786	15:59:10.289929 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502584708 2267802> (DF) (ttl 240, id 20660, len 1252)
   787	15:59:10.303501 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2267807 502584708> (DF) (ttl 64, id 300, len 52)
   788	15:59:10.310094 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20661, len 1500)
   789	15:59:10.318956 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20662, len 1500)
   790	15:59:10.319678 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2267808 502584711> (DF) (ttl 64, id 301, len 52)
   791	15:59:10.326156 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502584711 2267805> (DF) (ttl 240, id 20663, len 1252)
   792	15:59:10.335218 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20664, len 1500)
   793	15:59:10.343513 172.16.183.2.1032 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2267811 502584711> (DF) (ttl 64, id 302, len 52)
   794	15:59:10.344090 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20665, len 1500)
   795	15:59:10.348408 172.16.183.2.1032 > clusterb.icq.com.http: P [bad tcp cksum e7d4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   796	15:59:10.348408 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2267811 502584713> (DF) (ttl 64, id 303, len 52)
   797	15:59:10.351264 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502584713 2267807> (DF) (ttl 240, id 20666, len 1252)
   798	15:59:10.351995 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 304, len 40)
   799	15:59:10.360339 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20667, len 1500)
   800	15:59:10.361110 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 305, len 40)
   801	15:59:10.369203 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20668, len 1500)
   802	15:59:10.369928 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 306, len 40)
   803	15:59:10.376408 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502584714 2267808> (DF) (ttl 240, id 20669, len 1252)
   804	15:59:10.377091 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 307, len 40)
   805	15:59:10.385460 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20670, len 1500)
   806	15:59:10.386265 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 308, len 40)
   807	15:59:10.394337 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20671, len 1500)
   808	15:59:10.395364 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 309, len 40)
   809	15:59:10.401526 clusterb.icq.com.http > 172.16.183.2.1032: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502584717 2267811> (DF) (ttl 240, id 20672, len 1252)
   810	15:59:10.402216 172.16.183.2.1032 > clusterb.icq.com.http: R [tcp sum ok] 328275881:328275881(0) win 0 (ttl 255, id 310, len 40)
   811	15:59:12.357499 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50730+ A? web.icq.com. [|domain] (ttl 64, id 311, len 57)
   812	15:59:12.369724 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50730 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 31536, len 233)
   813	15:59:12.370762 172.16.183.2.1033 > clustera.icq.com.http: S [tcp sum ok] 345909800:345909800(0) win 32120 <mss 1460,sackOK,timestamp 2268013 0,nop,wscale 0> (DF) (ttl 64, id 312, len 60)
   814	15:59:12.390033 clustera.icq.com.http > 172.16.183.2.1033: S [tcp sum ok] 497357939:497357939(0) ack 345909801 win 33304 <nop,nop,timestamp 16970814 2268013,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 60806, len 64)
   815	15:59:12.390635 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268015 16970814> (DF) (ttl 64, id 313, len 52)
   816	15:59:13.385433 172.16.183.2.1033 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268115 16970814> (DF) (ttl 64, id 314, len 104)
   817	15:59:13.405341 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 16970916 2268115> (DF) (ttl 49, id 60807, len 52)
   818	15:59:14.222508 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60808, len 1500)
   819	15:59:14.223278 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2268198 16970996> (DF) (ttl 64, id 315, len 52)
   820	15:59:14.242064 clustera.icq.com.http > 172.16.183.2.1033: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60809, len 1500)
   821	15:59:14.253464 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2268202 16970996> (DF) (ttl 64, id 316, len 52)
   822	15:59:14.259438 clustera.icq.com.http > 172.16.183.2.1033: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 16970996 2268115> (DF) (ttl 49, id 60810, len 1477)
   823	15:59:14.276460 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 16971000 2268198> (DF) (ttl 49, id 60811, len 1500)
   824	15:59:14.283495 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2268205 16970996> (DF) (ttl 64, id 317, len 52)
   825	15:59:14.294199 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 16971000 2268198> (DF) (ttl 49, id 60812, len 1500)
   826	15:59:14.308294 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 16971003 2268202> (DF) (ttl 49, id 60813, len 1252)
   827	15:59:14.323476 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2268209 16971000> (DF) (ttl 64, id 318, len 52)
   828	15:59:14.325979 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 16971003 2268202> (DF) (ttl 49, id 60814, len 1500)
   829	15:59:14.342004 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60815, len 1500)
   830	15:59:14.342719 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2268210 16971003> (DF) (ttl 64, id 319, len 52)
   831	15:59:14.354831 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60816, len 1252)
   832	15:59:14.369843 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 16971006 2268205> (DF) (ttl 49, id 60817, len 1500)
   833	15:59:14.383469 172.16.183.2.1033 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2268215 16971006> (DF) (ttl 64, id 320, len 52)
   834	15:59:14.384841 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60818, len 1500)
   835	15:59:14.388962 172.16.183.2.1033 > clustera.icq.com.http: P [bad tcp cksum 32b3!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   836	15:59:14.388962 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2268215 16971010> (DF) (ttl 64, id 321, len 52)
   837	15:59:14.397213 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60819, len 1252)
   838	15:59:14.397982 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 322, len 40)
   839	15:59:14.412444 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 16971010 2268209> (DF) (ttl 49, id 60820, len 1500)
   840	15:59:14.413237 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 323, len 40)
   841	15:59:14.427472 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60821, len 1500)
   842	15:59:14.428354 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 324, len 40)
   843	15:59:14.439340 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60822, len 1252)
   844	15:59:14.440102 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 325, len 40)
   845	15:59:14.452859 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 16971011 2268210> (DF) (ttl 49, id 60823, len 1500)
   846	15:59:14.453609 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 326, len 40)
   847	15:59:14.466149 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60824, len 1500)
   848	15:59:14.466936 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 327, len 40)
   849	15:59:14.477036 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60825, len 1252)
   850	15:59:14.477727 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 328, len 40)
   851	15:59:14.490544 clustera.icq.com.http > 172.16.183.2.1033: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 16971016 2268215> (DF) (ttl 49, id 60826, len 1500)
   852	15:59:14.491306 172.16.183.2.1033 > clustera.icq.com.http: R [tcp sum ok] 345909853:345909853(0) win 0 (ttl 255, id 329, len 40)
   853	15:59:16.397321 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50731+ A? web.icq.com. [|domain] (ttl 64, id 330, len 57)
   854	15:59:16.409015 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50731 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 31928, len 233)
   855	15:59:16.410055 172.16.183.2.1034 > clustera.icq.com.http: S [tcp sum ok] 349239666:349239666(0) win 32120 <mss 1460,sackOK,timestamp 2268417 0,nop,wscale 0> (DF) (ttl 64, id 331, len 60)
   856	15:59:16.429075 clustera.icq.com.http > 172.16.183.2.1034: S [tcp sum ok] 2920270530:2920270530(0) ack 349239667 win 65535 <nop,nop,timestamp 500578743 2268417,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 34306, len 64)
   857	15:59:16.429605 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268419 500578743> (DF) (ttl 64, id 332, len 52)
   858	15:59:17.425733 172.16.183.2.1034 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268519 500578743> (DF) (ttl 64, id 333, len 104)
   859	15:59:17.443650 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500578844 2268519> (DF) (ttl 240, id 34307, len 52)
   860	15:59:18.422932 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500578940 2268519> (DF) (ttl 240, id 34308, len 1500)
   861	15:59:18.423705 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2268618 500578940> (DF) (ttl 64, id 334, len 52)
   862	15:59:18.440176 clustera.icq.com.http > 172.16.183.2.1034: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500578940 2268519> (DF) (ttl 240, id 34309, len 1500)
   863	15:59:18.453427 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2268622 500578940> (DF) (ttl 64, id 335, len 52)
   864	15:59:18.456897 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500578944 2268618> (DF) (ttl 240, id 34310, len 1477)
   865	15:59:18.471963 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500578944 2268618> (DF) (ttl 240, id 34311, len 1500)
   866	15:59:18.483437 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2268625 500578944> (DF) (ttl 64, id 336, len 52)
   867	15:59:18.486981 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500578947 2268622> (DF) (ttl 240, id 34312, len 1500)
   868	15:59:18.499600 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500578947 2268622> (DF) (ttl 240, id 34313, len 1252)
   869	15:59:18.513427 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2268628 500578947> (DF) (ttl 64, id 337, len 52)
   870	15:59:18.516546 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34314, len 1500)
   871	15:59:18.531577 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34315, len 1500)
   872	15:59:18.532331 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2268629 500578950> (DF) (ttl 64, id 338, len 52)
   873	15:59:18.542711 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500578950 2268625> (DF) (ttl 240, id 34316, len 1252)
   874	15:59:18.556224 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34317, len 1500)
   875	15:59:18.569547 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34318, len 1500)
   876	15:59:18.570286 172.16.183.2.1034 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2268634 500578950> (DF) (ttl 64, id 339, len 52)
   877	15:59:18.572998 172.16.183.2.1034 > clustera.icq.com.http: P [bad tcp cksum f99c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   878	15:59:18.572998 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2268634 500578953> (DF) (ttl 64, id 340, len 52)
   879	15:59:18.580643 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500578953 2268628> (DF) (ttl 240, id 34319, len 1252)
   880	15:59:18.581478 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 341, len 40)
   881	15:59:18.594150 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34320, len 1500)
   882	15:59:18.595179 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 342, len 40)
   883	15:59:18.607445 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34321, len 1500)
   884	15:59:18.608237 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 343, len 40)
   885	15:59:18.618817 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500578955 2268629> (DF) (ttl 240, id 34322, len 1252)
   886	15:59:18.619543 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 344, len 40)
   887	15:59:18.631098 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34323, len 1500)
   888	15:59:18.631860 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 345, len 40)
   889	15:59:18.643661 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34324, len 1500)
   890	15:59:18.644399 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 346, len 40)
   891	15:59:18.653561 clustera.icq.com.http > 172.16.183.2.1034: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500578958 2268634> (DF) (ttl 240, id 34325, len 1252)
   892	15:59:18.654263 172.16.183.2.1034 > clustera.icq.com.http: R [tcp sum ok] 349239719:349239719(0) win 0 (ttl 255, id 347, len 40)
   893	15:59:20.597190 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50732+ A? web.icq.com. [|domain] (ttl 64, id 348, len 57)
   894	15:59:20.610668 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50732 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 32375, len 233)
   895	15:59:20.611670 172.16.183.2.1035 > clustera.icq.com.http: S [tcp sum ok] 353775413:353775413(0) win 32120 <mss 1460,sackOK,timestamp 2268836 0,nop,wscale 0> (DF) (ttl 64, id 349, len 60)
   896	15:59:20.629503 clustera.icq.com.http > 172.16.183.2.1035: S [tcp sum ok] 3685924677:3685924677(0) ack 353775414 win 33304 <nop,nop,timestamp 18558534 2268836,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 52925, len 64)
   897	15:59:20.630065 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2268837 18558534> (DF) (ttl 64, id 350, len 52)
   898	15:59:21.625757 172.16.183.2.1035 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2268937 18558534> (DF) (ttl 64, id 351, len 104)
   899	15:59:21.655915 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18558636 2268937> (DF) (ttl 49, id 52926, len 52)
   900	15:59:22.343987 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52927, len 1500)
   901	15:59:22.344979 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269011 18558704> (DF) (ttl 64, id 352, len 52)
   902	15:59:22.361231 clustera.icq.com.http > 172.16.183.2.1035: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52928, len 1500)
   903	15:59:22.378440 clustera.icq.com.http > 172.16.183.2.1035: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18558704 2268937> (DF) (ttl 49, id 52929, len 1477)
   904	15:59:22.395700 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18558708 2269011> (DF) (ttl 49, id 52930, len 1500)
   905	15:59:22.396456 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2269016 18558704> (DF) (ttl 64, id 353, len 52)
   906	15:59:22.413188 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18558708 2269011> (DF) (ttl 49, id 52931, len 1500)
   907	15:59:22.428271 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52932, len 1252)
   908	15:59:22.443393 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2269021 18558708> (DF) (ttl 64, id 354, len 52)
   909	15:59:22.443708 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52933, len 1500)
   910	15:59:22.459519 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52934, len 1500)
   911	15:59:22.460256 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2269022 18558713> (DF) (ttl 64, id 355, len 52)
   912	15:59:22.471621 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18558713 2269016> (DF) (ttl 49, id 52935, len 1252)
   913	15:59:22.486863 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52936, len 1500)
   914	15:59:22.501888 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52937, len 1500)
   915	15:59:22.502637 172.16.183.2.1035 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269026 18558713> (DF) (ttl 64, id 356, len 52)
   916	15:59:22.506781 172.16.183.2.1035 > clustera.icq.com.http: P [bad tcp cksum c944!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   917	15:59:22.506781 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2269027 18558713> (DF) (ttl 64, id 357, len 52)
   918	15:59:22.514478 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18558717 2269021> (DF) (ttl 49, id 52938, len 1252)
   919	15:59:22.515409 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 358, len 40)
   920	15:59:22.528483 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52939, len 1500)
   921	15:59:22.529227 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 359, len 40)
   922	15:59:22.541780 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52940, len 1500)
   923	15:59:22.542491 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 360, len 40)
   924	15:59:22.553404 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18558719 2269022> (DF) (ttl 49, id 52941, len 1252)
   925	15:59:22.554126 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 361, len 40)
   926	15:59:22.566906 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52942, len 1500)
   927	15:59:22.567729 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 362, len 40)
   928	15:59:22.580222 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52943, len 1500)
   929	15:59:22.581046 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 363, len 40)
   930	15:59:22.591099 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52944, len 1252)
   931	15:59:22.591853 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 364, len 40)
   932	15:59:22.604620 clustera.icq.com.http > 172.16.183.2.1035: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18558723 2269026> (DF) (ttl 49, id 52945, len 1500)
   933	15:59:22.605537 172.16.183.2.1035 > clustera.icq.com.http: R [tcp sum ok] 353775466:353775466(0) win 0 (ttl 255, id 365, len 40)
   934	15:59:24.517977 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50733+ A? web.icq.com. [|domain] (ttl 64, id 366, len 57)
   935	15:59:24.531712 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50733 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 32752, len 233)
   936	15:59:24.532804 172.16.183.2.1036 > clusterb.icq.com.http: S [tcp sum ok] 345024297:345024297(0) win 32120 <mss 1460,sackOK,timestamp 2269229 0,nop,wscale 0> (DF) (ttl 64, id 367, len 60)
   937	15:59:24.550303 clusterb.icq.com.http > 172.16.183.2.1036: S [tcp sum ok] 1842368025:1842368025(0) ack 345024298 win 65535 <nop,nop,timestamp 500619613 2269229,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 32163, len 64)
   938	15:59:24.550905 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2269231 500619613> (DF) (ttl 64, id 368, len 52)
   939	15:59:25.545233 172.16.183.2.1036 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2269331 500619613> (DF) (ttl 64, id 369, len 104)
   940	15:59:25.565353 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500619715 2269331> (DF) (ttl 240, id 32164, len 52)
   941	15:59:26.298768 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500619787 2269331> (DF) (ttl 240, id 32165, len 1500)
   942	15:59:26.299524 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269406 500619787> (DF) (ttl 64, id 370, len 52)
   943	15:59:26.309092 clusterb.icq.com.http > 172.16.183.2.1036: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500619787 2269331> (DF) (ttl 240, id 32166, len 1500)
   944	15:59:26.313368 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2269408 500619787> (DF) (ttl 64, id 371, len 52)
   945	15:59:26.328075 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500619790 2269406> (DF) (ttl 240, id 32167, len 1477)
   946	15:59:26.338175 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500619790 2269406> (DF) (ttl 240, id 32168, len 1500)
   947	15:59:26.343372 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2269411 500619790> (DF) (ttl 64, id 372, len 52)
   948	15:59:26.348261 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500619791 2269408> (DF) (ttl 240, id 32169, len 1500)
   949	15:59:26.356449 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500619791 2269408> (DF) (ttl 240, id 32170, len 1252)
   950	15:59:26.363364 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2269413 500619791> (DF) (ttl 64, id 373, len 52)
   951	15:59:26.372404 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32171, len 1500)
   952	15:59:26.382030 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32172, len 1500)
   953	15:59:26.382765 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2269414 500619794> (DF) (ttl 64, id 374, len 52)
   954	15:59:26.389714 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500619794 2269411> (DF) (ttl 240, id 32173, len 1252)
   955	15:59:26.399270 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32174, len 1500)
   956	15:59:26.408389 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32175, len 1500)
   957	15:59:26.409103 172.16.183.2.1036 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269417 500619794> (DF) (ttl 64, id 375, len 52)
   958	15:59:26.415821 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500619796 2269413> (DF) (ttl 240, id 32176, len 1252)
   959	15:59:26.418187 172.16.183.2.1036 > clusterb.icq.com.http: P [bad tcp cksum a1a6!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
   960	15:59:26.418187 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2269418 500619796> (DF) (ttl 64, id 376, len 52)
   961	15:59:26.425619 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32177, len 1500)
   962	15:59:26.426512 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 377, len 40)
   963	15:59:26.434749 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32178, len 1500)
   964	15:59:26.435692 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 378, len 40)
   965	15:59:26.442172 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500619798 2269414> (DF) (ttl 240, id 32179, len 1252)
   966	15:59:26.442888 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 379, len 40)
   967	15:59:26.451735 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32180, len 1500)
   968	15:59:26.452567 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 380, len 40)
   969	15:59:26.460853 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32181, len 1500)
   970	15:59:26.461664 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 381, len 40)
   971	15:59:26.468288 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32182, len 1252)
   972	15:59:26.469043 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 382, len 40)
   973	15:59:26.477620 clusterb.icq.com.http > 172.16.183.2.1036: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500619801 2269417> (DF) (ttl 240, id 32183, len 1500)
   974	15:59:26.478404 172.16.183.2.1036 > clusterb.icq.com.http: R [tcp sum ok] 345024350:345024350(0) win 0 (ttl 255, id 383, len 40)
   975	15:59:28.417369 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50734+ A? web.icq.com. [|domain] (ttl 64, id 384, len 57)
   976	15:59:28.429342 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50734 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 33104, len 233)
   977	15:59:28.430421 172.16.183.2.1037 > clusterb.icq.com.http: S [tcp sum ok] 356706602:356706602(0) win 32120 <mss 1460,sackOK,timestamp 2269619 0,nop,wscale 0> (DF) (ttl 64, id 385, len 60)
   978	15:59:28.447431 clusterb.icq.com.http > 172.16.183.2.1037: S [tcp sum ok] 1673736519:1673736519(0) ack 356706603 win 65535 <nop,nop,timestamp 500709525 2269619,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 13779, len 64)
   979	15:59:28.448032 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2269621 500709525> (DF) (ttl 64, id 386, len 52)
   980	15:59:29.445652 172.16.183.2.1037 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2269721 500709525> (DF) (ttl 64, id 387, len 104)
   981	15:59:29.466685 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500709627 2269721> (DF) (ttl 240, id 13780, len 52)
   982	15:59:30.369096 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500709715 2269721> (DF) (ttl 240, id 13781, len 1500)
   983	15:59:30.369896 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2269814 500709715> (DF) (ttl 64, id 388, len 52)
   984	15:59:30.387319 clusterb.icq.com.http > 172.16.183.2.1037: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500709715 2269721> (DF) (ttl 240, id 13782, len 1500)
   985	15:59:30.393333 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2269816 500709715> (DF) (ttl 64, id 389, len 52)
   986	15:59:30.406515 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500709719 2269814> (DF) (ttl 240, id 13783, len 1477)
   987	15:59:30.423335 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2269819 500709719> (DF) (ttl 64, id 390, len 52)
   988	15:59:30.424022 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500709719 2269814> (DF) (ttl 240, id 13784, len 1500)
   989	15:59:30.441034 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500709721 2269816> (DF) (ttl 240, id 13785, len 1500)
   990	15:59:30.441779 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2269820 500709719> (DF) (ttl 64, id 391, len 52)
   991	15:59:30.454131 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500709721 2269816> (DF) (ttl 240, id 13786, len 1252)
   992	15:59:30.469603 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500709724 2269819> (DF) (ttl 240, id 13787, len 1500)
   993	15:59:30.483334 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2269825 500709721> (DF) (ttl 64, id 392, len 52)
   994	15:59:30.484651 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500709724 2269819> (DF) (ttl 240, id 13788, len 1500)
   995	15:59:30.497507 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13789, len 1252)
   996	15:59:30.503330 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2269827 500709724> (DF) (ttl 64, id 393, len 52)
   997	15:59:30.512725 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13790, len 1500)
   998	15:59:30.527750 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500709726 2269820> (DF) (ttl 240, id 13791, len 1500)
   999	15:59:30.528476 172.16.183.2.1037 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2269829 500709726> (DF) (ttl 64, id 394, len 52)
  1000	15:59:30.532602 172.16.183.2.1037 > clusterb.icq.com.http: P [bad tcp cksum 7b8f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1001	15:59:30.532602 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2269829 500709726> (DF) (ttl 64, id 395, len 52)
  1002	15:59:30.540591 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13792, len 1252)
  1003	15:59:30.541341 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 396, len 40)
  1004	15:59:30.554336 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13793, len 1500)
  1005	15:59:30.556220 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 397, len 40)
  1006	15:59:30.567896 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500709730 2269825> (DF) (ttl 240, id 13794, len 1500)
  1007	15:59:30.568673 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 398, len 40)
  1008	15:59:30.578536 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13795, len 1252)
  1009	15:59:30.579265 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 399, len 40)
  1010	15:59:30.592560 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13796, len 1500)
  1011	15:59:30.593411 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 400, len 40)
  1012	15:59:30.605840 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500709732 2269827> (DF) (ttl 240, id 13797, len 1500)
  1013	15:59:30.606656 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 401, len 40)
  1014	15:59:30.617212 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13798, len 1252)
  1015	15:59:30.617949 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 402, len 40)
  1016	15:59:30.630718 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13799, len 1500)
  1017	15:59:30.631456 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 403, len 40)
  1018	15:59:30.643040 clusterb.icq.com.http > 172.16.183.2.1037: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500709734 2269829> (DF) (ttl 240, id 13800, len 1500)
  1019	15:59:30.643824 172.16.183.2.1037 > clusterb.icq.com.http: R [tcp sum ok] 356706655:356706655(0) win 0 (ttl 255, id 404, len 40)
  1020	15:59:32.537559 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50735+ A? web.icq.com. [|domain] (ttl 64, id 405, len 57)
  1021	15:59:32.550188 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50735 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 33382, len 233)
  1022	15:59:32.551274 172.16.183.2.1038 > clustera.icq.com.http: S [tcp sum ok] 358047615:358047615(0) win 32120 <mss 1460,sackOK,timestamp 2270032 0,nop,wscale 0> (DF) (ttl 64, id 406, len 60)
  1023	15:59:32.569756 clustera.icq.com.http > 172.16.183.2.1038: S [tcp sum ok] 602579997:602579997(0) ack 358047616 win 65535 <nop,nop,timestamp 501163630 2270032,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 42436, len 64)
  1024	15:59:32.570325 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2270034 501163630> (DF) (ttl 64, id 407, len 52)
  1025	15:59:33.565328 172.16.183.2.1038 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2270134 501163630> (DF) (ttl 64, id 408, len 104)
  1026	15:59:33.587284 clustera.icq.com.http > 172.16.183.2.1038: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501163732 2270134> (DF) (ttl 240, id 42437, len 52)
  1027	15:59:33.782945 clustera.icq.com.http > 172.16.183.2.1038: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501163751 2270134> (DF) (ttl 240, id 42438, len 391)
  1028	15:59:33.783645 clustera.icq.com.http > 172.16.183.2.1038: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501163751 2270134> (DF) (ttl 240, id 42439, len 52)
  1029	15:59:33.783999 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2270154 501163751> (DF) (ttl 64, id 409, len 52)
  1030	15:59:33.784422 172.16.183.2.1038 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2270154 501163751> (DF) (ttl 64, id 410, len 52)
  1031	15:59:59.443090 172.16.183.2.1038 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2272722 501163751> (DF) (ttl 64, id 411, len 52)
  1032	15:59:59.460182 172.16.183.2.1038 > clustera.icq.com.http: P [bad tcp cksum 671b!] 244532723:244532774(51) ack 4050434968 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1033	15:59:59.460182 clustera.icq.com.http > 172.16.183.2.1038: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501166319 2272722> (DF) (ttl 240, id 42440, len 52)
  1034	16:00:00.447611 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50736+ A? web.icq.com. [|domain] (ttl 64, id 412, len 57)
  1035	16:00:00.462101 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50736 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36119, len 233)
  1036	16:00:00.463184 172.16.183.2.1039 > clustera.icq.com.http: S [tcp sum ok] 394055014:394055014(0) win 32120 <mss 1460,sackOK,timestamp 2272823 0,nop,wscale 0> (DF) (ttl 64, id 413, len 60)
  1037	16:00:00.480429 clustera.icq.com.http > 172.16.183.2.1039: S [tcp sum ok] 3797363675:3797363675(0) ack 394055015 win 65535 <nop,nop,timestamp 500583148 2272823,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 60729, len 64)
  1038	16:00:00.481023 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2272824 500583148> (DF) (ttl 64, id 414, len 52)
  1039	16:00:01.475340 172.16.183.2.1039 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2272924 500583148> (DF) (ttl 64, id 415, len 104)
  1040	16:00:01.498223 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500583249 2272924> (DF) (ttl 240, id 60730, len 52)
  1041	16:00:02.293937 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500583328 2272924> (DF) (ttl 240, id 60731, len 1500)
  1042	16:00:02.294991 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2273007 500583328> (DF) (ttl 64, id 416, len 52)
  1043	16:00:02.309470 clustera.icq.com.http > 172.16.183.2.1039: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500583328 2272924> (DF) (ttl 240, id 60732, len 1500)
  1044	16:00:02.313048 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2273009 500583328> (DF) (ttl 64, id 417, len 52)
  1045	16:00:02.329094 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500583331 2273007> (DF) (ttl 240, id 60733, len 1477)
  1046	16:00:02.342955 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500583331 2273007> (DF) (ttl 240, id 60734, len 1500)
  1047	16:00:02.353045 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2273012 500583331> (DF) (ttl 64, id 418, len 52)
  1048	16:00:02.357989 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500583333 2273009> (DF) (ttl 240, id 60735, len 1500)
  1049	16:00:02.370349 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500583333 2273009> (DF) (ttl 240, id 60736, len 1252)
  1050	16:00:02.383034 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2273016 500583333> (DF) (ttl 64, id 419, len 52)
  1051	16:00:02.390741 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60737, len 1500)
  1052	16:00:02.403829 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60738, len 1500)
  1053	16:00:02.404570 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2273018 500583337> (DF) (ttl 64, id 420, len 52)
  1054	16:00:02.414936 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500583337 2273012> (DF) (ttl 240, id 60739, len 1252)
  1055	16:00:02.428452 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60740, len 1500)
  1056	16:00:02.429273 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2273021 500583337> (DF) (ttl 64, id 421, len 52)
  1057	16:00:02.442247 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60741, len 1500)
  1058	16:00:02.443060 172.16.183.2.1039 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2273022 500583340> (DF) (ttl 64, id 422, len 52)
  1059	16:00:02.445406 172.16.183.2.1039 > clustera.icq.com.http: P [bad tcp cksum f92f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1060	16:00:02.445406 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2273022 500583340> (DF) (ttl 64, id 423, len 52)
  1061	16:00:02.452871 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500583340 2273016> (DF) (ttl 240, id 60742, len 1252)
  1062	16:00:02.453610 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 424, len 40)
  1063	16:00:02.466380 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60743, len 1500)
  1064	16:00:02.467161 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 425, len 40)
  1065	16:00:02.478936 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60744, len 1500)
  1066	16:00:02.479701 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 426, len 40)
  1067	16:00:02.488831 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500583342 2273018> (DF) (ttl 240, id 60745, len 1252)
  1068	16:00:02.489520 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 427, len 40)
  1069	16:00:02.500860 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500583344 2273021> (DF) (ttl 240, id 60746, len 1500)
  1070	16:00:02.501606 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 428, len 40)
  1071	16:00:02.513426 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500583344 2273021> (DF) (ttl 240, id 60747, len 1500)
  1072	16:00:02.514204 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 429, len 40)
  1073	16:00:02.523322 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60748, len 1252)
  1074	16:00:02.524000 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 430, len 40)
  1075	16:00:02.535363 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60749, len 1500)
  1076	16:00:02.536125 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 431, len 40)
  1077	16:00:02.547424 clustera.icq.com.http > 172.16.183.2.1039: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500583346 2273022> (DF) (ttl 240, id 60750, len 1500)
  1078	16:00:02.548197 172.16.183.2.1039 > clustera.icq.com.http: R [tcp sum ok] 394055067:394055067(0) win 0 (ttl 255, id 432, len 40)
  1079	16:00:04.457053 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50737+ A? web.icq.com. [|domain] (ttl 64, id 433, len 57)
  1080	16:00:04.469357 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50737 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36503, len 233)
  1081	16:00:04.470137 172.16.183.2.1040 > clustera.icq.com.http: S [tcp sum ok] 392431046:392431046(0) win 32120 <mss 1460,sackOK,timestamp 2273224 0,nop,wscale 0> (DF) (ttl 64, id 434, len 60)
  1082	16:00:04.488701 clustera.icq.com.http > 172.16.183.2.1040: S [tcp sum ok] 1393169427:1393169427(0) ack 392431047 win 33304 <nop,nop,timestamp 199514718 2273224,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 34733, len 64)
  1083	16:00:04.489152 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2273226 199514718> (DF) (ttl 64, id 435, len 52)
  1084	16:00:05.486138 172.16.183.2.1040 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2273326 199514718> (DF) (ttl 64, id 436, len 104)
  1085	16:00:05.506700 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] ack 53 win 33278 <nop,nop,timestamp 199514819 2273326> (DF) (ttl 49, id 34734, len 52)
  1086	16:00:10.184289 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34735, len 1500)
  1087	16:00:10.185303 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2273797 199515285> (DF) (ttl 64, id 437, len 52)
  1088	16:00:10.205223 clustera.icq.com.http > 172.16.183.2.1040: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34736, len 1500)
  1089	16:00:10.225174 clustera.icq.com.http > 172.16.183.2.1040: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34737, len 1477)
  1090	16:00:10.242965 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2273803 199515285> (DF) (ttl 64, id 438, len 52)
  1091	16:00:10.245635 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 199515285 2273326> (DF) (ttl 49, id 34738, len 1500)
  1092	16:00:10.264833 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 199515289 2273797> (DF) (ttl 49, id 34739, len 1500)
  1093	16:00:10.265623 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2273805 199515285> (DF) (ttl 64, id 439, len 52)
  1094	16:00:10.279674 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 199515289 2273797> (DF) (ttl 49, id 34740, len 1252)
  1095	16:00:10.292970 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2273808 199515289> (DF) (ttl 64, id 440, len 52)
  1096	16:00:10.296881 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34741, len 1500)
  1097	16:00:10.314629 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34742, len 1500)
  1098	16:00:10.315571 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2273810 199515295> (DF) (ttl 64, id 441, len 52)
  1099	16:00:10.328724 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 199515295 2273803> (DF) (ttl 49, id 34743, len 1252)
  1100	16:00:10.342985 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2273813 199515295> (DF) (ttl 64, id 442, len 52)
  1101	16:00:10.346150 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34744, len 1500)
  1102	16:00:10.362414 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34745, len 1500)
  1103	16:00:10.363094 172.16.183.2.1040 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2273814 199515297> (DF) (ttl 64, id 443, len 52)
  1104	16:00:10.367058 172.16.183.2.1040 > clustera.icq.com.http: P [bad tcp cksum c59e!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1105	16:00:10.367058 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2273815 199515297> (DF) (ttl 64, id 444, len 52)
  1106	16:00:10.375012 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 199515297 2273805> (DF) (ttl 49, id 34746, len 1252)
  1107	16:00:10.375761 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 445, len 40)
  1108	16:00:10.390004 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 199515300 2273808> (DF) (ttl 49, id 34747, len 1500)
  1109	16:00:10.390737 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 446, len 40)
  1110	16:00:10.405520 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 199515300 2273808> (DF) (ttl 49, id 34748, len 1500)
  1111	16:00:10.406231 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 447, len 40)
  1112	16:00:10.418120 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34749, len 1252)
  1113	16:00:10.418819 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 448, len 40)
  1114	16:00:10.433592 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34750, len 1500)
  1115	16:00:10.434303 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 449, len 40)
  1116	16:00:10.448630 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 199515302 2273810> (DF) (ttl 49, id 34751, len 1500)
  1117	16:00:10.449360 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 450, len 40)
  1118	16:00:10.459754 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 199515305 2273813> (DF) (ttl 49, id 34752, len 1252)
  1119	16:00:10.460429 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 451, len 40)
  1120	16:00:10.473279 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 199515305 2273813> (DF) (ttl 49, id 34753, len 1500)
  1121	16:00:10.473996 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 452, len 40)
  1122	16:00:10.486569 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34754, len 1500)
  1123	16:00:10.487307 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 453, len 40)
  1124	16:00:10.497944 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34755, len 1252)
  1125	16:00:10.498623 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 454, len 40)
  1126	16:00:10.511454 clustera.icq.com.http > 172.16.183.2.1040: . [tcp sum ok] 28898:30346(1448) ack 53 win 33304 <nop,nop,timestamp 199515307 2273814> (DF) (ttl 49, id 34756, len 1500)
  1127	16:00:10.512161 172.16.183.2.1040 > clustera.icq.com.http: R [tcp sum ok] 392431099:392431099(0) win 0 (ttl 255, id 455, len 40)
  1128	16:00:12.377009 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50738+ A? web.icq.com. [|domain] (ttl 64, id 456, len 57)
  1129	16:00:12.389776 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50738 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 37209, len 233)
  1130	16:00:12.390800 172.16.183.2.1041 > clustera.icq.com.http: S [tcp sum ok] 401016398:401016398(0) win 32120 <mss 1460,sackOK,timestamp 2274017 0,nop,wscale 0> (DF) (ttl 64, id 457, len 60)
  1131	16:00:12.409838 clustera.icq.com.http > 172.16.183.2.1041: S [tcp sum ok] 1376461372:1376461372(0) ack 401016399 win 33304 <nop,nop,timestamp 18563713 2274017,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 52946, len 64)
  1132	16:00:12.410400 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274019 18563713> (DF) (ttl 64, id 458, len 52)
  1133	16:00:13.405762 172.16.183.2.1041 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274119 18563713> (DF) (ttl 64, id 459, len 104)
  1134	16:00:13.424902 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 18563815 2274119> (DF) (ttl 49, id 52947, len 52)
  1135	16:00:14.788769 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52948, len 1500)
  1136	16:00:14.789545 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2274257 18563949> (DF) (ttl 64, id 460, len 52)
  1137	16:00:14.808709 clustera.icq.com.http > 172.16.183.2.1041: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52949, len 1500)
  1138	16:00:14.822944 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2274261 18563949> (DF) (ttl 64, id 461, len 52)
  1139	16:00:14.825947 clustera.icq.com.http > 172.16.183.2.1041: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 18563949 2274119> (DF) (ttl 49, id 52950, len 1477)
  1140	16:00:14.843457 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 18563953 2274257> (DF) (ttl 49, id 52951, len 1500)
  1141	16:00:14.852945 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2274264 18563949> (DF) (ttl 64, id 462, len 52)
  1142	16:00:14.860703 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 18563953 2274257> (DF) (ttl 49, id 52952, len 1500)
  1143	16:00:14.875037 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 18563956 2274261> (DF) (ttl 49, id 52953, len 1252)
  1144	16:00:14.892489 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 18563956 2274261> (DF) (ttl 49, id 52954, len 1500)
  1145	16:00:14.893239 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2274267 18563953> (DF) (ttl 64, id 463, len 52)
  1146	16:00:14.908991 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52955, len 1500)
  1147	16:00:14.921358 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52956, len 1252)
  1148	16:00:14.932927 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2274272 18563959> (DF) (ttl 64, id 464, len 52)
  1149	16:00:14.936834 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 18563959 2274264> (DF) (ttl 49, id 52957, len 1500)
  1150	16:00:14.951852 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52958, len 1500)
  1151	16:00:14.952615 172.16.183.2.1041 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2274274 18563959> (DF) (ttl 64, id 465, len 52)
  1152	16:00:14.955356 172.16.183.2.1041 > clustera.icq.com.http: P [bad tcp cksum 8e90!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1153	16:00:14.955356 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2274274 18563959> (DF) (ttl 64, id 466, len 52)
  1154	16:00:14.963977 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52959, len 1252)
  1155	16:00:14.965182 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 467, len 40)
  1156	16:00:14.979440 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52960, len 1500)
  1157	16:00:14.980283 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 468, len 40)
  1158	16:00:14.994466 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 18563964 2274267> (DF) (ttl 49, id 52961, len 1500)
  1159	16:00:14.995420 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 469, len 40)
  1160	16:00:15.005842 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52962, len 1252)
  1161	16:00:15.006571 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 470, len 40)
  1162	16:00:15.019356 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52963, len 1500)
  1163	16:00:15.020121 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 471, len 40)
  1164	16:00:15.032655 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 18563967 2274272> (DF) (ttl 49, id 52964, len 1500)
  1165	16:00:15.033400 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 472, len 40)
  1166	16:00:15.044029 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52965, len 1252)
  1167	16:00:15.045001 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 473, len 40)
  1168	16:00:15.057532 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52966, len 1500)
  1169	16:00:15.058292 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 474, len 40)
  1170	16:00:15.070836 clustera.icq.com.http > 172.16.183.2.1041: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 18563969 2274274> (DF) (ttl 49, id 52967, len 1500)
  1171	16:00:15.071610 172.16.183.2.1041 > clustera.icq.com.http: R [tcp sum ok] 401016451:401016451(0) win 0 (ttl 255, id 475, len 40)
  1172	16:00:16.977087 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50739+ A? web.icq.com. [|domain] (ttl 64, id 476, len 57)
  1173	16:00:16.990301 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50739 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 37512, len 233)
  1174	16:00:16.991304 172.16.183.2.1042 > clusterc.icq.com.http: S [tcp sum ok] 396875548:396875548(0) win 32120 <mss 1460,sackOK,timestamp 2274476 0,nop,wscale 0> (DF) (ttl 64, id 477, len 60)
  1175	16:00:17.008396 clusterc.icq.com.http > 172.16.183.2.1042: S [tcp sum ok] 1930518105:1930518105(0) ack 396875549 win 33304 <nop,nop,timestamp 214680094 2274476,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 38189, len 64)
  1176	16:00:17.008924 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274477 214680094> (DF) (ttl 64, id 478, len 52)
  1177	16:00:17.995679 172.16.183.2.1042 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274577 214680094> (DF) (ttl 64, id 479, len 104)
  1178	16:00:18.021979 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 214680194 2274577> (DF) (ttl 49, id 38190, len 52)
  1179	16:00:18.696238 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38191, len 1500)
  1180	16:00:18.696991 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2274648 214680261> (DF) (ttl 64, id 480, len 52)
  1181	16:00:18.714485 clusterc.icq.com.http > 172.16.183.2.1042: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38192, len 1500)
  1182	16:00:18.731460 clusterc.icq.com.http > 172.16.183.2.1042: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 214680261 2274577> (DF) (ttl 49, id 38193, len 1477)
  1183	16:00:18.732293 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2274652 214680261> (DF) (ttl 64, id 481, len 52)
  1184	16:00:18.748960 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 214680264 2274648> (DF) (ttl 49, id 38194, len 1500)
  1185	16:00:18.762886 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2274655 214680261> (DF) (ttl 64, id 482, len 52)
  1186	16:00:18.765971 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 214680264 2274648> (DF) (ttl 49, id 38195, len 1500)
  1187	16:00:18.779820 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 214680268 2274652> (DF) (ttl 49, id 38196, len 1252)
  1188	16:00:18.792890 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2274658 214680264> (DF) (ttl 64, id 483, len 52)
  1189	16:00:18.795063 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 214680268 2274652> (DF) (ttl 49, id 38197, len 1500)
  1190	16:00:18.810557 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38198, len 1500)
  1191	16:00:18.811368 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2274660 214680268> (DF) (ttl 64, id 484, len 52)
  1192	16:00:18.823173 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38199, len 1252)
  1193	16:00:18.838413 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 214680271 2274655> (DF) (ttl 49, id 38200, len 1500)
  1194	16:00:18.842916 172.16.183.2.1042 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2274663 214680271> (DF) (ttl 64, id 485, len 52)
  1195	16:00:18.853433 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38201, len 1500)
  1196	16:00:18.856850 172.16.183.2.1042 > clusterc.icq.com.http: P [bad tcp cksum 9a62!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1197	16:00:18.856850 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2274664 214680274> (DF) (ttl 64, id 486, len 52)
  1198	16:00:18.865780 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38202, len 1252)
  1199	16:00:18.866627 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 487, len 40)
  1200	16:00:18.880027 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 214680274 2274658> (DF) (ttl 49, id 38203, len 1500)
  1201	16:00:18.880768 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 488, len 40)
  1202	16:00:18.893324 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38204, len 1500)
  1203	16:00:18.894080 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 489, len 40)
  1204	16:00:18.905195 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38205, len 1252)
  1205	16:00:18.905941 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 490, len 40)
  1206	16:00:18.918698 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 214680276 2274660> (DF) (ttl 49, id 38206, len 1500)
  1207	16:00:18.919437 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 491, len 40)
  1208	16:00:18.932254 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38207, len 1500)
  1209	16:00:18.933000 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 492, len 40)
  1210	16:00:18.942890 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38208, len 1252)
  1211	16:00:18.943567 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 493, len 40)
  1212	16:00:18.956401 clusterc.icq.com.http > 172.16.183.2.1042: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 214680279 2274663> (DF) (ttl 49, id 38209, len 1500)
  1213	16:00:18.957102 172.16.183.2.1042 > clusterc.icq.com.http: R [tcp sum ok] 396875601:396875601(0) win 0 (ttl 255, id 494, len 40)
  1214	16:00:20.857265 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50740+ A? web.icq.com. [|domain] (ttl 64, id 495, len 57)
  1215	16:00:20.870933 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50740 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 37839, len 233)
  1216	16:00:20.871940 172.16.183.2.1043 > clusterb.icq.com.http: S [tcp sum ok] 400485699:400485699(0) win 32120 <mss 1460,sackOK,timestamp 2274865 0,nop,wscale 0> (DF) (ttl 64, id 496, len 60)
  1217	16:00:20.892975 clusterb.icq.com.http > 172.16.183.2.1043: S [tcp sum ok] 1033565685:1033565685(0) ack 400485700 win 65535 <nop,nop,timestamp 501162567 2274865,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22215, len 64)
  1218	16:00:20.893513 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2274866 501162567> (DF) (ttl 64, id 497, len 52)
  1219	16:00:21.885758 172.16.183.2.1043 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2274966 501162567> (DF) (ttl 64, id 498, len 104)
  1220	16:00:21.914667 clusterb.icq.com.http > 172.16.183.2.1043: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501162669 2274966> (DF) (ttl 240, id 22216, len 52)
  1221	16:00:22.105403 clusterb.icq.com.http > 172.16.183.2.1043: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501162689 2274966> (DF) (ttl 240, id 22217, len 391)
  1222	16:00:22.105851 clusterb.icq.com.http > 172.16.183.2.1043: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501162689 2274966> (DF) (ttl 240, id 22218, len 52)
  1223	16:00:22.106286 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2274989 501162689> (DF) (ttl 64, id 499, len 52)
  1224	16:00:22.106723 172.16.183.2.1043 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2274989 501162689> (DF) (ttl 64, id 500, len 52)
  1225	16:00:47.632750 172.16.183.2.1043 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2277522 501162689> (DF) (ttl 64, id 501, len 52)
  1226	16:00:47.651120 172.16.183.2.1043 > clusterb.icq.com.http: P [bad tcp cksum 691f!] 633080327:633080378(51) ack 3661887364 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1227	16:00:47.651120 clusterb.icq.com.http > 172.16.183.2.1043: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501165243 2277522> (DF) (ttl 240, id 22219, len 52)
  1228	16:00:48.637178 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50741+ A? web.icq.com. [|domain] (ttl 64, id 502, len 57)
  1229	16:00:48.652745 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50741 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 40661, len 233)
  1230	16:00:48.653889 172.16.183.2.1044 > clusterc.icq.com.http: S [tcp sum ok] 432467290:432467290(0) win 32120 <mss 1460,sackOK,timestamp 2277624 0,nop,wscale 0> (DF) (ttl 64, id 503, len 60)
  1231	16:00:48.671587 clusterc.icq.com.http > 172.16.183.2.1044: S [tcp sum ok] 2313883439:2313883439(0) ack 432467291 win 65535 <nop,nop,timestamp 200572841 2277624,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 64667, len 64)
  1232	16:00:48.672146 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2277626 200572841> (DF) (ttl 64, id 504, len 52)
  1233	16:00:49.665636 172.16.183.2.1044 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2277726 200572841> (DF) (ttl 64, id 505, len 104)
  1234	16:00:49.694276 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200572944 2277726> (DF) (ttl 240, id 64668, len 52)
  1235	16:00:50.257685 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 200572996 2277726> (DF) (ttl 240, id 64669, len 1500)
  1236	16:00:50.258443 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2277805 200572996> (DF) (ttl 64, id 506, len 52)
  1237	16:00:50.275909 clusterc.icq.com.http > 172.16.183.2.1044: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 200572996 2277726> (DF) (ttl 240, id 64670, len 1500)
  1238	16:00:50.292617 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2277809 200572996> (DF) (ttl 64, id 507, len 52)
  1239	16:00:50.300313 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 200573002 2277805> (DF) (ttl 240, id 64671, len 1477)
  1240	16:00:50.317564 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 200573002 2277805> (DF) (ttl 240, id 64672, len 1500)
  1241	16:00:50.322632 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2277812 200573002> (DF) (ttl 64, id 508, len 52)
  1242	16:00:50.341699 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 200573005 2277809> (DF) (ttl 240, id 64673, len 1500)
  1243	16:00:50.354069 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 200573005 2277809> (DF) (ttl 240, id 64674, len 1252)
  1244	16:00:50.369294 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64675, len 1500)
  1245	16:00:50.370147 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2277817 200573005> (DF) (ttl 64, id 509, len 52)
  1246	16:00:50.384825 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64676, len 1500)
  1247	16:00:50.397437 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 200573008 2277812> (DF) (ttl 240, id 64677, len 1252)
  1248	16:00:50.402610 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2277820 200573008> (DF) (ttl 64, id 510, len 52)
  1249	16:00:50.412653 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64678, len 1500)
  1250	16:00:50.427687 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64679, len 1500)
  1251	16:00:50.428377 172.16.183.2.1044 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2277822 200573013> (DF) (ttl 64, id 511, len 52)
  1252	16:00:50.432928 172.16.183.2.1044 > clusterc.icq.com.http: P [bad tcp cksum 8982!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1253	16:00:50.432928 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2277823 200573013> (DF) (ttl 64, id 512, len 52)
  1254	16:00:50.438799 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64680, len 1252)
  1255	16:00:50.439539 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 513, len 40)
  1256	16:00:50.452297 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 200573013 2277817> (DF) (ttl 240, id 64681, len 1500)
  1257	16:00:50.453111 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 514, len 40)
  1258	16:00:50.466341 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64682, len 1500)
  1259	16:00:50.467064 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 515, len 40)
  1260	16:00:50.477226 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64683, len 1252)
  1261	16:00:50.477971 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 516, len 40)
  1262	16:00:50.490730 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 200573016 2277820> (DF) (ttl 240, id 64684, len 1500)
  1263	16:00:50.491518 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 517, len 40)
  1264	16:00:50.504060 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64685, len 1500)
  1265	16:00:50.505048 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 518, len 40)
  1266	16:00:50.515173 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64686, len 1252)
  1267	16:00:50.515875 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 519, len 40)
  1268	16:00:50.528188 clusterc.icq.com.http > 172.16.183.2.1044: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 200573019 2277822> (DF) (ttl 240, id 64687, len 1500)
  1269	16:00:50.528924 172.16.183.2.1044 > clusterc.icq.com.http: R [tcp sum ok] 432467343:432467343(0) win 0 (ttl 255, id 520, len 40)
  1270	16:00:52.457167 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50742+ A? web.icq.com. [|domain] (ttl 64, id 521, len 57)
  1271	16:00:52.470071 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50742 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 40970, len 233)
  1272	16:00:52.470890 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278025 0,nop,wscale 0> (DF) (ttl 64, id 522, len 60)
  1273	16:00:55.475442 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278325 0,nop,wscale 0> (DF) (ttl 64, id 523, len 60)
  1274	16:01:01.465370 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2278925 0,nop,wscale 0> (DF) (ttl 64, id 524, len 60)
  1275	16:01:13.465357 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2280125 0,nop,wscale 0> (DF) (ttl 64, id 525, len 60)
  1276	16:01:37.545304 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2282525 0,nop,wscale 0> (DF) (ttl 64, id 526, len 60)
  1277	16:02:25.585528 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2287325 0,nop,wscale 0> (DF) (ttl 64, id 527, len 60)
  1278	16:02:40.043361 218.209.145.27 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 5029, len 422)
  1279	16:03:37.492985 122.255.17.55 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 34315, len 422)
  1280	16:04:01.405275 172.16.183.2.1045 > clusterb.icq.com.http: S [tcp sum ok] 445611523:445611523(0) win 32120 <mss 1460,sackOK,timestamp 2296925 0,nop,wscale 0> (DF) (ttl 64, id 528, len 60)
  1281	16:04:01.427339 clusterb.icq.com.http > 172.16.183.2.1045: S [tcp sum ok] 2816262027:2816262027(0) ack 445611524 win 65535 <nop,nop,timestamp 500736823 2296925,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 24615, len 64)
  1282	16:04:01.428219 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2296927 500736823> (DF) (ttl 64, id 529, len 52)
  1283	16:04:02.425771 172.16.183.2.1045 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2297027 500736823> (DF) (ttl 64, id 530, len 104)
  1284	16:04:02.445116 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500736925 2297027> (DF) (ttl 240, id 24616, len 52)
  1285	16:04:02.967859 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500736975 2297027> (DF) (ttl 240, id 24617, len 1500)
  1286	16:04:02.968615 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2297082 500736975> (DF) (ttl 64, id 531, len 52)
  1287	16:04:02.988073 clusterb.icq.com.http > 172.16.183.2.1045: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500736975 2297027> (DF) (ttl 240, id 24618, len 1500)
  1288	16:04:03.000890 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2297086 500736975> (DF) (ttl 64, id 532, len 52)
  1289	16:04:03.007023 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500736979 2297082> (DF) (ttl 240, id 24619, len 1477)
  1290	16:04:03.024283 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500736979 2297082> (DF) (ttl 240, id 24620, len 1500)
  1291	16:04:03.030915 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2297089 500736979> (DF) (ttl 64, id 533, len 52)
  1292	16:04:03.041536 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500736982 2297086> (DF) (ttl 240, id 24621, len 1500)
  1293	16:04:03.055866 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500736982 2297086> (DF) (ttl 240, id 24622, len 1252)
  1294	16:04:03.070897 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2297093 500736982> (DF) (ttl 64, id 534, len 52)
  1295	16:04:03.073791 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24623, len 1500)
  1296	16:04:03.090062 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24624, len 1500)
  1297	16:04:03.091010 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2297095 500736985> (DF) (ttl 64, id 535, len 52)
  1298	16:04:03.102916 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500736985 2297089> (DF) (ttl 240, id 24625, len 1252)
  1299	16:04:03.117911 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24626, len 1500)
  1300	16:04:03.130895 172.16.183.2.1045 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2297099 500736985> (DF) (ttl 64, id 536, len 52)
  1301	16:04:03.132928 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24627, len 1500)
  1302	16:04:03.137661 172.16.183.2.1045 > clusterb.icq.com.http: P [bad tcp cksum e822!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1303	16:04:03.137661 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2297099 500736989> (DF) (ttl 64, id 537, len 52)
  1304	16:04:03.145527 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500736989 2297093> (DF) (ttl 240, id 24628, len 1252)
  1305	16:04:03.146303 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 538, len 40)
  1306	16:04:03.160766 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24629, len 1500)
  1307	16:04:03.161543 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 539, len 40)
  1308	16:04:03.176030 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24630, len 1500)
  1309	16:04:03.176813 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 540, len 40)
  1310	16:04:03.187413 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500736991 2297095> (DF) (ttl 240, id 24631, len 1252)
  1311	16:04:03.188150 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 541, len 40)
  1312	16:04:03.200911 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24632, len 1500)
  1313	16:04:03.201675 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 542, len 40)
  1314	16:04:03.214210 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24633, len 1500)
  1315	16:04:03.215177 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 543, len 40)
  1316	16:04:03.225105 clusterb.icq.com.http > 172.16.183.2.1045: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500736995 2297099> (DF) (ttl 240, id 24634, len 1252)
  1317	16:04:03.225837 172.16.183.2.1045 > clusterb.icq.com.http: R [tcp sum ok] 445611576:445611576(0) win 0 (ttl 255, id 544, len 40)
  1318	16:04:05.147413 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50743+ A? web.icq.com. [|domain] (ttl 64, id 545, len 57)
  1319	16:04:05.161020 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50743 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 59442, len 233)
  1320	16:04:05.162886 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2297301 0,nop,wscale 0> (DF) (ttl 64, id 546, len 60)
  1321	16:04:08.165294 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2297602 0,nop,wscale 0> (DF) (ttl 64, id 547, len 60)
  1322	16:04:14.175215 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2298202 0,nop,wscale 0> (DF) (ttl 64, id 548, len 60)
  1323	16:04:26.185231 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2299402 0,nop,wscale 0> (DF) (ttl 64, id 549, len 60)
  1324	16:04:33.707291 26.44.146.84 > 172.16.183.2:  ip-proto-11 402 (ttl 237, id 63600, len 422)
  1325	16:04:50.155396 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2301802 0,nop,wscale 0> (DF) (ttl 64, id 550, len 60)
  1326	16:05:38.205079 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2306602 0,nop,wscale 0> (DF) (ttl 64, id 551, len 60)
  1327	16:07:14.275104 172.16.183.2.1046 > clustera.icq.com.http: S [tcp sum ok] 659617462:659617462(0) win 32120 <mss 1460,sackOK,timestamp 2316202 0,nop,wscale 0> (DF) (ttl 64, id 552, len 60)
  1328	16:07:14.291981 clustera.icq.com.http > 172.16.183.2.1046: S [tcp sum ok] 2841586950:2841586950(0) ack 659617463 win 24616 <nop,nop,timestamp 252426667 2316202,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 16559, len 64)
  1329	16:07:14.292677 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2316203 252426667> (DF) (ttl 64, id 553, len 52)
  1330	16:07:15.285607 172.16.183.2.1046 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2316303 252426667> (DF) (ttl 64, id 554, len 104)
  1331	16:07:15.305108 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252426768 2316303> (DF) (ttl 49, id 16560, len 52)
  1332	16:07:16.231649 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16561, len 1500)
  1333	16:07:16.232439 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2316415 252426860> (DF) (ttl 64, id 555, len 52)
  1334	16:07:16.240513 clustera.icq.com.http > 172.16.183.2.1046: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16562, len 1500)
  1335	16:07:16.249196 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2316417 252426860> (DF) (ttl 64, id 556, len 52)
  1336	16:07:16.249339 clustera.icq.com.http > 172.16.183.2.1046: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252426860 2316303> (DF) (ttl 49, id 16563, len 1477)
  1337	16:07:16.259172 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2316418 252426860> (DF) (ttl 64, id 557, len 52)
  1338	16:07:16.260220 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252426863 2316415> (DF) (ttl 49, id 16564, len 1500)
  1339	16:07:16.268863 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252426863 2316415> (DF) (ttl 49, id 16565, len 1500)
  1340	16:07:16.269722 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2316419 252426863> (DF) (ttl 64, id 558, len 52)
  1341	16:07:16.276780 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252426864 2316417> (DF) (ttl 49, id 16566, len 1252)
  1342	16:07:16.279192 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 30408 <nop,nop,timestamp 2316420 252426863> (DF) (ttl 64, id 559, len 52)
  1343	16:07:16.285866 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252426864 2316417> (DF) (ttl 49, id 16567, len 1500)
  1344	16:07:16.289175 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 30408 <nop,nop,timestamp 2316421 252426864> (DF) (ttl 64, id 560, len 52)
  1345	16:07:16.294697 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252426865 2316418> (DF) (ttl 49, id 16568, len 1500)
  1346	16:07:16.299174 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 30408 <nop,nop,timestamp 2316422 252426865> (DF) (ttl 64, id 561, len 52)
  1347	16:07:16.301900 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252426865 2316418> (DF) (ttl 49, id 16569, len 1252)
  1348	16:07:16.309181 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 30408 <nop,nop,timestamp 2316423 252426865> (DF) (ttl 64, id 562, len 52)
  1349	16:07:16.311004 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252426866 2316419> (DF) (ttl 49, id 16570, len 1500)
  1350	16:07:16.319194 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2316424 252426866> (DF) (ttl 64, id 563, len 52)
  1351	16:07:16.319839 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252426866 2316419> (DF) (ttl 49, id 16571, len 1500)
  1352	16:07:16.327041 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16572, len 1252)
  1353	16:07:16.329183 172.16.183.2.1046 > clustera.icq.com.http: . [tcp sum ok] ack 16610 win 30408 <nop,nop,timestamp 2316425 252426866> (DF) (ttl 64, id 564, len 52)
  1354	16:07:16.331686 172.16.183.2.1046 > clustera.icq.com.http: P [bad tcp cksum ee28!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1355	16:07:16.331686 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2316425 252426866> (DF) (ttl 64, id 565, len 52)
  1356	16:07:16.336088 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16573, len 1500)
  1357	16:07:16.336887 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 566, len 40)
  1358	16:07:16.344965 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252426867 2316420> (DF) (ttl 49, id 16574, len 1500)
  1359	16:07:16.345720 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 567, len 40)
  1360	16:07:16.352149 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252426868 2316421> (DF) (ttl 49, id 16575, len 1252)
  1361	16:07:16.352889 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 568, len 40)
  1362	16:07:16.361212 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252426868 2316421> (DF) (ttl 49, id 16576, len 1500)
  1363	16:07:16.361947 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 569, len 40)
  1364	16:07:16.370080 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252426869 2316422> (DF) (ttl 49, id 16577, len 1500)
  1365	16:07:16.370816 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 570, len 40)
  1366	16:07:16.377042 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252426869 2316422> (DF) (ttl 49, id 16578, len 1252)
  1367	16:07:16.377737 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 571, len 40)
  1368	16:07:16.386348 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252426870 2316423> (DF) (ttl 49, id 16579, len 1500)
  1369	16:07:16.387046 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 572, len 40)
  1370	16:07:16.395224 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252426870 2316423> (DF) (ttl 49, id 16580, len 1500)
  1371	16:07:16.395956 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 573, len 40)
  1372	16:07:16.402403 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 27698:28898(1200) ack 53 win 24616 <nop,nop,timestamp 252426871 2316424> (DF) (ttl 49, id 16581, len 1252)
  1373	16:07:16.403166 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 574, len 40)
  1374	16:07:16.411235 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 28898:30346(1448) ack 53 win 24616 <nop,nop,timestamp 252426871 2316424> (DF) (ttl 49, id 16582, len 1500)
  1375	16:07:16.411987 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 575, len 40)
  1376	16:07:16.420342 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 30346:31794(1448) ack 53 win 24616 <nop,nop,timestamp 252426872 2316425> (DF) (ttl 49, id 16583, len 1500)
  1377	16:07:16.421077 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 576, len 40)
  1378	16:07:16.427298 clustera.icq.com.http > 172.16.183.2.1046: . [tcp sum ok] 31794:32994(1200) ack 53 win 24616 <nop,nop,timestamp 252426872 2316425> (DF) (ttl 49, id 16584, len 1252)
  1379	16:07:16.428098 172.16.183.2.1046 > clustera.icq.com.http: R [tcp sum ok] 659617515:659617515(0) win 0 (ttl 255, id 577, len 40)
  1380	16:07:18.337287 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50744+ A? web.icq.com. [|domain] (ttl 64, id 578, len 57)
  1381	16:07:18.349897 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50744 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (189) (ttl 61, id 9271, len 217)
  1382	16:07:18.350977 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2316626 0,nop,wscale 0> (DF) (ttl 64, id 579, len 60)
  1383	16:07:21.354948 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2316926 0,nop,wscale 0> (DF) (ttl 64, id 580, len 60)
  1384	16:07:27.355294 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2317526 0,nop,wscale 0> (DF) (ttl 64, id 581, len 60)
  1385	16:07:39.345296 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2318726 0,nop,wscale 0> (DF) (ttl 64, id 582, len 60)
  1386	16:08:03.365057 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2321126 0,nop,wscale 0> (DF) (ttl 64, id 583, len 60)
  1387	16:08:51.355222 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2325926 0,nop,wscale 0> (DF) (ttl 64, id 584, len 60)
  1388	16:10:27.345208 172.16.183.2.1047 > clusterb.icq.com.http: S [tcp sum ok] 852933308:852933308(0) win 32120 <mss 1460,sackOK,timestamp 2335526 0,nop,wscale 0> (DF) (ttl 64, id 585, len 60)
  1389	16:10:27.362622 clusterb.icq.com.http > 172.16.183.2.1047: S [tcp sum ok] 3116560542:3116560542(0) ack 852933309 win 65535 <nop,nop,timestamp 502652418 2335526,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 44053, len 64)
  1390	16:10:27.363146 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2335527 502652418> (DF) (ttl 64, id 586, len 52)
  1391	16:10:28.355443 172.16.183.2.1047 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2335627 502652418> (DF) (ttl 64, id 587, len 104)
  1392	16:10:28.465644 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502652529 2335627> (DF) (ttl 240, id 44054, len 52)
  1393	16:10:29.125383 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502652592 2335627> (DF) (ttl 240, id 44055, len 1500)
  1394	16:10:29.126201 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2335711 502652592> (DF) (ttl 64, id 588, len 52)
  1395	16:10:29.142865 clusterb.icq.com.http > 172.16.183.2.1047: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502652592 2335627> (DF) (ttl 240, id 44056, len 1500)
  1396	16:10:29.145047 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2335713 502652592> (DF) (ttl 64, id 589, len 52)
  1397	16:10:29.159850 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502652597 2335711> (DF) (ttl 240, id 44057, len 1477)
  1398	16:10:29.174919 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502652597 2335711> (DF) (ttl 240, id 44058, len 1500)
  1399	16:10:29.175837 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2335716 502652597> (DF) (ttl 64, id 590, len 52)
  1400	16:10:29.190167 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 502652598 2335713> (DF) (ttl 240, id 44059, len 1500)
  1401	16:10:29.190922 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2335717 502652597> (DF) (ttl 64, id 591, len 52)
  1402	16:10:29.202774 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 502652598 2335713> (DF) (ttl 240, id 44060, len 1252)
  1403	16:10:29.214915 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2335720 502652598> (DF) (ttl 64, id 592, len 52)
  1404	16:10:29.217760 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 502652601 2335716> (DF) (ttl 240, id 44061, len 1500)
  1405	16:10:29.232790 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 502652601 2335716> (DF) (ttl 240, id 44062, len 1500)
  1406	16:10:29.233501 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2335721 502652601> (DF) (ttl 64, id 593, len 52)
  1407	16:10:29.244432 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44063, len 1252)
  1408	16:10:29.258415 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44064, len 1500)
  1409	16:10:29.271465 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 502652603 2335717> (DF) (ttl 240, id 44065, len 1500)
  1410	16:10:29.272206 172.16.183.2.1047 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2335725 502652603> (DF) (ttl 64, id 594, len 52)
  1411	16:10:29.276382 172.16.183.2.1047 > clusterb.icq.com.http: P [bad tcp cksum f489!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1412	16:10:29.276382 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2335725 502652603> (DF) (ttl 64, id 595, len 52)
  1413	16:10:29.282336 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 502652605 2335720> (DF) (ttl 240, id 44066, len 1252)
  1414	16:10:29.283127 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 596, len 40)
  1415	16:10:29.295862 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 502652605 2335720> (DF) (ttl 240, id 44067, len 1500)
  1416	16:10:29.296667 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 597, len 40)
  1417	16:10:29.309394 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44068, len 1500)
  1418	16:10:29.310114 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 598, len 40)
  1419	16:10:29.320289 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44069, len 1252)
  1420	16:10:29.321025 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 599, len 40)
  1421	16:10:29.333289 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 502652607 2335721> (DF) (ttl 240, id 44070, len 1500)
  1422	16:10:29.334046 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 600, len 40)
  1423	16:10:29.345855 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44071, len 1500)
  1424	16:10:29.346668 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 601, len 40)
  1425	16:10:29.355516 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44072, len 1252)
  1426	16:10:29.356297 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 602, len 40)
  1427	16:10:29.367796 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44073, len 1500)
  1428	16:10:29.368592 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 603, len 40)
  1429	16:10:29.379618 clusterb.icq.com.http > 172.16.183.2.1047: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 502652611 2335725> (DF) (ttl 240, id 44074, len 1500)
  1430	16:10:29.380414 172.16.183.2.1047 > clusterb.icq.com.http: R [tcp sum ok] 852933361:852933361(0) win 0 (ttl 255, id 604, len 40)
  1431	16:10:31.277357 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50745+ A? web.icq.com. [|domain] (ttl 64, id 605, len 57)
  1432	16:10:31.298336 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50745* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 26750, len 233)
  1433	16:10:31.299306 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2335927 0,nop,wscale 0> (DF) (ttl 64, id 606, len 60)
  1434	16:10:34.307000 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2336227 0,nop,wscale 0> (DF) (ttl 64, id 607, len 60)
  1435	16:10:40.295372 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2336827 0,nop,wscale 0> (DF) (ttl 64, id 608, len 60)
  1436	16:10:52.355292 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2338027 0,nop,wscale 0> (DF) (ttl 64, id 609, len 60)
  1437	16:11:16.375004 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2340427 0,nop,wscale 0> (DF) (ttl 64, id 610, len 60)
  1438	16:12:04.465149 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2345227 0,nop,wscale 0> (DF) (ttl 64, id 611, len 60)
  1439	16:13:40.455172 172.16.183.2.1048 > clustera.icq.com.http: S [tcp sum ok] 1071854659:1071854659(0) win 32120 <mss 1460,sackOK,timestamp 2354827 0,nop,wscale 0> (DF) (ttl 64, id 612, len 60)
  1440	16:13:40.472680 clustera.icq.com.http > 172.16.183.2.1048: S [tcp sum ok] 65291330:65291330(0) ack 1071854660 win 65535 <nop,nop,timestamp 17257910 2354827,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 22813, len 64)
  1441	16:13:40.473354 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2354828 17257910> (DF) (ttl 64, id 613, len 52)
  1442	16:13:41.465449 172.16.183.2.1048 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2354928 17257910> (DF) (ttl 64, id 614, len 104)
  1443	16:13:41.504486 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17258013 2354928> (DF) (ttl 240, id 22814, len 52)
  1444	16:13:42.087355 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17258069 2354928> (DF) (ttl 240, id 22815, len 1500)
  1445	16:13:42.088136 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2355013 17258069> (DF) (ttl 64, id 615, len 52)
  1446	16:13:42.107805 clustera.icq.com.http > 172.16.183.2.1048: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17258069 2354928> (DF) (ttl 240, id 22816, len 1500)
  1447	16:13:42.124924 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2355017 17258069> (DF) (ttl 64, id 616, len 52)
  1448	16:13:42.134880 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17258074 2355013> (DF) (ttl 240, id 22817, len 1477)
  1449	16:13:42.152145 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17258074 2355013> (DF) (ttl 240, id 22818, len 1500)
  1450	16:13:42.169637 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17258077 2355017> (DF) (ttl 240, id 22819, len 1500)
  1451	16:13:42.170409 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2355021 17258074> (DF) (ttl 64, id 617, len 52)
  1452	16:13:42.183978 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17258077 2355017> (DF) (ttl 240, id 22820, len 1252)
  1453	16:13:42.205357 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22821, len 1500)
  1454	16:13:42.214928 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2355026 17258077> (DF) (ttl 64, id 618, len 52)
  1455	16:13:42.220143 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22822, len 1500)
  1456	16:13:42.233009 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22823, len 1252)
  1457	16:13:42.235739 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2355028 17258081> (DF) (ttl 64, id 619, len 52)
  1458	16:13:42.248471 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17258081 2355021> (DF) (ttl 240, id 22824, len 1500)
  1459	16:13:42.263745 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22825, len 1500)
  1460	16:13:42.264559 172.16.183.2.1048 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2355031 17258081> (DF) (ttl 64, id 620, len 52)
  1461	16:13:42.275874 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22826, len 1252)
  1462	16:13:42.277946 172.16.183.2.1048 > clustera.icq.com.http: P [bad tcp cksum a61!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1463	16:13:42.277946 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2355032 17258086> (DF) (ttl 64, id 621, len 52)
  1464	16:13:42.291334 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17258086 2355026> (DF) (ttl 240, id 22827, len 1500)
  1465	16:13:42.292188 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 622, len 40)
  1466	16:13:42.304648 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22828, len 1500)
  1467	16:13:42.305835 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 623, len 40)
  1468	16:13:42.316021 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22829, len 1252)
  1469	16:13:42.316728 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 624, len 40)
  1470	16:13:42.330012 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17258088 2355028> (DF) (ttl 240, id 22830, len 1500)
  1471	16:13:42.330726 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 625, len 40)
  1472	16:13:42.343308 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22831, len 1500)
  1473	16:13:42.344042 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 626, len 40)
  1474	16:13:42.353946 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22832, len 1252)
  1475	16:13:42.354939 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 627, len 40)
  1476	16:13:42.367699 clustera.icq.com.http > 172.16.183.2.1048: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17258091 2355031> (DF) (ttl 240, id 22833, len 1500)
  1477	16:13:42.368450 172.16.183.2.1048 > clustera.icq.com.http: R [tcp sum ok] 1071854712:1071854712(0) win 0 (ttl 255, id 628, len 40)
  1478	16:13:44.287578 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50746+ A? web.icq.com. [|domain] (ttl 64, id 629, len 57)
  1479	16:13:44.334469 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50746 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 42583, len 244)
  1480	16:13:44.335984 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2355236 0,nop,wscale 0> (DF) (ttl 64, id 630, len 60)
  1481	16:13:47.335362 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2355536 0,nop,wscale 0> (DF) (ttl 64, id 631, len 60)
  1482	16:13:53.315161 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2356136 0,nop,wscale 0> (DF) (ttl 64, id 632, len 60)
  1483	16:14:05.315069 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2357336 0,nop,wscale 0> (DF) (ttl 64, id 633, len 60)
  1484	16:14:29.315090 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2359736 0,nop,wscale 0> (DF) (ttl 64, id 634, len 60)
  1485	16:15:17.315322 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2364536 0,nop,wscale 0> (DF) (ttl 64, id 635, len 60)
  1486	16:16:53.365237 172.16.183.2.1049 > clusterb.icq.com.http: S [tcp sum ok] 1267988835:1267988835(0) win 32120 <mss 1460,sackOK,timestamp 2374136 0,nop,wscale 0> (DF) (ttl 64, id 636, len 60)
  1487	16:16:53.383644 clusterb.icq.com.http > 172.16.183.2.1049: S [tcp sum ok] 3516591145:3516591145(0) ack 1267988836 win 65535 <nop,nop,timestamp 501261818 2374136,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 31685, len 64)
  1488	16:16:53.384579 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2374137 501261818> (DF) (ttl 64, id 637, len 52)
  1489	16:16:54.385509 172.16.183.2.1049 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2374237 501261818> (DF) (ttl 64, id 638, len 104)
  1490	16:16:54.407578 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501261920 2374237> (DF) (ttl 240, id 31686, len 52)
  1491	16:16:55.450176 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501262022 2374237> (DF) (ttl 240, id 31687, len 1500)
  1492	16:16:55.450919 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2374355 501262022> (DF) (ttl 64, id 639, len 52)
  1493	16:16:55.470122 clusterb.icq.com.http > 172.16.183.2.1049: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501262022 2374237> (DF) (ttl 240, id 31688, len 1500)
  1494	16:16:55.484014 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2374359 501262022> (DF) (ttl 64, id 640, len 52)
  1495	16:16:55.487357 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501262026 2374355> (DF) (ttl 240, id 31689, len 1477)
  1496	16:16:55.504633 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501262026 2374355> (DF) (ttl 240, id 31690, len 1500)
  1497	16:16:55.514014 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2374362 501262026> (DF) (ttl 64, id 641, len 52)
  1498	16:16:55.521861 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501262030 2374359> (DF) (ttl 240, id 31691, len 1500)
  1499	16:16:55.536442 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501262030 2374359> (DF) (ttl 240, id 31692, len 1252)
  1500	16:16:55.553903 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31693, len 1500)
  1501	16:16:55.555040 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2374366 501262030> (DF) (ttl 64, id 642, len 52)
  1502	16:16:55.570146 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31694, len 1500)
  1503	16:16:55.570896 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2374367 501262033> (DF) (ttl 64, id 643, len 52)
  1504	16:16:55.582267 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501262033 2374362> (DF) (ttl 240, id 31695, len 1252)
  1505	16:16:55.597498 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31696, len 1500)
  1506	16:16:55.613015 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31697, len 1500)
  1507	16:16:55.613796 172.16.183.2.1049 > clusterb.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2374372 501262033> (DF) (ttl 64, id 644, len 52)
  1508	16:16:55.616382 172.16.183.2.1049 > clusterb.icq.com.http: P [bad tcp cksum 291f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1509	16:16:55.616382 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2374372 501262037> (DF) (ttl 64, id 645, len 52)
  1510	16:16:55.625127 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501262037 2374366> (DF) (ttl 240, id 31698, len 1252)
  1511	16:16:55.625937 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 646, len 40)
  1512	16:16:55.640357 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31699, len 1500)
  1513	16:16:55.641161 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 647, len 40)
  1514	16:16:55.655378 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31700, len 1500)
  1515	16:16:55.656166 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 648, len 40)
  1516	16:16:55.666759 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501262038 2374367> (DF) (ttl 240, id 31701, len 1252)
  1517	16:16:55.667496 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 649, len 40)
  1518	16:16:55.680512 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31702, len 1500)
  1519	16:16:55.681280 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 650, len 40)
  1520	16:16:55.693577 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31703, len 1500)
  1521	16:16:55.694340 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 651, len 40)
  1522	16:16:55.704717 clusterb.icq.com.http > 172.16.183.2.1049: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501262043 2374372> (DF) (ttl 240, id 31704, len 1252)
  1523	16:16:55.705575 172.16.183.2.1049 > clusterb.icq.com.http: R [tcp sum ok] 1267988888:1267988888(0) win 0 (ttl 255, id 652, len 40)
  1524	16:16:57.647218 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50747+ A? web.icq.com. [|domain] (ttl 64, id 653, len 57)
  1525	16:16:57.663043 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50747 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 57051, len 233)
  1526	16:16:57.664155 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2374574 0,nop,wscale 0> (DF) (ttl 64, id 654, len 60)
  1527	16:17:00.664893 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2374874 0,nop,wscale 0> (DF) (ttl 64, id 655, len 60)
  1528	16:17:06.665159 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2375474 0,nop,wscale 0> (DF) (ttl 64, id 656, len 60)
  1529	16:17:18.665180 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2376674 0,nop,wscale 0> (DF) (ttl 64, id 657, len 60)
  1530	16:17:42.665122 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2379074 0,nop,wscale 0> (DF) (ttl 64, id 658, len 60)
  1531	16:18:30.665242 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2383874 0,nop,wscale 0> (DF) (ttl 64, id 659, len 60)
  1532	16:20:06.645248 172.16.183.2.1050 > clusterb.icq.com.http: S [tcp sum ok] 1464747463:1464747463(0) win 32120 <mss 1460,sackOK,timestamp 2393474 0,nop,wscale 0> (DF) (ttl 64, id 660, len 60)
  1533	16:20:06.670591 clusterb.icq.com.http > 172.16.183.2.1050: S [tcp sum ok] 1408673640:1408673640(0) ack 1464747464 win 65535 <nop,nop,timestamp 501439236 2393474,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 36393, len 64)
  1534	16:20:06.671263 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2393476 501439236> (DF) (ttl 64, id 661, len 52)
  1535	16:20:07.665587 172.16.183.2.1050 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2393576 501439236> (DF) (ttl 64, id 662, len 104)
  1536	16:20:07.687375 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501439338 2393576> (DF) (ttl 240, id 36394, len 52)
  1537	16:20:08.509210 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501439418 2393576> (DF) (ttl 240, id 36395, len 1500)
  1538	16:20:08.510088 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2393668 501439418> (DF) (ttl 64, id 663, len 52)
  1539	16:20:08.526959 clusterb.icq.com.http > 172.16.183.2.1050: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501439418 2393576> (DF) (ttl 240, id 36396, len 1500)
  1540	16:20:08.532295 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2393670 501439418> (DF) (ttl 64, id 664, len 52)
  1541	16:20:08.546394 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501439422 2393668> (DF) (ttl 240, id 36397, len 1477)
  1542	16:20:08.562298 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2393673 501439422> (DF) (ttl 64, id 665, len 52)
  1543	16:20:08.563655 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501439422 2393668> (DF) (ttl 240, id 36398, len 1500)
  1544	16:20:08.580909 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501439424 2393670> (DF) (ttl 240, id 36399, len 1500)
  1545	16:20:08.581672 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2393674 501439422> (DF) (ttl 64, id 666, len 52)
  1546	16:20:08.594495 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501439424 2393670> (DF) (ttl 240, id 36400, len 1252)
  1547	16:20:08.609973 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501439427 2393673> (DF) (ttl 240, id 36401, len 1500)
  1548	16:20:08.622313 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2393679 501439424> (DF) (ttl 64, id 667, len 52)
  1549	16:20:08.624761 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501439427 2393673> (DF) (ttl 240, id 36402, len 1500)
  1550	16:20:08.637622 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36403, len 1252)
  1551	16:20:08.642296 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2393681 501439427> (DF) (ttl 64, id 668, len 52)
  1552	16:20:08.653089 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36404, len 1500)
  1553	16:20:08.668366 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501439429 2393674> (DF) (ttl 240, id 36405, len 1500)
  1554	16:20:08.669060 172.16.183.2.1050 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2393683 501439429> (DF) (ttl 64, id 669, len 52)
  1555	16:20:08.671392 172.16.183.2.1050 > clusterb.icq.com.http: P [bad tcp cksum 6e89!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1556	16:20:08.671392 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2393683 501439429> (DF) (ttl 64, id 670, len 52)
  1557	16:20:08.680484 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36406, len 1252)
  1558	16:20:08.681307 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 671, len 40)
  1559	16:20:08.694960 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36407, len 1500)
  1560	16:20:08.695757 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 672, len 40)
  1561	16:20:08.708014 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501439433 2393679> (DF) (ttl 240, id 36408, len 1500)
  1562	16:20:08.708794 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 673, len 40)
  1563	16:20:08.718901 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36409, len 1252)
  1564	16:20:08.719595 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 674, len 40)
  1565	16:20:08.732675 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36410, len 1500)
  1566	16:20:08.733541 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 675, len 40)
  1567	16:20:08.746467 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501439435 2393681> (DF) (ttl 240, id 36411, len 1500)
  1568	16:20:08.747225 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 676, len 40)
  1569	16:20:08.757276 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36412, len 1252)
  1570	16:20:08.757997 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 677, len 40)
  1571	16:20:08.770601 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36413, len 1500)
  1572	16:20:08.771316 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 678, len 40)
  1573	16:20:08.783406 clusterb.icq.com.http > 172.16.183.2.1050: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501439438 2393683> (DF) (ttl 240, id 36414, len 1500)
  1574	16:20:08.784225 172.16.183.2.1050 > clusterb.icq.com.http: R [tcp sum ok] 1464747516:1464747516(0) win 0 (ttl 255, id 679, len 40)
  1575	16:20:10.677073 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50748+ A? web.icq.com. [|domain] (ttl 64, id 680, len 57)
  1576	16:20:10.689806 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50748 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 7333, len 233)
  1577	16:20:10.690979 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2393885 0,nop,wscale 0> (DF) (ttl 64, id 681, len 60)
  1578	16:20:13.695249 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2394185 0,nop,wscale 0> (DF) (ttl 64, id 682, len 60)
  1579	16:20:19.695459 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2394785 0,nop,wscale 0> (DF) (ttl 64, id 683, len 60)
  1580	16:20:31.695249 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2395985 0,nop,wscale 0> (DF) (ttl 64, id 684, len 60)
  1581	16:20:55.795163 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2398385 0,nop,wscale 0> (DF) (ttl 64, id 685, len 60)
  1582	16:21:43.835257 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2403185 0,nop,wscale 0> (DF) (ttl 64, id 686, len 60)
  1583	16:23:19.895107 172.16.183.2.1051 > clustera.icq.com.http: S [tcp sum ok] 1660991498:1660991498(0) win 32120 <mss 1460,sackOK,timestamp 2412785 0,nop,wscale 0> (DF) (ttl 64, id 687, len 60)
  1584	16:23:19.912931 clustera.icq.com.http > 172.16.183.2.1051: S [tcp sum ok] 2244470900:2244470900(0) ack 1660991499 win 24616 <nop,nop,timestamp 252523231 2412785,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 64695, len 64)
  1585	16:23:19.913705 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2412786 252523231> (DF) (ttl 64, id 688, len 52)
  1586	16:23:20.915374 172.16.183.2.1051 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2412886 252523231> (DF) (ttl 64, id 689, len 104)
  1587	16:23:20.942295 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252523334 2412886> (DF) (ttl 49, id 64696, len 52)
  1588	16:23:21.585251 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64697, len 1500)
  1589	16:23:21.586081 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2412981 252523396> (DF) (ttl 64, id 690, len 52)
  1590	16:23:21.602766 clustera.icq.com.http > 172.16.183.2.1051: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64698, len 1500)
  1591	16:23:21.617753 clustera.icq.com.http > 172.16.183.2.1051: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252523396 2412886> (DF) (ttl 49, id 64699, len 1477)
  1592	16:23:21.620577 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2412985 252523396> (DF) (ttl 64, id 691, len 52)
  1593	16:23:21.634299 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252523401 2412981> (DF) (ttl 49, id 64700, len 1500)
  1594	16:23:21.649312 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252523401 2412981> (DF) (ttl 49, id 64701, len 1500)
  1595	16:23:21.650204 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2412988 252523401> (DF) (ttl 64, id 692, len 52)
  1596	16:23:21.662165 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64702, len 1252)
  1597	16:23:21.677400 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64703, len 1500)
  1598	16:23:21.680571 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2412991 252523404> (DF) (ttl 64, id 693, len 52)
  1599	16:23:21.692678 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252523404 2412985> (DF) (ttl 49, id 64704, len 1500)
  1600	16:23:21.704301 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64705, len 1252)
  1601	16:23:21.717792 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64706, len 1500)
  1602	16:23:21.718596 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2412995 252523404> (DF) (ttl 64, id 694, len 52)
  1603	16:23:21.731353 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252523407 2412988> (DF) (ttl 49, id 64707, len 1500)
  1604	16:23:21.732060 172.16.183.2.1051 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2412996 252523407> (DF) (ttl 64, id 695, len 52)
  1605	16:23:21.741991 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64708, len 1252)
  1606	16:23:21.743119 172.16.183.2.1051 > clustera.icq.com.http: P [bad tcp cksum 994!] 53:104(51) ack 16610 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1607	16:23:21.743119 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 16610 win 31856 <nop,nop,timestamp 2412997 252523410> (DF) (ttl 64, id 696, len 52)
  1608	16:23:21.755479 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64709, len 1500)
  1609	16:23:21.756326 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 697, len 40)
  1610	16:23:21.769035 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252523410 2412991> (DF) (ttl 49, id 64710, len 1500)
  1611	16:23:21.769790 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 698, len 40)
  1612	16:23:21.779924 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64711, len 1252)
  1613	16:23:21.780655 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 699, len 40)
  1614	16:23:21.793684 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64712, len 1500)
  1615	16:23:21.794442 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 700, len 40)
  1616	16:23:21.805737 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252523414 2412995> (DF) (ttl 49, id 64713, len 1500)
  1617	16:23:21.806554 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 701, len 40)
  1618	16:23:21.815880 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64714, len 1252)
  1619	16:23:21.816864 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 702, len 40)
  1620	16:23:21.827671 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64715, len 1500)
  1621	16:23:21.828380 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 703, len 40)
  1622	16:23:21.839988 clustera.icq.com.http > 172.16.183.2.1051: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252523415 2412996> (DF) (ttl 49, id 64716, len 1500)
  1623	16:23:21.840815 172.16.183.2.1051 > clustera.icq.com.http: R [tcp sum ok] 1660991551:1660991551(0) win 0 (ttl 255, id 704, len 40)
  1624	16:23:23.757191 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50749+ A? web.icq.com. [|domain] (ttl 64, id 705, len 57)
  1625	16:23:23.778682 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50749* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 30338, len 233)
  1626	16:23:23.780106 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2413200 0,nop,wscale 0> (DF) (ttl 64, id 706, len 60)
  1627	16:23:26.785128 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2413500 0,nop,wscale 0> (DF) (ttl 64, id 707, len 60)
  1628	16:23:32.785291 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2414100 0,nop,wscale 0> (DF) (ttl 64, id 708, len 60)
  1629	16:23:44.775406 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2415300 0,nop,wscale 0> (DF) (ttl 64, id 709, len 60)
  1630	16:24:08.765229 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2417700 0,nop,wscale 0> (DF) (ttl 64, id 710, len 60)
  1631	16:24:56.755483 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2422500 0,nop,wscale 0> (DF) (ttl 64, id 711, len 60)
  1632	16:26:13.699933 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62318, len 48)
  1633	16:26:13.700847 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 2694365744 win 0 (ttl 255, id 712, len 40)
  1634	16:26:14.305254 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62332, len 48)
  1635	16:26:14.305467 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 1 win 0 (ttl 255, id 713, len 40)
  1636	16:26:14.911331 AOrleans-101-1-4-253.abo.wanadoo.fr.1717 > 172.16.183.2.http: S [tcp sum ok] 2694365743:2694365743(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl 105, id 62343, len 48)
  1637	16:26:14.911544 172.16.183.2.http > AOrleans-101-1-4-253.abo.wanadoo.fr.1717: R [tcp sum ok] 0:0(0) ack 1 win 0 (ttl 255, id 714, len 40)
  1638	16:26:32.805360 172.16.183.2.1052 > clusterc.icq.com.http: S [tcp sum ok] 1869426067:1869426067(0) win 32120 <mss 1460,sackOK,timestamp 2432100 0,nop,wscale 0> (DF) (ttl 64, id 715, len 60)
  1639	16:26:32.822188 clusterc.icq.com.http > 172.16.183.2.1052: S [tcp sum ok] 2307320426:2307320426(0) ack 1869426068 win 65535 <nop,nop,timestamp 501474729 2432100,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 63643, len 64)
  1640	16:26:32.823113 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2432101 501474729> (DF) (ttl 64, id 716, len 52)
  1641	16:26:33.815609 172.16.183.2.1052 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2432201 501474729> (DF) (ttl 64, id 717, len 104)
  1642	16:26:33.855962 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501474832 2432201> (DF) (ttl 240, id 63644, len 52)
  1643	16:26:34.822686 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501474927 2432201> (DF) (ttl 240, id 63645, len 1500)
  1644	16:26:34.823484 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2432311 501474927> (DF) (ttl 64, id 718, len 52)
  1645	16:26:34.836702 clusterc.icq.com.http > 172.16.183.2.1052: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501474927 2432201> (DF) (ttl 240, id 63646, len 1500)
  1646	16:26:34.838853 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2432313 501474927> (DF) (ttl 64, id 719, len 52)
  1647	16:26:34.858372 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501474930 2432311> (DF) (ttl 240, id 63647, len 1477)
  1648	16:26:34.871697 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501474930 2432311> (DF) (ttl 240, id 63648, len 1500)
  1649	16:26:34.872489 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2432316 501474930> (DF) (ttl 64, id 720, len 52)
  1650	16:26:34.885241 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501474932 2432313> (DF) (ttl 240, id 63649, len 1500)
  1651	16:26:34.885991 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2432317 501474930> (DF) (ttl 64, id 721, len 52)
  1652	16:26:34.896381 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501474932 2432313> (DF) (ttl 240, id 63650, len 1252)
  1653	16:26:34.909152 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501474935 2432316> (DF) (ttl 240, id 63651, len 1500)
  1654	16:26:34.910592 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2432320 501474932> (DF) (ttl 64, id 722, len 52)
  1655	16:26:34.920974 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501474935 2432316> (DF) (ttl 240, id 63652, len 1500)
  1656	16:26:34.921724 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2432321 501474935> (DF) (ttl 64, id 723, len 52)
  1657	16:26:34.931368 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63653, len 1252)
  1658	16:26:34.943648 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63654, len 1500)
  1659	16:26:34.948849 172.16.183.2.1052 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2432324 501474937> (DF) (ttl 64, id 724, len 52)
  1660	16:26:34.955468 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501474937 2432317> (DF) (ttl 240, id 63655, len 1500)
  1661	16:26:34.960179 172.16.183.2.1052 > clusterc.icq.com.http: P [bad tcp cksum cd10!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1662	16:26:34.960179 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2432325 501474937> (DF) (ttl 64, id 725, len 52)
  1663	16:26:34.965352 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501474939 2432320> (DF) (ttl 240, id 63656, len 1252)
  1664	16:26:34.966107 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 726, len 40)
  1665	16:26:34.977618 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501474939 2432320> (DF) (ttl 240, id 63657, len 1500)
  1666	16:26:34.978356 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 727, len 40)
  1667	16:26:34.989690 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63658, len 1500)
  1668	16:26:34.990421 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 728, len 40)
  1669	16:26:34.999345 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63659, len 1252)
  1670	16:26:35.000049 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 729, len 40)
  1671	16:26:35.010388 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501474940 2432321> (DF) (ttl 240, id 63660, len 1500)
  1672	16:26:35.011206 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 730, len 40)
  1673	16:26:35.021233 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63661, len 1500)
  1674	16:26:35.022066 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 731, len 40)
  1675	16:26:35.030633 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63662, len 1252)
  1676	16:26:35.031396 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 732, len 40)
  1677	16:26:35.041681 clusterc.icq.com.http > 172.16.183.2.1052: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501474943 2432324> (DF) (ttl 240, id 63663, len 1500)
  1678	16:26:35.042403 172.16.183.2.1052 > clusterc.icq.com.http: R [tcp sum ok] 1869426120:1869426120(0) win 0 (ttl 255, id 733, len 40)
  1679	16:26:36.967467 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50750+ A? web.icq.com. [|domain] (ttl 64, id 734, len 57)
  1680	16:26:37.004265 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50750 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 58444, len 244)
  1681	16:26:37.005400 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2432528 0,nop,wscale 0> (DF) (ttl 64, id 735, len 60)
  1682	16:26:40.004952 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2432828 0,nop,wscale 0> (DF) (ttl 64, id 736, len 60)
  1683	16:26:45.995260 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2433428 0,nop,wscale 0> (DF) (ttl 64, id 737, len 60)
  1684	16:26:58.065197 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2434628 0,nop,wscale 0> (DF) (ttl 64, id 738, len 60)
  1685	16:27:22.085066 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2437028 0,nop,wscale 0> (DF) (ttl 64, id 739, len 60)
  1686	16:28:10.075085 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2441828 0,nop,wscale 0> (DF) (ttl 64, id 740, len 60)
  1687	16:29:46.055324 172.16.183.2.1053 > clustera.icq.com.http: S [tcp sum ok] 2068930476:2068930476(0) win 32120 <mss 1460,sackOK,timestamp 2451428 0,nop,wscale 0> (DF) (ttl 64, id 741, len 60)
  1688	16:29:46.075130 clustera.icq.com.http > 172.16.183.2.1053: S [tcp sum ok] 2574466656:2574466656(0) ack 2068930477 win 33304 <nop,nop,timestamp 17154225 2451428,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 34539, len 64)
  1689	16:29:46.075684 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2451430 17154225> (DF) (ttl 64, id 742, len 52)
  1690	16:29:47.075632 172.16.183.2.1053 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2451530 17154225> (DF) (ttl 64, id 743, len 104)
  1691	16:29:47.114314 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17154329 2451530> (DF) (ttl 49, id 34540, len 52)
  1692	16:29:48.660747 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34541, len 1500)
  1693	16:29:48.661562 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2451701 17154482> (DF) (ttl 64, id 744, len 52)
  1694	16:29:48.680954 clustera.icq.com.http > 172.16.183.2.1053: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34542, len 1500)
  1695	16:29:48.695761 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2451705 17154482> (DF) (ttl 64, id 745, len 52)
  1696	16:29:48.698192 clustera.icq.com.http > 172.16.183.2.1053: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17154482 2451530> (DF) (ttl 49, id 34543, len 1477)
  1697	16:29:48.715448 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17154486 2451701> (DF) (ttl 49, id 34544, len 1500)
  1698	16:29:48.727586 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2451708 17154482> (DF) (ttl 64, id 746, len 52)
  1699	16:29:48.732676 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17154486 2451701> (DF) (ttl 49, id 34545, len 1500)
  1700	16:29:48.744912 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2451710 17154486> (DF) (ttl 64, id 747, len 52)
  1701	16:29:48.747306 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17154489 2451705> (DF) (ttl 49, id 34546, len 1252)
  1702	16:29:48.764722 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17154489 2451705> (DF) (ttl 49, id 34547, len 1500)
  1703	16:29:48.777119 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2451713 17154489> (DF) (ttl 64, id 748, len 52)
  1704	16:29:48.780720 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34548, len 1500)
  1705	16:29:48.793590 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34549, len 1252)
  1706	16:29:48.794362 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2451715 17154492> (DF) (ttl 64, id 749, len 52)
  1707	16:29:48.809061 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17154492 2451708> (DF) (ttl 49, id 34550, len 1500)
  1708	16:29:48.823852 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17154494 2451710> (DF) (ttl 49, id 34551, len 1500)
  1709	16:29:48.824899 172.16.183.2.1053 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2451717 17154492> (DF) (ttl 64, id 750, len 52)
  1710	16:29:48.832532 172.16.183.2.1053 > clustera.icq.com.http: P [bad tcp cksum 2b6f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1711	16:29:48.832532 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2451718 17154492> (DF) (ttl 64, id 751, len 52)
  1712	16:29:48.836435 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17154494 2451710> (DF) (ttl 49, id 34552, len 1252)
  1713	16:29:48.837244 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 752, len 40)
  1714	16:29:48.851662 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34553, len 1500)
  1715	16:29:48.852438 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 753, len 40)
  1716	16:29:48.866697 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34554, len 1500)
  1717	16:29:48.867440 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 754, len 40)
  1718	16:29:48.878075 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17154497 2451713> (DF) (ttl 49, id 34555, len 1252)
  1719	16:29:48.878805 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 755, len 40)
  1720	16:29:48.891825 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17154499 2451715> (DF) (ttl 49, id 34556, len 1500)
  1721	16:29:48.892593 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 756, len 40)
  1722	16:29:48.905383 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17154499 2451715> (DF) (ttl 49, id 34557, len 1500)
  1723	16:29:48.906162 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 757, len 40)
  1724	16:29:48.916263 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34558, len 1252)
  1725	16:29:48.917093 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 758, len 40)
  1726	16:29:48.929778 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34559, len 1500)
  1727	16:29:48.930553 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 759, len 40)
  1728	16:29:48.943335 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34560, len 1500)
  1729	16:29:48.944113 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 760, len 40)
  1730	16:29:48.954450 clustera.icq.com.http > 172.16.183.2.1053: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 17154502 2451717> (DF) (ttl 49, id 34561, len 1252)
  1731	16:29:48.955458 172.16.183.2.1053 > clustera.icq.com.http: R [tcp sum ok] 2068930529:2068930529(0) win 0 (ttl 255, id 761, len 40)
  1732	16:29:50.837457 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50751+ A? web.icq.com. [|domain] (ttl 64, id 762, len 57)
  1733	16:29:50.851679 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50751 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 9180, len 217)
  1734	16:29:50.852999 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2451920 0,nop,wscale 0> (DF) (ttl 64, id 763, len 60)
  1735	16:29:53.865382 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2452221 0,nop,wscale 0> (DF) (ttl 64, id 764, len 60)
  1736	16:29:59.864847 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2452821 0,nop,wscale 0> (DF) (ttl 64, id 765, len 60)
  1737	16:30:11.865184 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2454021 0,nop,wscale 0> (DF) (ttl 64, id 766, len 60)
  1738	16:30:35.885068 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2456421 0,nop,wscale 0> (DF) (ttl 64, id 767, len 60)
  1739	16:31:23.925086 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2461221 0,nop,wscale 0> (DF) (ttl 64, id 768, len 60)
  1740	16:32:59.945169 172.16.183.2.1054 > clusterc.icq.com.http: S [tcp sum ok] 2301613154:2301613154(0) win 32120 <mss 1460,sackOK,timestamp 2470821 0,nop,wscale 0> (DF) (ttl 64, id 769, len 60)
  1741	16:32:59.961483 clusterc.icq.com.http > 172.16.183.2.1054: S [tcp sum ok] 2546932478:2546932478(0) ack 2301613155 win 65535 <nop,nop,timestamp 25989686 2470821,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 46621, len 64)
  1742	16:32:59.962155 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2470822 25989686> (DF) (ttl 64, id 770, len 52)
  1743	16:33:00.955497 172.16.183.2.1054 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2470922 25989686> (DF) (ttl 64, id 771, len 104)
  1744	16:33:00.975305 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 25989787 2470922> (DF) (ttl 240, id 46622, len 52)
  1745	16:33:02.131721 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 25989901 2470922> (DF) (ttl 240, id 46623, len 1500)
  1746	16:33:02.132488 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2471054 25989901> (DF) (ttl 64, id 772, len 52)
  1747	16:33:02.151446 clusterc.icq.com.http > 172.16.183.2.1054: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 25989901 2470922> (DF) (ttl 240, id 46624, len 1500)
  1748	16:33:02.164924 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2471058 25989901> (DF) (ttl 64, id 773, len 52)
  1749	16:33:02.168897 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 25989905 2471054> (DF) (ttl 240, id 46625, len 1477)
  1750	16:33:02.185930 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 25989905 2471054> (DF) (ttl 240, id 46626, len 1500)
  1751	16:33:02.195397 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2471061 25989905> (DF) (ttl 64, id 774, len 52)
  1752	16:33:02.203409 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 25989908 2471058> (DF) (ttl 240, id 46627, len 1500)
  1753	16:33:02.214911 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2471063 25989908> (DF) (ttl 64, id 775, len 52)
  1754	16:33:02.217501 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 25989908 2471058> (DF) (ttl 240, id 46628, len 1252)
  1755	16:33:02.235449 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46629, len 1500)
  1756	16:33:02.245400 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2471066 25989908> (DF) (ttl 64, id 776, len 52)
  1757	16:33:02.250960 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46630, len 1500)
  1758	16:33:02.263818 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 25989911 2471061> (DF) (ttl 240, id 46631, len 1252)
  1759	16:33:02.264836 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2471068 25989911> (DF) (ttl 64, id 777, len 52)
  1760	16:33:02.279059 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 25989913 2471063> (DF) (ttl 240, id 46632, len 1500)
  1761	16:33:02.294084 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 25989913 2471063> (DF) (ttl 240, id 46633, len 1500)
  1762	16:33:02.295085 172.16.183.2.1054 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2471071 25989911> (DF) (ttl 64, id 778, len 52)
  1763	16:33:02.299452 172.16.183.2.1054 > clusterc.icq.com.http: P [bad tcp cksum 5b11!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1764	16:33:02.299452 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2471071 25989913> (DF) (ttl 64, id 779, len 52)
  1765	16:33:02.306681 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46634, len 1252)
  1766	16:33:02.307421 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 780, len 40)
  1767	16:33:02.321659 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46635, len 1500)
  1768	16:33:02.322467 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 781, len 40)
  1769	16:33:02.336941 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 25989916 2471066> (DF) (ttl 240, id 46636, len 1500)
  1770	16:33:02.337697 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 782, len 40)
  1771	16:33:02.347832 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 25989918 2471068> (DF) (ttl 240, id 46637, len 1252)
  1772	16:33:02.348589 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 783, len 40)
  1773	16:33:02.362058 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 25989918 2471068> (DF) (ttl 240, id 46638, len 1500)
  1774	16:33:02.362833 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 784, len 40)
  1775	16:33:02.375364 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46639, len 1500)
  1776	16:33:02.376107 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 785, len 40)
  1777	16:33:02.386259 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46640, len 1252)
  1778	16:33:02.387041 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 786, len 40)
  1779	16:33:02.399762 clusterc.icq.com.http > 172.16.183.2.1054: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 25989921 2471071> (DF) (ttl 240, id 46641, len 1500)
  1780	16:33:02.400563 172.16.183.2.1054 > clusterc.icq.com.http: R [tcp sum ok] 2301613207:2301613207(0) win 0 (ttl 255, id 787, len 40)
  1781	16:33:04.297062 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50752+ A? web.icq.com. [|domain] (ttl 64, id 788, len 57)
  1782	16:33:04.310350 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50752 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 25330, len 233)
  1783	16:33:04.311337 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2471272 0,nop,wscale 0> (DF) (ttl 64, id 789, len 60)
  1784	16:33:07.325011 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2471572 0,nop,wscale 0> (DF) (ttl 64, id 790, len 60)
  1785	16:33:13.325240 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2472172 0,nop,wscale 0> (DF) (ttl 64, id 791, len 60)
  1786	16:33:25.325197 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2473372 0,nop,wscale 0> (DF) (ttl 64, id 792, len 60)
  1787	16:33:49.325098 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2475772 0,nop,wscale 0> (DF) (ttl 64, id 793, len 60)
  1788	16:34:37.305215 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2480572 0,nop,wscale 0> (DF) (ttl 64, id 794, len 60)
  1789	16:36:13.285038 172.16.183.2.1055 > clustera.icq.com.http: S [tcp sum ok] 2486004080:2486004080(0) win 32120 <mss 1460,sackOK,timestamp 2490172 0,nop,wscale 0> (DF) (ttl 64, id 795, len 60)
  1790	16:36:13.524357 clustera.icq.com.http > 172.16.183.2.1055: S [tcp sum ok] 2296856698:2296856698(0) ack 2486004081 win 33304 <nop,nop,timestamp 17192957 2490172,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 28643, len 64)
  1791	16:36:13.525031 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2490195 17192957> (DF) (ttl 64, id 796, len 52)
  1792	16:36:14.525400 172.16.183.2.1055 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2490295 17192957> (DF) (ttl 64, id 797, len 104)
  1793	16:36:14.623450 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17193089 2490295> (DF) (ttl 49, id 28644, len 52)
  1794	16:36:15.228224 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28645, len 1500)
  1795	16:36:15.228996 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2490370 17193147> (DF) (ttl 64, id 798, len 52)
  1796	16:36:15.248168 clustera.icq.com.http > 172.16.183.2.1055: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28646, len 1500)
  1797	16:36:15.263665 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2490374 17193147> (DF) (ttl 64, id 799, len 52)
  1798	16:36:15.265402 clustera.icq.com.http > 172.16.183.2.1055: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17193147 2490295> (DF) (ttl 49, id 28647, len 1477)
  1799	16:36:15.282663 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17193151 2490370> (DF) (ttl 49, id 28648, len 1500)
  1800	16:36:15.293669 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2490377 17193147> (DF) (ttl 64, id 800, len 52)
  1801	16:36:15.300158 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17193151 2490370> (DF) (ttl 49, id 28649, len 1500)
  1802	16:36:15.314500 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17193155 2490374> (DF) (ttl 49, id 28650, len 1252)
  1803	16:36:15.331949 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17193155 2490374> (DF) (ttl 49, id 28651, len 1500)
  1804	16:36:15.332749 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2490381 17193151> (DF) (ttl 64, id 801, len 52)
  1805	16:36:15.348441 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28652, len 1500)
  1806	16:36:15.360844 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28653, len 1252)
  1807	16:36:15.361596 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2490384 17193158> (DF) (ttl 64, id 802, len 52)
  1808	16:36:15.376042 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17193158 2490377> (DF) (ttl 49, id 28654, len 1500)
  1809	16:36:15.391318 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28655, len 1500)
  1810	16:36:15.392068 172.16.183.2.1055 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2490386 17193158> (DF) (ttl 64, id 803, len 52)
  1811	16:36:15.396910 172.16.183.2.1055 > clustera.icq.com.http: P [bad tcp cksum f95a!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1812	16:36:15.396910 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2490387 17193158> (DF) (ttl 64, id 804, len 52)
  1813	16:36:15.403672 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28656, len 1252)
  1814	16:36:15.404415 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 805, len 40)
  1815	16:36:15.418927 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28657, len 1500)
  1816	16:36:15.419740 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 806, len 40)
  1817	16:36:15.433920 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17193162 2490381> (DF) (ttl 49, id 28658, len 1500)
  1818	16:36:15.434922 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 807, len 40)
  1819	16:36:15.445304 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17193165 2490384> (DF) (ttl 49, id 28659, len 1252)
  1820	16:36:15.446026 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 808, len 40)
  1821	16:36:15.458816 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17193165 2490384> (DF) (ttl 49, id 28660, len 1500)
  1822	16:36:15.459525 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 809, len 40)
  1823	16:36:15.472365 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28661, len 1500)
  1824	16:36:15.473192 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 810, len 40)
  1825	16:36:15.483488 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28662, len 1252)
  1826	16:36:15.484289 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 811, len 40)
  1827	16:36:15.497004 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28663, len 1500)
  1828	16:36:15.497809 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 812, len 40)
  1829	16:36:15.510302 clustera.icq.com.http > 172.16.183.2.1055: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17193167 2490386> (DF) (ttl 49, id 28664, len 1500)
  1830	16:36:15.511119 172.16.183.2.1055 > clustera.icq.com.http: R [tcp sum ok] 2486004133:2486004133(0) win 0 (ttl 255, id 813, len 40)
  1831	16:36:17.467309 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50753+ A? web.icq.com. [|domain] (ttl 64, id 814, len 57)
  1832	16:36:17.481996 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50753 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 40519, len 233)
  1833	16:36:17.483098 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2490589 0,nop,wscale 0> (DF) (ttl 64, id 815, len 60)
  1834	16:36:20.484984 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2490889 0,nop,wscale 0> (DF) (ttl 64, id 816, len 60)
  1835	16:36:26.485312 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2491489 0,nop,wscale 0> (DF) (ttl 64, id 817, len 60)
  1836	16:36:38.485248 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2492689 0,nop,wscale 0> (DF) (ttl 64, id 818, len 60)
  1837	16:37:02.555133 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2495089 0,nop,wscale 0> (DF) (ttl 64, id 819, len 60)
  1838	16:37:50.545420 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2499889 0,nop,wscale 0> (DF) (ttl 64, id 820, len 60)
  1839	16:39:26.535351 172.16.183.2.1056 > clustera.icq.com.http: S [tcp sum ok] 2691588670:2691588670(0) win 32120 <mss 1460,sackOK,timestamp 2509489 0,nop,wscale 0> (DF) (ttl 64, id 821, len 60)
  1840	16:39:26.553343 clustera.icq.com.http > 172.16.183.2.1056: S [tcp sum ok] 4039897856:4039897856(0) ack 2691588671 win 65535 <nop,nop,timestamp 501670768 2509489,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 57953, len 64)
  1841	16:39:26.554018 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2509490 501670768> (DF) (ttl 64, id 822, len 52)
  1842	16:39:27.555517 172.16.183.2.1056 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2509590 501670768> (DF) (ttl 64, id 823, len 104)
  1843	16:39:27.576289 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501670871 2509590> (DF) (ttl 240, id 57954, len 52)
  1844	16:39:28.124412 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501670924 2509590> (DF) (ttl 240, id 57955, len 1500)
  1845	16:39:28.125376 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2509666 501670924> (DF) (ttl 64, id 824, len 52)
  1846	16:39:28.141889 clustera.icq.com.http > 172.16.183.2.1056: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501670924 2509590> (DF) (ttl 240, id 57956, len 1500)
  1847	16:39:28.160363 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501670928 2509666> (DF) (ttl 240, id 57957, len 1477)
  1848	16:39:28.162105 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2509670 501670924> (DF) (ttl 64, id 825, len 52)
  1849	16:39:28.175418 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501670928 2509666> (DF) (ttl 240, id 57958, len 1500)
  1850	16:39:28.195126 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57959, len 1500)
  1851	16:39:28.195836 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2509673 501670928> (DF) (ttl 64, id 826, len 52)
  1852	16:39:28.207730 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57960, len 1252)
  1853	16:39:28.221952 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2509676 501670931> (DF) (ttl 64, id 827, len 52)
  1854	16:39:28.222718 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501670931 2509670> (DF) (ttl 240, id 57961, len 1500)
  1855	16:39:28.237988 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57962, len 1500)
  1856	16:39:28.238733 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2509677 501670931> (DF) (ttl 64, id 828, len 52)
  1857	16:39:28.249128 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57963, len 1252)
  1858	16:39:28.261963 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2509680 501670934> (DF) (ttl 64, id 829, len 52)
  1859	16:39:28.262370 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501670934 2509673> (DF) (ttl 240, id 57964, len 1500)
  1860	16:39:28.275712 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501670938 2509676> (DF) (ttl 240, id 57965, len 1500)
  1861	16:39:28.276441 172.16.183.2.1056 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2509681 501670934> (DF) (ttl 64, id 830, len 52)
  1862	16:39:28.279032 172.16.183.2.1056 > clustera.icq.com.http: P [bad tcp cksum 873a!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1863	16:39:28.279032 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2509681 501670934> (DF) (ttl 64, id 831, len 52)
  1864	16:39:28.287051 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501670938 2509676> (DF) (ttl 240, id 57966, len 1252)
  1865	16:39:28.287830 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 832, len 40)
  1866	16:39:28.300800 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57967, len 1500)
  1867	16:39:28.301534 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 833, len 40)
  1868	16:39:28.313849 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57968, len 1500)
  1869	16:39:28.314566 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 834, len 40)
  1870	16:39:28.325240 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501670939 2509677> (DF) (ttl 240, id 57969, len 1252)
  1871	16:39:28.326003 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 835, len 40)
  1872	16:39:28.337749 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501670941 2509680> (DF) (ttl 240, id 57970, len 1500)
  1873	16:39:28.338503 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 836, len 40)
  1874	16:39:28.349579 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501670941 2509680> (DF) (ttl 240, id 57971, len 1500)
  1875	16:39:28.350413 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 837, len 40)
  1876	16:39:28.359483 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57972, len 1252)
  1877	16:39:28.360256 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 838, len 40)
  1878	16:39:28.371516 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57973, len 1500)
  1879	16:39:28.372273 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 839, len 40)
  1880	16:39:28.383576 clustera.icq.com.http > 172.16.183.2.1056: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501670942 2509681> (DF) (ttl 240, id 57974, len 1500)
  1881	16:39:28.384348 172.16.183.2.1056 > clustera.icq.com.http: R [tcp sum ok] 2691588723:2691588723(0) win 0 (ttl 255, id 840, len 40)
  1882	16:39:30.297207 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50754+ A? web.icq.com. [|domain] (ttl 64, id 841, len 57)
  1883	16:39:30.328182 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50754 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (216) (ttl 61, id 54613, len 244)
  1884	16:39:30.329378 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2509885 0,nop,wscale 0> (DF) (ttl 64, id 842, len 60)
  1885	16:39:33.325339 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2510185 0,nop,wscale 0> (DF) (ttl 64, id 843, len 60)
  1886	16:39:39.325384 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2510785 0,nop,wscale 0> (DF) (ttl 64, id 844, len 60)
  1887	16:39:51.315386 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2511985 0,nop,wscale 0> (DF) (ttl 64, id 845, len 60)
  1888	16:40:15.345240 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2514385 0,nop,wscale 0> (DF) (ttl 64, id 846, len 60)
  1889	16:41:03.405130 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2519185 0,nop,wscale 0> (DF) (ttl 64, id 847, len 60)
  1890	16:42:39.475192 172.16.183.2.1057 > clusterb.icq.com.http: S [tcp sum ok] 2885314196:2885314196(0) win 32120 <mss 1460,sackOK,timestamp 2528785 0,nop,wscale 0> (DF) (ttl 64, id 848, len 60)
  1891	16:42:39.494649 clusterb.icq.com.http > 172.16.183.2.1057: S [tcp sum ok] 668554081:668554081(0) ack 2885314197 win 33304 <nop,nop,timestamp 139005000 2528785,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 31441, len 64)
  1892	16:42:39.495660 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2528786 139005000> (DF) (ttl 64, id 849, len 52)
  1893	16:42:40.485686 172.16.183.2.1057 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2528886 139005000> (DF) (ttl 64, id 850, len 104)
  1894	16:42:40.505497 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 139005101 2528886> (DF) (ttl 49, id 31442, len 52)
  1895	16:42:41.002380 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31443, len 1500)
  1896	16:42:41.003160 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2528960 139005149> (DF) (ttl 64, id 851, len 52)
  1897	16:42:41.020357 clusterb.icq.com.http > 172.16.183.2.1057: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31444, len 1500)
  1898	16:42:41.037835 clusterb.icq.com.http > 172.16.183.2.1057: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 139005149 2528886> (DF) (ttl 49, id 31445, len 1477)
  1899	16:42:41.038632 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2528964 139005149> (DF) (ttl 64, id 852, len 52)
  1900	16:42:41.054837 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 139005152 2528960> (DF) (ttl 49, id 31446, len 1500)
  1901	16:42:41.070227 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2528967 139005149> (DF) (ttl 64, id 853, len 52)
  1902	16:42:41.072326 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 139005152 2528960> (DF) (ttl 49, id 31447, len 1500)
  1903	16:42:41.085935 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 139005156 2528964> (DF) (ttl 49, id 31448, len 1252)
  1904	16:42:41.100220 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2528970 139005152> (DF) (ttl 64, id 854, len 52)
  1905	16:42:41.101398 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 139005156 2528964> (DF) (ttl 49, id 31449, len 1500)
  1906	16:42:41.116701 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31450, len 1500)
  1907	16:42:41.117399 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2528971 139005156> (DF) (ttl 64, id 855, len 52)
  1908	16:42:41.129308 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31451, len 1252)
  1909	16:42:41.140217 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2528974 139005159> (DF) (ttl 64, id 856, len 52)
  1910	16:42:41.144531 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 139005159 2528967> (DF) (ttl 49, id 31452, len 1500)
  1911	16:42:41.160301 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31453, len 1500)
  1912	16:42:41.160989 172.16.183.2.1057 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2528976 139005159> (DF) (ttl 64, id 857, len 52)
  1913	16:42:41.163685 172.16.183.2.1057 > clusterb.icq.com.http: P [bad tcp cksum 1593!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1914	16:42:41.163685 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2528976 139005159> (DF) (ttl 64, id 858, len 52)
  1915	16:42:41.172894 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31454, len 1252)
  1916	16:42:41.173708 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 859, len 40)
  1917	16:42:41.186894 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 139005162 2528970> (DF) (ttl 49, id 31455, len 1500)
  1918	16:42:41.187641 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 860, len 40)
  1919	16:42:41.200436 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31456, len 1500)
  1920	16:42:41.201202 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 861, len 40)
  1921	16:42:41.211819 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31457, len 1252)
  1922	16:42:41.212515 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 862, len 40)
  1923	16:42:41.225324 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 139005164 2528971> (DF) (ttl 49, id 31458, len 1500)
  1924	16:42:41.226096 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 863, len 40)
  1925	16:42:41.238627 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 139005166 2528974> (DF) (ttl 49, id 31459, len 1500)
  1926	16:42:41.239425 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 864, len 40)
  1927	16:42:41.250030 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 139005166 2528974> (DF) (ttl 49, id 31460, len 1252)
  1928	16:42:41.250769 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 865, len 40)
  1929	16:42:41.263278 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31461, len 1500)
  1930	16:42:41.264056 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 866, len 40)
  1931	16:42:41.276324 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31462, len 1500)
  1932	16:42:41.277056 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 867, len 40)
  1933	16:42:41.285979 clusterb.icq.com.http > 172.16.183.2.1057: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 139005168 2528976> (DF) (ttl 49, id 31463, len 1252)
  1934	16:42:41.286672 172.16.183.2.1057 > clusterb.icq.com.http: R [tcp sum ok] 2885314249:2885314249(0) win 0 (ttl 255, id 868, len 40)
  1935	16:42:43.166772 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50755+ A? web.icq.com. [|domain] (ttl 64, id 869, len 57)
  1936	16:42:43.179265 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50755 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (189) (ttl 61, id 3560, len 217)
  1937	16:42:43.180305 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2529177 0,nop,wscale 0> (DF) (ttl 64, id 870, len 60)
  1938	16:42:46.185006 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2529477 0,nop,wscale 0> (DF) (ttl 64, id 871, len 60)
  1939	16:42:52.205336 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2530077 0,nop,wscale 0> (DF) (ttl 64, id 872, len 60)
  1940	16:43:04.205152 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2531277 0,nop,wscale 0> (DF) (ttl 64, id 873, len 60)
  1941	16:43:28.245080 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2533677 0,nop,wscale 0> (DF) (ttl 64, id 874, len 60)
  1942	16:44:16.185231 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2538477 0,nop,wscale 0> (DF) (ttl 64, id 875, len 60)
  1943	16:45:52.165158 172.16.183.2.1058 > clusterb.icq.com.http: S [tcp sum ok] 3093563136:3093563136(0) win 32120 <mss 1460,sackOK,timestamp 2548077 0,nop,wscale 0> (DF) (ttl 64, id 876, len 60)
  1944	16:45:52.183604 clusterb.icq.com.http > 172.16.183.2.1058: S [tcp sum ok] 4136000670:4136000670(0) ack 3093563137 win 65535 <nop,nop,timestamp 500987902 2548077,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 45037, len 64)
  1945	16:45:52.183953 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2548078 500987902> (DF) (ttl 64, id 877, len 52)
  1946	16:45:53.185547 172.16.183.2.1058 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2548178 500987902> (DF) (ttl 64, id 878, len 104)
  1947	16:45:53.265439 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 500988010 2548178> (DF) (ttl 240, id 45038, len 52)
  1948	16:45:54.074237 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 500988089 2548178> (DF) (ttl 240, id 45039, len 1500)
  1949	16:45:54.075225 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2548273 500988089> (DF) (ttl 64, id 879, len 52)
  1950	16:45:54.094425 clusterb.icq.com.http > 172.16.183.2.1058: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 500988089 2548178> (DF) (ttl 240, id 45040, len 1500)
  1951	16:45:54.108508 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2548277 500988089> (DF) (ttl 64, id 880, len 52)
  1952	16:45:54.113381 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 500988093 2548273> (DF) (ttl 240, id 45041, len 1477)
  1953	16:45:54.130649 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 500988093 2548273> (DF) (ttl 240, id 45042, len 1500)
  1954	16:45:54.138512 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2548280 500988093> (DF) (ttl 64, id 881, len 52)
  1955	16:45:54.150110 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 500988096 2548277> (DF) (ttl 240, id 45043, len 1500)
  1956	16:45:54.164673 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 500988096 2548277> (DF) (ttl 240, id 45044, len 1252)
  1957	16:45:54.178498 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2548284 500988096> (DF) (ttl 64, id 882, len 52)
  1958	16:45:54.181888 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45045, len 1500)
  1959	16:45:54.197912 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45046, len 1500)
  1960	16:45:54.198619 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2548285 500988099> (DF) (ttl 64, id 883, len 52)
  1961	16:45:54.210266 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 500988099 2548280> (DF) (ttl 240, id 45047, len 1252)
  1962	16:45:54.224948 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2548288 500988099> (DF) (ttl 64, id 884, len 52)
  1963	16:45:54.225732 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 500988103 2548284> (DF) (ttl 240, id 45048, len 1500)
  1964	16:45:54.240788 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 500988104 2548284> (DF) (ttl 240, id 45049, len 1500)
  1965	16:45:54.241539 172.16.183.2.1058 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2548290 500988103> (DF) (ttl 64, id 885, len 52)
  1966	16:45:54.246330 172.16.183.2.1058 > clusterb.icq.com.http: P [bad tcp cksum 530e!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  1967	16:45:54.246330 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2548290 500988103> (DF) (ttl 64, id 886, len 52)
  1968	16:45:54.253118 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 500988104 2548284> (DF) (ttl 240, id 45050, len 1252)
  1969	16:45:54.253893 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 887, len 40)
  1970	16:45:54.268351 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45051, len 1500)
  1971	16:45:54.269150 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 888, len 40)
  1972	16:45:54.283143 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45052, len 1500)
  1973	16:45:54.283885 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 889, len 40)
  1974	16:45:54.294765 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 500988105 2548285> (DF) (ttl 240, id 45053, len 1252)
  1975	16:45:54.295522 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 890, len 40)
  1976	16:45:54.308262 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 500988108 2548288> (DF) (ttl 240, id 45054, len 1500)
  1977	16:45:54.309024 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 891, len 40)
  1978	16:45:54.321561 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 500988108 2548288> (DF) (ttl 240, id 45055, len 1500)
  1979	16:45:54.322360 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 892, len 40)
  1980	16:45:54.332707 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45056, len 1252)
  1981	16:45:54.333411 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 893, len 40)
  1982	16:45:54.346204 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45057, len 1500)
  1983	16:45:54.346951 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 894, len 40)
  1984	16:45:54.359515 clusterb.icq.com.http > 172.16.183.2.1058: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 500988110 2548290> (DF) (ttl 240, id 45058, len 1500)
  1985	16:45:54.360332 172.16.183.2.1058 > clusterb.icq.com.http: R [tcp sum ok] 3093563189:3093563189(0) win 0 (ttl 255, id 895, len 40)
  1986	16:45:56.257559 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50756+ A? web.icq.com. [|domain] (ttl 64, id 896, len 57)
  1987	16:45:56.277251 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50756* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 18958, len 233)
  1988	16:45:56.278246 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2548493 0,nop,wscale 0> (DF) (ttl 64, id 897, len 60)
  1989	16:45:59.284970 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2548793 0,nop,wscale 0> (DF) (ttl 64, id 898, len 60)
  1990	16:46:05.285212 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2549393 0,nop,wscale 0> (DF) (ttl 64, id 899, len 60)
  1991	16:46:17.295241 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2550593 0,nop,wscale 0> (DF) (ttl 64, id 900, len 60)
  1992	16:46:41.365183 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2552993 0,nop,wscale 0> (DF) (ttl 64, id 901, len 60)
  1993	16:47:29.395139 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2557793 0,nop,wscale 0> (DF) (ttl 64, id 902, len 60)
  1994	16:49:05.365112 172.16.183.2.1059 > clusterb.icq.com.http: S [tcp sum ok] 3295016956:3295016956(0) win 32120 <mss 1460,sackOK,timestamp 2567393 0,nop,wscale 0> (DF) (ttl 64, id 903, len 60)
  1995	16:49:05.381622 clusterb.icq.com.http > 172.16.183.2.1059: S [tcp sum ok] 3478682439:3478682439(0) ack 3295016957 win 65535 <nop,nop,timestamp 501007222 2567393,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 41629, len 64)
  1996	16:49:05.382093 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2567394 501007222> (DF) (ttl 64, id 904, len 52)
  1997	16:49:06.375397 172.16.183.2.1059 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2567494 501007222> (DF) (ttl 64, id 905, len 104)
  1998	16:49:06.462216 clusterb.icq.com.http > 172.16.183.2.1059: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501007330 2567494> (DF) (ttl 240, id 41630, len 52)
  1999	16:49:06.784247 clusterb.icq.com.http > 172.16.183.2.1059: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501007362 2567494> (DF) (ttl 240, id 41631, len 391)
  2000	16:49:06.785203 clusterb.icq.com.http > 172.16.183.2.1059: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501007362 2567494> (DF) (ttl 240, id 41632, len 52)
  2001	16:49:06.785686 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2567551 501007362> (DF) (ttl 64, id 906, len 52)
  2002	16:49:06.786067 172.16.183.2.1059 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2567551 501007362> (DF) (ttl 64, id 907, len 52)
  2003	16:49:31.495041 172.16.183.2.1059 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2570022 501007362> (DF) (ttl 64, id 908, len 52)
  2004	16:49:31.511233 172.16.183.2.1059 > clusterb.icq.com.http: P [bad tcp cksum c4f!] 183665824:183665875(51) ack 4111301867 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2005	16:49:31.511233 clusterb.icq.com.http > 172.16.183.2.1059: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501009835 2570022> (DF) (ttl 240, id 41633, len 52)
  2006	16:49:32.497621 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50757+ A? web.icq.com. [|domain] (ttl 64, id 909, len 57)
  2007	16:49:32.537057 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50757 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 34910, len 244)
  2008	16:49:32.538424 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2570126 0,nop,wscale 0> (DF) (ttl 64, id 910, len 60)
  2009	16:49:35.534883 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2570426 0,nop,wscale 0> (DF) (ttl 64, id 911, len 60)
  2010	16:49:41.545256 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2571026 0,nop,wscale 0> (DF) (ttl 64, id 912, len 60)
  2011	16:49:53.535229 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2572226 0,nop,wscale 0> (DF) (ttl 64, id 913, len 60)
  2012	16:50:17.535035 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2574626 0,nop,wscale 0> (DF) (ttl 64, id 914, len 60)
  2013	16:51:05.545058 172.16.183.2.1060 > clustera.icq.com.http: S [tcp sum ok] 3545564270:3545564270(0) win 32120 <mss 1460,sackOK,timestamp 2579426 0,nop,wscale 0> (DF) (ttl 64, id 915, len 60)
  2014	16:51:05.563386 clustera.icq.com.http > 172.16.183.2.1060: S [tcp sum ok] 2630780046:2630780046(0) ack 3545564271 win 65535 <nop,nop,timestamp 200621887 2579426,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 30839, len 64)
  2015	16:51:05.564077 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2579427 200621887> (DF) (ttl 64, id 916, len 52)
  2016	16:51:06.565440 172.16.183.2.1060 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2579527 200621887> (DF) (ttl 64, id 917, len 104)
  2017	16:51:06.604301 clustera.icq.com.http > 172.16.183.2.1060: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 200621991 2579527> (DF) (ttl 240, id 30840, len 52)
  2018	16:51:07.013051 clustera.icq.com.http > 172.16.183.2.1060: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 200622032 2579527> (DF) (ttl 240, id 30841, len 391)
  2019	16:51:07.013499 clustera.icq.com.http > 172.16.183.2.1060: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 200622032 2579527> (DF) (ttl 240, id 30842, len 52)
  2020	16:51:07.014000 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2579576 200622032> (DF) (ttl 64, id 918, len 52)
  2021	16:51:07.014390 172.16.183.2.1060 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2579576 200622032> (DF) (ttl 64, id 919, len 52)
  2022	16:51:32.455540 172.16.183.2.1060 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2582122 200622032> (DF) (ttl 64, id 920, len 52)
  2023	16:51:32.473260 172.16.183.2.1060 > clustera.icq.com.http: P [bad tcp cksum c5d!] 3380183413:3380183464(51) ack 914784278 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2024	16:51:32.473260 clustera.icq.com.http > 172.16.183.2.1060: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 200624578 2582122> (DF) (ttl 240, id 30843, len 52)
  2025	16:51:33.457169 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50758+ A? web.icq.com. [|domain] (ttl 64, id 921, len 57)
  2026	16:51:33.471216 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50758 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 43112, len 233)
  2027	16:51:33.472525 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2582223 0,nop,wscale 0> (DF) (ttl 64, id 922, len 60)
  2028	16:51:36.465289 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2582523 0,nop,wscale 0> (DF) (ttl 64, id 923, len 60)
  2029	16:51:42.465240 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2583123 0,nop,wscale 0> (DF) (ttl 64, id 924, len 60)
  2030	16:51:54.505164 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2584323 0,nop,wscale 0> (DF) (ttl 64, id 925, len 60)
  2031	16:52:18.505193 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2586723 0,nop,wscale 0> (DF) (ttl 64, id 926, len 60)
  2032	16:53:06.495174 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2591523 0,nop,wscale 0> (DF) (ttl 64, id 927, len 60)
  2033	16:54:42.435122 172.16.183.2.1061 > clusterc.icq.com.http: S [tcp sum ok] 3659230079:3659230079(0) win 32120 <mss 1460,sackOK,timestamp 2601123 0,nop,wscale 0> (DF) (ttl 64, id 928, len 60)
  2034	16:54:42.452647 clusterc.icq.com.http > 172.16.183.2.1061: S [tcp sum ok] 4069272869:4069272869(0) ack 3659230080 win 65535 <nop,nop,timestamp 78290753 2601123,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 14475, len 64)
  2035	16:54:42.453595 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2601124 78290753> (DF) (ttl 64, id 929, len 52)
  2036	16:54:43.445944 172.16.183.2.1061 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2601224 78290753> (DF) (ttl 64, id 930, len 104)
  2037	16:54:43.465971 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 78290855 2601224> (DF) (ttl 240, id 14476, len 52)
  2038	16:54:44.059678 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 78290912 2601224> (DF) (ttl 240, id 14477, len 1500)
  2039	16:54:44.060503 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2601289 78290912> (DF) (ttl 64, id 931, len 52)
  2040	16:54:44.077649 clusterc.icq.com.http > 172.16.183.2.1061: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 78290912 2601224> (DF) (ttl 240, id 14478, len 1500)
  2041	16:54:44.083787 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2601291 78290912> (DF) (ttl 64, id 932, len 52)
  2042	16:54:44.096117 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 78290916 2601289> (DF) (ttl 240, id 14479, len 1477)
  2043	16:54:44.113377 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 78290916 2601289> (DF) (ttl 240, id 14480, len 1500)
  2044	16:54:44.114211 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2601294 78290916> (DF) (ttl 64, id 933, len 52)
  2045	16:54:44.130874 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 78290918 2601291> (DF) (ttl 240, id 14481, len 1500)
  2046	16:54:44.131626 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2601295 78290916> (DF) (ttl 64, id 934, len 52)
  2047	16:54:44.144224 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 78290918 2601291> (DF) (ttl 240, id 14482, len 1252)
  2048	16:54:44.159213 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 78290921 2601294> (DF) (ttl 240, id 14483, len 1500)
  2049	16:54:44.173783 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2601300 78290918> (DF) (ttl 64, id 935, len 52)
  2050	16:54:44.174230 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 78290921 2601294> (DF) (ttl 240, id 14484, len 1500)
  2051	16:54:44.187343 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14485, len 1252)
  2052	16:54:44.193792 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2601302 78290921> (DF) (ttl 64, id 936, len 52)
  2053	16:54:44.202805 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14486, len 1500)
  2054	16:54:44.217597 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 78290923 2601295> (DF) (ttl 240, id 14487, len 1500)
  2055	16:54:44.218326 172.16.183.2.1061 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2601304 78290923> (DF) (ttl 64, id 937, len 52)
  2056	16:54:44.222542 172.16.183.2.1061 > clusterc.icq.com.http: P [bad tcp cksum 69bb!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2057	16:54:44.222542 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2601304 78290923> (DF) (ttl 64, id 938, len 52)
  2058	16:54:44.230218 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14488, len 1252)
  2059	16:54:44.230962 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 939, len 40)
  2060	16:54:44.244198 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14489, len 1500)
  2061	16:54:44.245183 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 940, len 40)
  2062	16:54:44.257979 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 78290927 2601300> (DF) (ttl 240, id 14490, len 1500)
  2063	16:54:44.258733 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 941, len 40)
  2064	16:54:44.268872 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14491, len 1252)
  2065	16:54:44.269578 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 942, len 40)
  2066	16:54:44.282872 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14492, len 1500)
  2067	16:54:44.283619 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 943, len 40)
  2068	16:54:44.295929 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 78290929 2601302> (DF) (ttl 240, id 14493, len 1500)
  2069	16:54:44.296708 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 944, len 40)
  2070	16:54:44.307064 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14494, len 1252)
  2071	16:54:44.307770 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 945, len 40)
  2072	16:54:44.320577 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14495, len 1500)
  2073	16:54:44.321316 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 946, len 40)
  2074	16:54:44.333626 clusterc.icq.com.http > 172.16.183.2.1061: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 78290932 2601304> (DF) (ttl 240, id 14496, len 1500)
  2075	16:54:44.334402 172.16.183.2.1061 > clusterc.icq.com.http: R [tcp sum ok] 3659230132:3659230132(0) win 0 (ttl 255, id 947, len 40)
  2076	16:54:46.227633 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50759+ A? web.icq.com. [|domain] (ttl 64, id 948, len 57)
  2077	16:54:46.241250 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50759 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (189) (ttl 61, id 56498, len 217)
  2078	16:54:46.242335 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2601506 0,nop,wscale 0> (DF) (ttl 64, id 949, len 60)
  2079	16:54:49.235347 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2601806 0,nop,wscale 0> (DF) (ttl 64, id 950, len 60)
  2080	16:54:55.234926 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2602406 0,nop,wscale 0> (DF) (ttl 64, id 951, len 60)
  2081	16:55:07.235279 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2603606 0,nop,wscale 0> (DF) (ttl 64, id 952, len 60)
  2082	16:55:31.265174 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2606006 0,nop,wscale 0> (DF) (ttl 64, id 953, len 60)
  2083	16:56:19.325106 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2610806 0,nop,wscale 0> (DF) (ttl 64, id 954, len 60)
  2084	16:57:55.345193 172.16.183.2.1062 > clustera.icq.com.http: S [tcp sum ok] 3881865772:3881865772(0) win 32120 <mss 1460,sackOK,timestamp 2620406 0,nop,wscale 0> (DF) (ttl 64, id 955, len 60)
  2085	16:57:55.362863 clustera.icq.com.http > 172.16.183.2.1062: S [tcp sum ok] 3921083661:3921083661(0) ack 3881865773 win 65535 <nop,nop,timestamp 501513917 2620406,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 62307, len 64)
  2086	16:57:55.363535 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2620407 501513917> (DF) (ttl 64, id 956, len 52)
  2087	16:57:56.355511 172.16.183.2.1062 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2620507 501513917> (DF) (ttl 64, id 957, len 104)
  2088	16:57:56.374476 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501514018 2620507> (DF) (ttl 240, id 62308, len 52)
  2089	16:57:57.057611 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501514084 2620507> (DF) (ttl 240, id 62309, len 1500)
  2090	16:57:57.058377 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2620594 501514084> (DF) (ttl 64, id 958, len 52)
  2091	16:57:57.075596 clustera.icq.com.http > 172.16.183.2.1062: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501514084 2620507> (DF) (ttl 240, id 62310, len 1500)
  2092	16:57:57.092051 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2620598 501514084> (DF) (ttl 64, id 959, len 52)
  2093	16:57:57.092820 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501514088 2620594> (DF) (ttl 240, id 62311, len 1477)
  2094	16:57:57.110092 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501514088 2620594> (DF) (ttl 240, id 62312, len 1500)
  2095	16:57:57.122063 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2620601 501514088> (DF) (ttl 64, id 960, len 52)
  2096	16:57:57.127836 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501514091 2620598> (DF) (ttl 240, id 62313, len 1500)
  2097	16:57:57.141175 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501514091 2620598> (DF) (ttl 240, id 62314, len 1252)
  2098	16:57:57.142064 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2620603 501514091> (DF) (ttl 64, id 961, len 52)
  2099	16:57:57.156164 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62315, len 1500)
  2100	16:57:57.171192 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62316, len 1500)
  2101	16:57:57.172020 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2620606 501514094> (DF) (ttl 64, id 962, len 52)
  2102	16:57:57.184288 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501514094 2620601> (DF) (ttl 240, id 62317, len 1252)
  2103	16:57:57.199765 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62318, len 1500)
  2104	16:57:57.200593 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2620609 501514094> (DF) (ttl 64, id 963, len 52)
  2105	16:57:57.214551 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62319, len 1500)
  2106	16:57:57.215517 172.16.183.2.1062 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2620610 501514096> (DF) (ttl 64, id 964, len 52)
  2107	16:57:57.219965 172.16.183.2.1062 > clustera.icq.com.http: P [bad tcp cksum a2c0!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2108	16:57:57.219965 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2620610 501514096> (DF) (ttl 64, id 965, len 52)
  2109	16:57:57.227150 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501514096 2620603> (DF) (ttl 240, id 62320, len 1252)
  2110	16:57:57.227931 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 966, len 40)
  2111	16:57:57.240899 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62321, len 1500)
  2112	16:57:57.241727 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 967, len 40)
  2113	16:57:57.254227 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62322, len 1500)
  2114	16:57:57.255241 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 968, len 40)
  2115	16:57:57.265576 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501514099 2620606> (DF) (ttl 240, id 62323, len 1252)
  2116	16:57:57.266329 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 969, len 40)
  2117	16:57:57.279324 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501514102 2620609> (DF) (ttl 240, id 62324, len 1500)
  2118	16:57:57.280155 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 970, len 40)
  2119	16:57:57.292632 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501514102 2620609> (DF) (ttl 240, id 62325, len 1500)
  2120	16:57:57.293430 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 971, len 40)
  2121	16:57:57.303782 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62326, len 1252)
  2122	16:57:57.304488 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 972, len 40)
  2123	16:57:57.317271 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62327, len 1500)
  2124	16:57:57.318053 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 973, len 40)
  2125	16:57:57.329830 clustera.icq.com.http > 172.16.183.2.1062: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501514104 2620610> (DF) (ttl 240, id 62328, len 1500)
  2126	16:57:57.330612 172.16.183.2.1062 > clustera.icq.com.http: R [tcp sum ok] 3881865825:3881865825(0) win 0 (ttl 255, id 974, len 40)
  2127	16:57:59.226837 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50760+ A? web.icq.com. [|domain] (ttl 64, id 975, len 57)
  2128	16:57:59.247325 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50760* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 6120, len 233)
  2129	16:57:59.248251 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2620813 0,nop,wscale 0> (DF) (ttl 64, id 976, len 60)
  2130	16:58:02.255277 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2621113 0,nop,wscale 0> (DF) (ttl 64, id 977, len 60)
  2131	16:58:08.254944 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2621713 0,nop,wscale 0> (DF) (ttl 64, id 978, len 60)
  2132	16:58:20.255283 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2622913 0,nop,wscale 0> (DF) (ttl 64, id 979, len 60)
  2133	16:58:44.265239 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2625313 0,nop,wscale 0> (DF) (ttl 64, id 980, len 60)
  2134	16:59:32.265365 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2630113 0,nop,wscale 0> (DF) (ttl 64, id 981, len 60)
  2135	17:01:08.315091 172.16.183.2.1063 > clustera.icq.com.http: S [tcp sum ok] 4067163966:4067163966(0) win 32120 <mss 1460,sackOK,timestamp 2639713 0,nop,wscale 0> (DF) (ttl 64, id 982, len 60)
  2136	17:01:11.693993 clustera.icq.com.http > 172.16.183.2.1063: S [tcp sum ok] 3446771727:3446771727(0) ack 4067163967 win 65535 <nop,nop,timestamp 17543038 2639713,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52676, len 64)
  2137	17:01:11.694340 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2640050 17543038> (DF) (ttl 64, id 983, len 52)
  2138	17:01:12.695367 172.16.183.2.1063 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2640150 17543038> (DF) (ttl 64, id 984, len 104)
  2139	17:01:12.793067 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17543147 2640150> (DF) (ttl 240, id 52677, len 52)
  2140	17:01:13.303744 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17543197 2640150> (DF) (ttl 240, id 52678, len 1500)
  2141	17:01:13.304549 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2640225 17543197> (DF) (ttl 64, id 985, len 52)
  2142	17:01:13.319260 clustera.icq.com.http > 172.16.183.2.1063: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17543197 2640150> (DF) (ttl 240, id 52679, len 1500)
  2143	17:01:13.336559 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2640229 17543197> (DF) (ttl 64, id 986, len 52)
  2144	17:01:13.339192 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17543200 2640225> (DF) (ttl 240, id 52680, len 1477)
  2145	17:01:13.353752 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17543200 2640225> (DF) (ttl 240, id 52681, len 1500)
  2146	17:01:13.369273 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17543203 2640229> (DF) (ttl 240, id 52682, len 1500)
  2147	17:01:13.370032 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2640231 17543200> (DF) (ttl 64, id 987, len 52)
  2148	17:01:13.381906 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17543203 2640229> (DF) (ttl 240, id 52683, len 1252)
  2149	17:01:13.401805 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52684, len 1500)
  2150	17:01:13.410331 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2640236 17543203> (DF) (ttl 64, id 988, len 52)
  2151	17:01:13.415108 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52685, len 1500)
  2152	17:01:13.426725 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52686, len 1252)
  2153	17:01:13.430316 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2640238 17543207> (DF) (ttl 64, id 989, len 52)
  2154	17:01:13.440242 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17543207 2640231> (DF) (ttl 240, id 52687, len 1500)
  2155	17:01:13.453528 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52688, len 1500)
  2156	17:01:13.454226 172.16.183.2.1063 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2640240 17543207> (DF) (ttl 64, id 990, len 52)
  2157	17:01:13.459099 172.16.183.2.1063 > clustera.icq.com.http: P [bad tcp cksum c6d1!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2158	17:01:13.459099 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2640240 17543207> (DF) (ttl 64, id 991, len 52)
  2159	17:01:13.464400 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52689, len 1252)
  2160	17:01:13.465348 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 992, len 40)
  2161	17:01:13.477907 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17543211 2640236> (DF) (ttl 240, id 52690, len 1500)
  2162	17:01:13.478702 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 993, len 40)
  2163	17:01:13.490471 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52691, len 1500)
  2164	17:01:13.491247 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 994, len 40)
  2165	17:01:13.500616 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52692, len 1252)
  2166	17:01:13.501378 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 995, len 40)
  2167	17:01:13.512892 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17543213 2640238> (DF) (ttl 240, id 52693, len 1500)
  2168	17:01:13.513692 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 996, len 40)
  2169	17:01:13.524970 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52694, len 1500)
  2170	17:01:13.525873 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 997, len 40)
  2171	17:01:13.535113 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52695, len 1252)
  2172	17:01:13.535805 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 998, len 40)
  2173	17:01:13.547134 clustera.icq.com.http > 172.16.183.2.1063: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17543215 2640240> (DF) (ttl 240, id 52696, len 1500)
  2174	17:01:13.547885 172.16.183.2.1063 > clustera.icq.com.http: R [tcp sum ok] 4067164019:4067164019(0) win 0 (ttl 255, id 999, len 40)
  2175	17:01:15.457103 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50761+ A? web.icq.com. [|domain] (ttl 64, id 1000, len 57)
  2176	17:01:15.488288 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50761 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 20597, len 244)
  2177	17:01:15.489349 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2640443 0,nop,wscale 0> (DF) (ttl 64, id 1001, len 60)
  2178	17:01:18.545262 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2640743 0,nop,wscale 0> (DF) (ttl 64, id 1002, len 60)
  2179	17:01:24.535008 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2641343 0,nop,wscale 0> (DF) (ttl 64, id 1003, len 60)
  2180	17:01:36.547126 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2642543 0,nop,wscale 0> (DF) (ttl 64, id 1004, len 60)
  2181	17:02:00.615192 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2644943 0,nop,wscale 0> (DF) (ttl 64, id 1005, len 60)
  2182	17:02:48.605170 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2649743 0,nop,wscale 0> (DF) (ttl 64, id 1006, len 60)
  2183	17:04:24.505129 172.16.183.2.1064 > clustera.icq.com.http: S [tcp sum ok] 4285902886:4285902886(0) win 32120 <mss 1460,sackOK,timestamp 2659343 0,nop,wscale 0> (DF) (ttl 64, id 1007, len 60)
  2184	17:04:24.523164 clustera.icq.com.http > 172.16.183.2.1064: S [tcp sum ok] 62751347:62751347(0) ack 4285902887 win 33304 <nop,nop,timestamp 17362118 2659343,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 16317, len 64)
  2185	17:04:24.523834 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2659344 17362118> (DF) (ttl 64, id 1008, len 52)
  2186	17:04:25.526198 172.16.183.2.1064 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2659444 17362118> (DF) (ttl 64, id 1009, len 104)
  2187	17:04:25.544646 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17362220 2659444> (DF) (ttl 49, id 16318, len 52)
  2188	17:04:26.227514 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16319, len 1500)
  2189	17:04:26.228294 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2659524 17362287> (DF) (ttl 64, id 1010, len 52)
  2190	17:04:26.239587 clustera.icq.com.http > 172.16.183.2.1064: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16320, len 1500)
  2191	17:04:26.248602 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2659526 17362287> (DF) (ttl 64, id 1011, len 52)
  2192	17:04:26.251636 clustera.icq.com.http > 172.16.183.2.1064: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17362287 2659444> (DF) (ttl 49, id 16321, len 1477)
  2193	17:04:26.258605 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2659527 17362287> (DF) (ttl 64, id 1012, len 52)
  2194	17:04:26.263483 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17362290 2659524> (DF) (ttl 49, id 16322, len 1500)
  2195	17:04:26.268601 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2659528 17362290> (DF) (ttl 64, id 1013, len 52)
  2196	17:04:26.275801 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17362290 2659524> (DF) (ttl 49, id 16323, len 1500)
  2197	17:04:26.285707 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17362292 2659526> (DF) (ttl 49, id 16324, len 1252)
  2198	17:04:26.297737 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17362292 2659526> (DF) (ttl 49, id 16325, len 1500)
  2199	17:04:26.298635 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2659531 17362290> (DF) (ttl 64, id 1014, len 52)
  2200	17:04:26.310050 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17362293 2659527> (DF) (ttl 49, id 16326, len 1500)
  2201	17:04:26.310797 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2659532 17362292> (DF) (ttl 64, id 1015, len 52)
  2202	17:04:26.318719 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17362293 2659527> (DF) (ttl 49, id 16327, len 1252)
  2203	17:04:26.329757 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17362294 2659528> (DF) (ttl 49, id 16328, len 1500)
  2204	17:04:26.334984 172.16.183.2.1064 > clustera.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2659535 17362293> (DF) (ttl 64, id 1016, len 52)
  2205	17:04:26.340601 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17362294 2659528> (DF) (ttl 49, id 16329, len 1500)
  2206	17:04:26.348348 172.16.183.2.1064 > clustera.icq.com.http: P [bad tcp cksum 23eb!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2207	17:04:26.348348 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2659535 17362294> (DF) (ttl 64, id 1017, len 52)
  2208	17:04:26.350035 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16330, len 1252)
  2209	17:04:26.350806 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1018, len 40)
  2210	17:04:26.361030 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16331, len 1500)
  2211	17:04:26.361812 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1019, len 40)
  2212	17:04:26.372117 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17362297 2659531> (DF) (ttl 49, id 16332, len 1500)
  2213	17:04:26.372858 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1020, len 40)
  2214	17:04:26.381275 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16333, len 1252)
  2215	17:04:26.381977 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1021, len 40)
  2216	17:04:26.392066 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16334, len 1500)
  2217	17:04:26.392808 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1022, len 40)
  2218	17:04:26.402922 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17362298 2659532> (DF) (ttl 49, id 16335, len 1500)
  2219	17:04:26.403653 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1023, len 40)
  2220	17:04:26.411340 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16336, len 1252)
  2221	17:04:26.412036 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1024, len 40)
  2222	17:04:26.421637 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16337, len 1500)
  2223	17:04:26.422337 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1025, len 40)
  2224	17:04:26.431740 clustera.icq.com.http > 172.16.183.2.1064: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 17362301 2659535> (DF) (ttl 49, id 16338, len 1500)
  2225	17:04:26.432482 172.16.183.2.1064 > clustera.icq.com.http: R [tcp sum ok] 4285902939:4285902939(0) win 0 (ttl 255, id 1026, len 40)
  2226	17:04:28.367335 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50762+ A? web.icq.com. [|domain] (ttl 64, id 1027, len 57)
  2227	17:04:28.381504 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50762 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 34094, len 233)
  2228	17:04:28.382736 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2659738 0,nop,wscale 0> (DF) (ttl 64, id 1028, len 60)
  2229	17:04:31.385374 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2660038 0,nop,wscale 0> (DF) (ttl 64, id 1029, len 60)
  2230	17:04:37.375165 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2660638 0,nop,wscale 0> (DF) (ttl 64, id 1030, len 60)
  2231	17:04:49.365355 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2661838 0,nop,wscale 0> (DF) (ttl 64, id 1031, len 60)
  2232	17:05:13.395035 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2664238 0,nop,wscale 0> (DF) (ttl 64, id 1032, len 60)
  2233	17:06:01.385212 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2669038 0,nop,wscale 0> (DF) (ttl 64, id 1033, len 60)
  2234	17:07:37.445196 172.16.183.2.1065 > clusterc.icq.com.http: S [tcp sum ok] 173215837:173215837(0) win 32120 <mss 1460,sackOK,timestamp 2678638 0,nop,wscale 0> (DF) (ttl 64, id 1034, len 60)
  2235	17:07:37.462970 clusterc.icq.com.http > 172.16.183.2.1065: S [tcp sum ok] 3555290910:3555290910(0) ack 173215838 win 65535 <nop,nop,timestamp 26197441 2678638,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 27019, len 64)
  2236	17:07:37.463886 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2678639 26197441> (DF) (ttl 64, id 1035, len 52)
  2237	17:07:38.455507 172.16.183.2.1065 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2678739 26197441> (DF) (ttl 64, id 1036, len 104)
  2238	17:07:38.492300 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 26197544 2678739> (DF) (ttl 240, id 27020, len 52)
  2239	17:07:39.268073 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 26197620 2678739> (DF) (ttl 240, id 27021, len 1500)
  2240	17:07:39.268841 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2678834 26197620> (DF) (ttl 64, id 1037, len 52)
  2241	17:07:39.279896 clusterc.icq.com.http > 172.16.183.2.1065: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 26197620 2678739> (DF) (ttl 240, id 27022, len 1500)
  2242	17:07:39.286873 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2678836 26197620> (DF) (ttl 64, id 1038, len 52)
  2243	17:07:39.300340 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 26197623 2678834> (DF) (ttl 240, id 27023, len 1477)
  2244	17:07:39.311189 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 26197623 2678834> (DF) (ttl 240, id 27024, len 1500)
  2245	17:07:39.316884 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2678839 26197623> (DF) (ttl 64, id 1039, len 52)
  2246	17:07:39.322030 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 26197625 2678836> (DF) (ttl 240, id 27025, len 1500)
  2247	17:07:39.331192 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 26197625 2678836> (DF) (ttl 240, id 27026, len 1252)
  2248	17:07:39.334983 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2678841 26197625> (DF) (ttl 64, id 1040, len 52)
  2249	17:07:39.344675 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27027, len 1500)
  2250	17:07:39.355549 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27028, len 1500)
  2251	17:07:39.356325 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2678843 26197628> (DF) (ttl 64, id 1041, len 52)
  2252	17:07:39.364944 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 26197628 2678839> (DF) (ttl 240, id 27029, len 1252)
  2253	17:07:39.374973 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2678845 26197628> (DF) (ttl 64, id 1042, len 52)
  2254	17:07:39.375748 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 26197629 2678841> (DF) (ttl 240, id 27030, len 1500)
  2255	17:07:39.386807 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 26197629 2678841> (DF) (ttl 240, id 27031, len 1500)
  2256	17:07:39.387584 172.16.183.2.1065 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2678846 26197629> (DF) (ttl 64, id 1043, len 52)
  2257	17:07:39.391990 172.16.183.2.1065 > clusterc.icq.com.http: P [bad tcp cksum f6c2!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2258	17:07:39.391990 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2678846 26197629> (DF) (ttl 64, id 1044, len 52)
  2259	17:07:39.395487 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 26197630 2678841> (DF) (ttl 240, id 27032, len 1252)
  2260	17:07:39.396222 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1045, len 40)
  2261	17:07:39.406024 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27033, len 1500)
  2262	17:07:39.406814 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1046, len 40)
  2263	17:07:39.415887 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27034, len 1500)
  2264	17:07:39.416649 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1047, len 40)
  2265	17:07:39.424050 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 26197632 2678843> (DF) (ttl 240, id 27035, len 1252)
  2266	17:07:39.424971 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1048, len 40)
  2267	17:07:39.434344 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 26197634 2678845> (DF) (ttl 240, id 27036, len 1500)
  2268	17:07:39.435322 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1049, len 40)
  2269	17:07:39.444446 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 26197634 2678845> (DF) (ttl 240, id 27037, len 1500)
  2270	17:07:39.445403 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1050, len 40)
  2271	17:07:39.452623 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27038, len 1252)
  2272	17:07:39.453343 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1051, len 40)
  2273	17:07:39.462450 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27039, len 1500)
  2274	17:07:39.463166 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1052, len 40)
  2275	17:07:39.472793 clusterc.icq.com.http > 172.16.183.2.1065: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 26197635 2678846> (DF) (ttl 240, id 27040, len 1500)
  2276	17:07:39.473574 172.16.183.2.1065 > clusterc.icq.com.http: R [tcp sum ok] 173215890:173215890(0) win 0 (ttl 255, id 1053, len 40)
  2277	17:07:41.396916 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50763+ A? web.icq.com. [|domain] (ttl 64, id 1054, len 57)
  2278	17:07:41.412194 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50763 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (189) (ttl 61, id 49471, len 217)
  2279	17:07:41.413246 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679048 0,nop,wscale 0> (DF) (ttl 64, id 1055, len 60)
  2280	17:07:44.415006 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679348 0,nop,wscale 0> (DF) (ttl 64, id 1056, len 60)
  2281	17:07:50.415399 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2679948 0,nop,wscale 0> (DF) (ttl 64, id 1057, len 60)
  2282	17:08:02.416041 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2681148 0,nop,wscale 0> (DF) (ttl 64, id 1058, len 60)
  2283	17:08:26.435202 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2683548 0,nop,wscale 0> (DF) (ttl 64, id 1059, len 60)
  2284	17:09:14.425074 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2688348 0,nop,wscale 0> (DF) (ttl 64, id 1060, len 60)
  2285	17:10:50.405215 172.16.183.2.1066 > clustera.icq.com.http: S [tcp sum ok] 384122368:384122368(0) win 32120 <mss 1460,sackOK,timestamp 2697948 0,nop,wscale 0> (DF) (ttl 64, id 1061, len 60)
  2286	17:10:50.422706 clustera.icq.com.http > 172.16.183.2.1066: S [tcp sum ok] 2691367641:2691367641(0) ack 384122369 win 65535 <nop,nop,timestamp 501008152 2697948,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 50929, len 64)
  2287	17:10:50.423596 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2697949 501008152> (DF) (ttl 64, id 1062, len 52)
  2288	17:10:51.415805 172.16.183.2.1066 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2698049 501008152> (DF) (ttl 64, id 1063, len 104)
  2289	17:10:51.435797 clustera.icq.com.http > 172.16.183.2.1066: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501008254 2698049> (DF) (ttl 240, id 50930, len 52)
  2290	17:10:51.699439 clustera.icq.com.http > 172.16.183.2.1066: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 501008280 2698049> (DF) (ttl 240, id 50931, len 391)
  2291	17:10:51.700086 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2698077 501008280> (DF) (ttl 64, id 1064, len 52)
  2292	17:10:51.700626 clustera.icq.com.http > 172.16.183.2.1066: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 501008280 2698049> (DF) (ttl 240, id 50932, len 52)
  2293	17:10:51.701046 172.16.183.2.1066 > clustera.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2698077 501008280> (DF) (ttl 64, id 1065, len 52)
  2294	17:11:17.284945 172.16.183.2.1066 > clustera.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2700622 501008280> (DF) (ttl 64, id 1066, len 52)
  2295	17:11:17.302030 172.16.183.2.1066 > clustera.icq.com.http: P [bad tcp cksum 15d!] 2307245614:2307245665(51) ack 1987722077 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2296	17:11:17.302030 clustera.icq.com.http > 172.16.183.2.1066: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 501010840 2700622> (DF) (ttl 240, id 50933, len 52)
  2297	17:11:18.337243 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50764+ A? web.icq.com. [|domain] (ttl 64, id 1067, len 57)
  2298	17:11:18.368748 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50764 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 63844, len 244)
  2299	17:11:18.369837 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2700726 0,nop,wscale 0> (DF) (ttl 64, id 1068, len 60)
  2300	17:11:21.365349 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2701026 0,nop,wscale 0> (DF) (ttl 64, id 1069, len 60)
  2301	17:11:27.375181 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2701626 0,nop,wscale 0> (DF) (ttl 64, id 1070, len 60)
  2302	17:11:39.375305 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2702826 0,nop,wscale 0> (DF) (ttl 64, id 1071, len 60)
  2303	17:12:03.415209 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2705226 0,nop,wscale 0> (DF) (ttl 64, id 1072, len 60)
  2304	17:12:51.405204 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2710026 0,nop,wscale 0> (DF) (ttl 64, id 1073, len 60)
  2305	17:14:27.355371 172.16.183.2.1067 > clusterc.icq.com.http: S [tcp sum ok] 607573270:607573270(0) win 32120 <mss 1460,sackOK,timestamp 2719626 0,nop,wscale 0> (DF) (ttl 64, id 1074, len 60)
  2306	17:14:27.373814 clusterc.icq.com.http > 172.16.183.2.1067: S [tcp sum ok] 769227074:769227074(0) ack 607573271 win 33304 <nop,nop,timestamp 215125235 2719626,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 33151, len 64)
  2307	17:14:27.374994 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2719627 215125235> (DF) (ttl 64, id 1075, len 52)
  2308	17:14:28.375728 172.16.183.2.1067 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2719727 215125235> (DF) (ttl 64, id 1076, len 104)
  2309	17:14:28.396764 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215125338 2719727> (DF) (ttl 49, id 33152, len 52)
  2310	17:14:28.965332 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33153, len 1500)
  2311	17:14:28.966105 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2719816 215125393> (DF) (ttl 64, id 1077, len 52)
  2312	17:14:28.983057 clusterc.icq.com.http > 172.16.183.2.1067: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33154, len 1500)
  2313	17:14:28.994954 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2719820 215125393> (DF) (ttl 64, id 1078, len 52)
  2314	17:14:28.997826 clusterc.icq.com.http > 172.16.183.2.1067: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215125393 2719727> (DF) (ttl 49, id 33155, len 1477)
  2315	17:14:29.012870 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215125396 2719816> (DF) (ttl 49, id 33156, len 1500)
  2316	17:14:29.023227 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2719823 215125393> (DF) (ttl 64, id 1079, len 52)
  2317	17:14:29.028143 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215125396 2719816> (DF) (ttl 49, id 33157, len 1500)
  2318	17:14:29.040516 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215125399 2719820> (DF) (ttl 49, id 33158, len 1252)
  2319	17:14:29.043223 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2719825 215125396> (DF) (ttl 64, id 1080, len 52)
  2320	17:14:29.055740 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215125399 2719820> (DF) (ttl 49, id 33159, len 1500)
  2321	17:14:29.071021 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33160, len 1500)
  2322	17:14:29.071732 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2719827 215125399> (DF) (ttl 64, id 1081, len 52)
  2323	17:14:29.082649 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33161, len 1252)
  2324	17:14:29.094958 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2719830 215125402> (DF) (ttl 64, id 1082, len 52)
  2325	17:14:29.096155 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215125402 2719823> (DF) (ttl 49, id 33162, len 1500)
  2326	17:14:29.109458 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33163, len 1500)
  2327	17:14:29.110244 172.16.183.2.1067 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2719832 215125402> (DF) (ttl 64, id 1083, len 52)
  2328	17:14:29.112614 172.16.183.2.1067 > clusterc.icq.com.http: P [bad tcp cksum 4c7f!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2329	17:14:29.112614 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2719832 215125402> (DF) (ttl 64, id 1084, len 52)
  2330	17:14:29.120813 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33164, len 1252)
  2331	17:14:29.121610 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1085, len 40)
  2332	17:14:29.134309 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215125404 2719825> (DF) (ttl 49, id 33165, len 1500)
  2333	17:14:29.135348 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1086, len 40)
  2334	17:14:29.147615 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33166, len 1500)
  2335	17:14:29.148426 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1087, len 40)
  2336	17:14:29.158517 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33167, len 1252)
  2337	17:14:29.159295 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1088, len 40)
  2338	17:14:29.172006 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215125407 2719827> (DF) (ttl 49, id 33168, len 1500)
  2339	17:14:29.172790 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1089, len 40)
  2340	17:14:29.184829 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215125409 2719830> (DF) (ttl 49, id 33169, len 1500)
  2341	17:14:29.185660 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1090, len 40)
  2342	17:14:29.194234 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215125409 2719830> (DF) (ttl 49, id 33170, len 1252)
  2343	17:14:29.195243 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1091, len 40)
  2344	17:14:29.206506 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33171, len 1500)
  2345	17:14:29.207292 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1092, len 40)
  2346	17:14:29.218584 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33172, len 1500)
  2347	17:14:29.219425 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1093, len 40)
  2348	17:14:29.228485 clusterc.icq.com.http > 172.16.183.2.1067: . [tcp sum ok] 27698:28898(1200) ack 53 win 33304 <nop,nop,timestamp 215125411 2719832> (DF) (ttl 49, id 33173, len 1252)
  2349	17:14:29.229278 172.16.183.2.1067 > clusterc.icq.com.http: R [tcp sum ok] 607573323:607573323(0) win 0 (ttl 255, id 1094, len 40)
  2350	17:14:31.137570 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50765+ A? web.icq.com. [|domain] (ttl 64, id 1095, len 57)
  2351	17:14:31.150112 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50765 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 10467, len 233)
  2352	17:14:31.151470 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720034 0,nop,wscale 0> (DF) (ttl 64, id 1096, len 60)
  2353	17:14:34.154948 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720335 0,nop,wscale 0> (DF) (ttl 64, id 1097, len 60)
  2354	17:14:40.155293 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2720935 0,nop,wscale 0> (DF) (ttl 64, id 1098, len 60)
  2355	17:14:52.145357 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2722135 0,nop,wscale 0> (DF) (ttl 64, id 1099, len 60)
  2356	17:15:16.175180 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2724535 0,nop,wscale 0> (DF) (ttl 64, id 1100, len 60)
  2357	17:16:04.225104 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2729335 0,nop,wscale 0> (DF) (ttl 64, id 1101, len 60)
  2358	17:17:40.295244 172.16.183.2.1068 > clusterb.icq.com.http: S [tcp sum ok] 830779109:830779109(0) win 32120 <mss 1460,sackOK,timestamp 2738935 0,nop,wscale 0> (DF) (ttl 64, id 1102, len 60)
  2359	17:17:40.312619 clusterb.icq.com.http > 172.16.183.2.1068: S [tcp sum ok] 1861741510:1861741510(0) ack 830779110 win 65535 <nop,nop,timestamp 501178718 2738935,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52653, len 64)
  2360	17:17:40.313548 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2738936 501178718> (DF) (ttl 64, id 1103, len 52)
  2361	17:17:41.295391 172.16.183.2.1068 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2739036 501178718> (DF) (ttl 64, id 1104, len 104)
  2362	17:17:41.315859 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501178818 2739036> (DF) (ttl 240, id 52654, len 52)
  2363	17:17:41.806811 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501178865 2739036> (DF) (ttl 240, id 52655, len 1500)
  2364	17:17:41.807637 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2739108 501178865> (DF) (ttl 64, id 1105, len 52)
  2365	17:17:41.827007 clusterb.icq.com.http > 172.16.183.2.1068: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501178865 2739036> (DF) (ttl 240, id 52656, len 1500)
  2366	17:17:41.831502 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2739110 501178865> (DF) (ttl 64, id 1106, len 52)
  2367	17:17:41.844488 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501178869 2739108> (DF) (ttl 240, id 52657, len 1477)
  2368	17:17:41.861495 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2739113 501178869> (DF) (ttl 64, id 1107, len 52)
  2369	17:17:41.861712 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501178869 2739108> (DF) (ttl 240, id 52658, len 1500)
  2370	17:17:41.879003 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501178871 2739110> (DF) (ttl 240, id 52659, len 1500)
  2371	17:17:41.879759 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2739114 501178869> (DF) (ttl 64, id 1108, len 52)
  2372	17:17:41.893575 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501178871 2739110> (DF) (ttl 240, id 52660, len 1252)
  2373	17:17:41.911270 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501178874 2739113> (DF) (ttl 240, id 52661, len 1500)
  2374	17:17:41.921504 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2739119 501178871> (DF) (ttl 64, id 1109, len 52)
  2375	17:17:41.927274 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501178874 2739113> (DF) (ttl 240, id 52662, len 1500)
  2376	17:17:41.940136 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52663, len 1252)
  2377	17:17:41.951496 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2739122 501178874> (DF) (ttl 64, id 1110, len 52)
  2378	17:17:41.955152 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52664, len 1500)
  2379	17:17:41.970151 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501178876 2739114> (DF) (ttl 240, id 52665, len 1500)
  2380	17:17:41.970849 172.16.183.2.1068 > clusterb.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2739123 501178876> (DF) (ttl 64, id 1111, len 52)
  2381	17:17:41.975798 172.16.183.2.1068 > clusterb.icq.com.http: P [bad tcp cksum aae4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2382	17:17:41.975798 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2739124 501178876> (DF) (ttl 64, id 1112, len 52)
  2383	17:17:41.982748 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52666, len 1252)
  2384	17:17:41.983502 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1113, len 40)
  2385	17:17:41.997980 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52667, len 1500)
  2386	17:17:41.998797 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1114, len 40)
  2387	17:17:42.013006 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501178880 2739119> (DF) (ttl 240, id 52668, len 1500)
  2388	17:17:42.013809 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1115, len 40)
  2389	17:17:42.023901 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52669, len 1252)
  2390	17:17:42.024784 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1116, len 40)
  2391	17:17:42.037890 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52670, len 1500)
  2392	17:17:42.038662 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1117, len 40)
  2393	17:17:42.051200 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501178883 2739122> (DF) (ttl 240, id 52671, len 1500)
  2394	17:17:42.051945 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1118, len 40)
  2395	17:17:42.062595 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52672, len 1252)
  2396	17:17:42.063269 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1119, len 40)
  2397	17:17:42.075846 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52673, len 1500)
  2398	17:17:42.076567 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1120, len 40)
  2399	17:17:42.089380 clusterb.icq.com.http > 172.16.183.2.1068: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501178885 2739123> (DF) (ttl 240, id 52674, len 1500)
  2400	17:17:42.090106 172.16.183.2.1068 > clusterb.icq.com.http: R [tcp sum ok] 830779162:830779162(0) win 0 (ttl 255, id 1121, len 40)
  2401	17:17:43.987075 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50766+ A? web.icq.com. [|domain] (ttl 64, id 1122, len 57)
  2402	17:17:44.000460 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50766 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 22831, len 217)
  2403	17:17:44.001551 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2739326 0,nop,wscale 0> (DF) (ttl 64, id 1123, len 60)
  2404	17:17:47.005288 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2739626 0,nop,wscale 0> (DF) (ttl 64, id 1124, len 60)
  2405	17:17:52.995286 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2740226 0,nop,wscale 0> (DF) (ttl 64, id 1125, len 60)
  2406	17:18:04.995220 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2741426 0,nop,wscale 0> (DF) (ttl 64, id 1126, len 60)
  2407	17:18:29.015301 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2743826 0,nop,wscale 0> (DF) (ttl 64, id 1127, len 60)
  2408	17:19:17.005285 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2748626 0,nop,wscale 0> (DF) (ttl 64, id 1128, len 60)
  2409	17:20:53.035219 172.16.183.2.1069 > clusterc.icq.com.http: S [tcp sum ok] 1017454136:1017454136(0) win 32120 <mss 1460,sackOK,timestamp 2758226 0,nop,wscale 0> (DF) (ttl 64, id 1129, len 60)
  2410	17:20:53.052343 clusterc.icq.com.http > 172.16.183.2.1069: S [tcp sum ok] 767520358:767520358(0) ack 1017454137 win 65535 <nop,nop,timestamp 201053288 2758226,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 19473, len 64)
  2411	17:20:53.052724 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2758227 201053288> (DF) (ttl 64, id 1130, len 52)
  2412	17:20:54.045442 172.16.183.2.1069 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2758327 201053288> (DF) (ttl 64, id 1131, len 104)
  2413	17:20:54.167925 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 201053399 2758327> (DF) (ttl 240, id 19474, len 52)
  2414	17:20:54.944441 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 201053476 2758327> (DF) (ttl 240, id 19475, len 1500)
  2415	17:20:54.945532 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2758427 201053476> (DF) (ttl 64, id 1132, len 52)
  2416	17:20:54.956502 clusterc.icq.com.http > 172.16.183.2.1069: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 201053476 2758327> (DF) (ttl 240, id 19476, len 1500)
  2417	17:20:54.974484 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 201053479 2758427> (DF) (ttl 240, id 19477, len 1477)
  2418	17:20:54.979771 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2758431 201053476> (DF) (ttl 64, id 1133, len 52)
  2419	17:20:54.986562 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 201053479 2758427> (DF) (ttl 240, id 19478, len 1500)
  2420	17:20:55.008733 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19479, len 1500)
  2421	17:20:55.009473 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2758433 201053479> (DF) (ttl 64, id 1134, len 52)
  2422	17:20:55.018402 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19480, len 1252)
  2423	17:20:55.030425 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 201053482 2758431> (DF) (ttl 240, id 19481, len 1500)
  2424	17:20:55.039779 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2758436 201053482> (DF) (ttl 64, id 1135, len 52)
  2425	17:20:55.041318 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19482, len 1500)
  2426	17:20:55.050183 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19483, len 1252)
  2427	17:20:55.050987 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2758438 201053485> (DF) (ttl 64, id 1136, len 52)
  2428	17:20:55.061477 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 201053485 2758433> (DF) (ttl 240, id 19484, len 1500)
  2429	17:20:55.073043 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19485, len 1500)
  2430	17:20:55.073770 172.16.183.2.1069 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2758440 201053485> (DF) (ttl 64, id 1137, len 52)
  2431	17:20:55.077128 172.16.183.2.1069 > clusterc.icq.com.http: P [bad tcp cksum ae28!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2432	17:20:55.077128 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2758440 201053485> (DF) (ttl 64, id 1138, len 52)
  2433	17:20:55.081696 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19486, len 1252)
  2434	17:20:55.082471 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1139, len 40)
  2435	17:20:55.093467 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 201053488 2758436> (DF) (ttl 240, id 19487, len 1500)
  2436	17:20:55.094195 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1140, len 40)
  2437	17:20:55.104310 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 201053489 2758438> (DF) (ttl 240, id 19488, len 1500)
  2438	17:20:55.105370 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1141, len 40)
  2439	17:20:55.113227 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 201053489 2758438> (DF) (ttl 240, id 19489, len 1252)
  2440	17:20:55.113893 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1142, len 40)
  2441	17:20:55.123782 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19490, len 1500)
  2442	17:20:55.124568 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1143, len 40)
  2443	17:20:55.133876 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19491, len 1500)
  2444	17:20:55.134832 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1144, len 40)
  2445	17:20:55.142048 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19492, len 1252)
  2446	17:20:55.142705 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1145, len 40)
  2447	17:20:55.152357 clusterc.icq.com.http > 172.16.183.2.1069: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 201053492 2758440> (DF) (ttl 240, id 19493, len 1500)
  2448	17:20:55.153074 172.16.183.2.1069 > clusterc.icq.com.http: R [tcp sum ok] 1017454189:1017454189(0) win 0 (ttl 255, id 1146, len 40)
  2449	17:20:57.097232 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50767+ A? web.icq.com. [|domain] (ttl 64, id 1147, len 57)
  2450	17:20:57.117162 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50767* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (205) (ttl 61, id 36092, len 233)
  2451	17:20:57.118595 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2758643 0,nop,wscale 0> (DF) (ttl 64, id 1148, len 60)
  2452	17:21:00.125148 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2758944 0,nop,wscale 0> (DF) (ttl 64, id 1149, len 60)
  2453	17:21:06.125416 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2759544 0,nop,wscale 0> (DF) (ttl 64, id 1150, len 60)
  2454	17:21:18.185092 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2760744 0,nop,wscale 0> (DF) (ttl 64, id 1151, len 60)
  2455	17:21:42.195272 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2763144 0,nop,wscale 0> (DF) (ttl 64, id 1152, len 60)
  2456	17:22:30.245216 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2767944 0,nop,wscale 0> (DF) (ttl 64, id 1153, len 60)
  2457	17:24:06.155091 172.16.183.2.1070 > clustera.icq.com.http: S [tcp sum ok] 1237496390:1237496390(0) win 32120 <mss 1460,sackOK,timestamp 2777544 0,nop,wscale 0> (DF) (ttl 64, id 1154, len 60)
  2458	17:24:06.172495 clustera.icq.com.http > 172.16.183.2.1070: S [tcp sum ok] 3136039760:3136039760(0) ack 1237496391 win 24616 <nop,nop,timestamp 252887867 2777544,nop,wscale 0,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 41039, len 64)
  2459	17:24:06.173408 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2777545 252887867> (DF) (ttl 64, id 1155, len 52)
  2460	17:24:07.165618 172.16.183.2.1070 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2777645 252887867> (DF) (ttl 64, id 1156, len 104)
  2461	17:24:07.185810 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] ack 53 win 24616 <nop,nop,timestamp 252887968 2777645> (DF) (ttl 49, id 41040, len 52)
  2462	17:24:07.667913 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 1:1449(1448) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41041, len 1500)
  2463	17:24:07.668739 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2777706 252888015> (DF) (ttl 64, id 1157, len 52)
  2464	17:24:07.685646 clustera.icq.com.http > 172.16.183.2.1070: P [tcp sum ok] 1449:2897(1448) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41042, len 1500)
  2465	17:24:07.700419 clustera.icq.com.http > 172.16.183.2.1070: P [tcp sum ok] 2897:4322(1425) ack 53 win 24616 <nop,nop,timestamp 252888015 2777645> (DF) (ttl 49, id 41043, len 1477)
  2466	17:24:07.708064 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2777710 252888015> (DF) (ttl 64, id 1158, len 52)
  2467	17:24:07.715458 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 4322:5770(1448) ack 53 win 24616 <nop,nop,timestamp 252888018 2777706> (DF) (ttl 49, id 41044, len 1500)
  2468	17:24:07.730490 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 5770:7218(1448) ack 53 win 24616 <nop,nop,timestamp 252888018 2777706> (DF) (ttl 49, id 41045, len 1500)
  2469	17:24:07.731664 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2777712 252888018> (DF) (ttl 64, id 1159, len 52)
  2470	17:24:07.743089 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 7218:8418(1200) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41046, len 1252)
  2471	17:24:07.754910 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2777715 252888022> (DF) (ttl 64, id 1160, len 52)
  2472	17:24:07.758075 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 8418:9866(1448) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41047, len 1500)
  2473	17:24:07.773355 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 9866:11314(1448) ack 53 win 24616 <nop,nop,timestamp 252888022 2777710> (DF) (ttl 49, id 41048, len 1500)
  2474	17:24:07.774117 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2777716 252888022> (DF) (ttl 64, id 1161, len 52)
  2475	17:24:07.784989 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 11314:12514(1200) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41049, len 1252)
  2476	17:24:07.798489 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 12514:13962(1448) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41050, len 1500)
  2477	17:24:07.812285 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 13962:15410(1448) ack 53 win 24616 <nop,nop,timestamp 252888025 2777712> (DF) (ttl 49, id 41051, len 1500)
  2478	17:24:07.812980 172.16.183.2.1070 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2777720 252888025> (DF) (ttl 64, id 1162, len 52)
  2479	17:24:07.817712 172.16.183.2.1070 > clustera.icq.com.http: P [bad tcp cksum a93d!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2480	17:24:07.817712 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2777720 252888025> (DF) (ttl 64, id 1163, len 52)
  2481	17:24:07.823171 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 15410:16610(1200) ack 53 win 24616 <nop,nop,timestamp 252888027 2777715> (DF) (ttl 49, id 41052, len 1252)
  2482	17:24:07.823905 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1164, len 40)
  2483	17:24:07.836656 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 16610:18058(1448) ack 53 win 24616 <nop,nop,timestamp 252888027 2777715> (DF) (ttl 49, id 41053, len 1500)
  2484	17:24:07.837401 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1165, len 40)
  2485	17:24:07.849957 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 18058:19506(1448) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41054, len 1500)
  2486	17:24:07.850665 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1166, len 40)
  2487	17:24:07.860847 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 19506:20706(1200) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41055, len 1252)
  2488	17:24:07.861544 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1167, len 40)
  2489	17:24:07.874102 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 20706:22154(1448) ack 53 win 24616 <nop,nop,timestamp 252888029 2777716> (DF) (ttl 49, id 41056, len 1500)
  2490	17:24:07.875131 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1168, len 40)
  2491	17:24:07.886678 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 22154:23602(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41057, len 1500)
  2492	17:24:07.887481 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1169, len 40)
  2493	17:24:07.896332 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 23602:24802(1200) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41058, len 1252)
  2494	17:24:07.897083 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1170, len 40)
  2495	17:24:07.908601 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 24802:26250(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41059, len 1500)
  2496	17:24:07.909326 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1171, len 40)
  2497	17:24:07.920661 clustera.icq.com.http > 172.16.183.2.1070: . [tcp sum ok] 26250:27698(1448) ack 53 win 24616 <nop,nop,timestamp 252888033 2777720> (DF) (ttl 49, id 41060, len 1500)
  2498	17:24:07.921381 172.16.183.2.1070 > clustera.icq.com.http: R [tcp sum ok] 1237496443:1237496443(0) win 0 (ttl 255, id 1172, len 40)
  2499	17:24:09.817316 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50768+ A? web.icq.com. [|domain] (ttl 64, id 1173, len 57)
  2500	17:24:09.848274 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50768 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com (216) (ttl 61, id 47523, len 244)
  2501	17:24:09.849319 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2777923 0,nop,wscale 0> (DF) (ttl 64, id 1174, len 60)
  2502	17:24:12.855262 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2778223 0,nop,wscale 0> (DF) (ttl 64, id 1175, len 60)
  2503	17:24:18.845352 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2778823 0,nop,wscale 0> (DF) (ttl 64, id 1176, len 60)
  2504	17:24:30.855089 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2780023 0,nop,wscale 0> (DF) (ttl 64, id 1177, len 60)
  2505	17:24:54.855238 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2782423 0,nop,wscale 0> (DF) (ttl 64, id 1178, len 60)
  2506	17:25:42.835169 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2787223 0,nop,wscale 0> (DF) (ttl 64, id 1179, len 60)
  2507	17:26:50.245950 dom11-246.menta.net.4114 > 172.16.183.2.ftp: S [tcp sum ok] 1242601389:1242601389(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19349, len 52)
  2508	17:26:50.251280 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1180, len 48)
  2509	17:26:51.679854 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19402, len 52)
  2510	17:26:51.684207 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1243238826 win 0 (DF) (ttl 255, id 0, len 40)
  2511	17:26:52.523413 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19451, len 52)
  2512	17:26:52.526631 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
  2513	17:26:53.227056 dom11-246.menta.net.4134 > 172.16.183.2.ftp: S [tcp sum ok] 1244301180:1244301180(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19474, len 52)
  2514	17:26:53.230260 172.16.183.2.ftp > dom11-246.menta.net.4134: S [tcp sum ok] 1612149285:1612149285(0) ack 1244301181 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1181, len 48)
  2515	17:26:53.320432 dom11-246.menta.net.4120 > 172.16.183.8.ftp: S [tcp sum ok] 1243238825:1243238825(0) win 60352 <mss 1460,nop,wscale 2,nop,nop,eol> (DF) (ttl 47, id 19475, len 52)
  2516	17:26:53.323723 172.16.183.8.ftp > dom11-246.menta.net.4120: R [tcp sum ok] 0:0(0) ack 1 win 0 (DF) (ttl 255, id 0, len 40)
  2517	17:26:53.534983 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1182, len 48)
  2518	17:26:53.622205 dom11-246.menta.net.4134 > 172.16.183.2.ftp: . [tcp sum ok] ack 1 win 64240 (DF) (ttl 47, id 19479, len 40)
  2519	17:26:53.657044 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52442+ PTR? 246.114.57.62.in-addr.arpa. [|domain] (ttl 64, id 1183, len 72)
  2520	17:26:53.669874 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52442 1/2/2 246.114.57.62.in-addr.arpa. PTR dom11-246.menta.net. (161) (ttl 61, id 57851, len 189)
  2521	17:26:53.670989 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52443+ A? dom11-246.menta.net. [|domain] (ttl 64, id 1184, len 65)
  2522	17:26:54.098063 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52443* 1/2/2 dom11-246.menta.net. A dom11-246.menta.net (146) (ttl 61, id 57895, len 174)
  2523	17:26:54.103828 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52444+ PTR? 246.114.57.62.in-addr.arpa. [|domain] (ttl 64, id 1185, len 72)
  2524	17:26:54.116049 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52444 1/2/2 246.114.57.62.in-addr.arpa. PTR dom11-246.menta.net. (161) (ttl 61, id 57896, len 189)
  2525	17:26:54.117897 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 52445+ PTR? 2.183.16.172.in-addr.arpa. [|domain] (ttl 64, id 1186, len 71)
  2526	17:26:54.148067 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 52445 NXDomain* 0/1/0 (120) (ttl 61, id 57901, len 148)
  2527	17:26:54.149705 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1187, len 120)
  2528	17:26:57.154958 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1188, len 120)
  2529	17:26:59.995028 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1189, len 48)
  2530	17:27:03.125066 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1190, len 120)
  2531	17:27:12.465078 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1191, len 48)
  2532	17:27:15.124890 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1192, len 120)
  2533	17:27:18.845061 172.16.183.2.1071 > clustera.icq.com.http: S [tcp sum ok] 1433092377:1433092377(0) win 32120 <mss 1460,sackOK,timestamp 2796823 0,nop,wscale 0> (DF) (ttl 64, id 1193, len 60)
  2534	17:27:18.862206 clustera.icq.com.http > 172.16.183.2.1071: S [tcp sum ok] 2572299246:2572299246(0) ack 1433092378 win 65535 <nop,nop,timestamp 17699757 2796823,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 50371, len 64)
  2535	17:27:18.862870 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2796824 17699757> (DF) (ttl 64, id 1194, len 52)
  2536	17:27:19.855625 172.16.183.2.1071 > clustera.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2796924 17699757> (DF) (ttl 64, id 1195, len 104)
  2537	17:27:19.894743 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17699861 2796924> (DF) (ttl 240, id 50372, len 52)
  2538	17:27:20.415780 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17699911 2796924> (DF) (ttl 240, id 50373, len 1500)
  2539	17:27:20.416586 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2796987 17699911> (DF) (ttl 64, id 1196, len 52)
  2540	17:27:20.431293 clustera.icq.com.http > 172.16.183.2.1071: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17699911 2796924> (DF) (ttl 240, id 50374, len 1500)
  2541	17:27:20.436349 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2796989 17699911> (DF) (ttl 64, id 1197, len 52)
  2542	17:27:20.450266 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17699915 2796987> (DF) (ttl 240, id 50375, len 1477)
  2543	17:27:20.465290 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17699915 2796987> (DF) (ttl 240, id 50376, len 1500)
  2544	17:27:20.466063 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2796992 17699915> (DF) (ttl 64, id 1198, len 52)
  2545	17:27:20.480813 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17699916 2796989> (DF) (ttl 240, id 50377, len 1500)
  2546	17:27:20.481558 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2796993 17699915> (DF) (ttl 64, id 1199, len 52)
  2547	17:27:20.492684 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17699917 2796989> (DF) (ttl 240, id 50378, len 1252)
  2548	17:27:20.507181 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17699919 2796992> (DF) (ttl 240, id 50379, len 1500)
  2549	17:27:20.520480 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17699919 2796992> (DF) (ttl 240, id 50380, len 1500)
  2550	17:27:20.521235 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2796997 17699917> (DF) (ttl 64, id 1200, len 52)
  2551	17:27:20.531866 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50381, len 1252)
  2552	17:27:20.545143 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50382, len 1500)
  2553	17:27:20.558425 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17699921 2796993> (DF) (ttl 240, id 50383, len 1500)
  2554	17:27:20.559149 172.16.183.2.1071 > clustera.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2797001 17699921> (DF) (ttl 64, id 1201, len 52)
  2555	17:27:20.563613 172.16.183.2.1071 > clustera.icq.com.http: P [bad tcp cksum 27c4!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2556	17:27:20.563613 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2797001 17699921> (DF) (ttl 64, id 1202, len 52)
  2557	17:27:20.569550 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50384, len 1252)
  2558	17:27:20.570301 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1203, len 40)
  2559	17:27:20.583293 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50385, len 1500)
  2560	17:27:20.584070 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1204, len 40)
  2561	17:27:20.596107 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50386, len 1500)
  2562	17:27:20.596853 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1205, len 40)
  2563	17:27:20.606006 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17699925 2796997> (DF) (ttl 240, id 50387, len 1252)
  2564	17:27:20.606743 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1206, len 40)
  2565	17:27:20.618034 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50388, len 1500)
  2566	17:27:20.618763 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1207, len 40)
  2567	17:27:20.630595 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50389, len 1500)
  2568	17:27:20.631341 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1208, len 40)
  2569	17:27:20.640492 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50390, len 1252)
  2570	17:27:20.641214 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1209, len 40)
  2571	17:27:20.652759 clustera.icq.com.http > 172.16.183.2.1071: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 17699929 2797001> (DF) (ttl 240, id 50391, len 1500)
  2572	17:27:20.653503 172.16.183.2.1071 > clustera.icq.com.http: R [tcp sum ok] 1433092430:1433092430(0) win 0 (ttl 255, id 1210, len 40)
  2573	17:27:22.567159 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50769+ A? web.icq.com. [|domain] (ttl 64, id 1211, len 57)
  2574	17:27:22.579376 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50769 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 59569, len 233)
  2575	17:27:22.580555 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2797203 0,nop,wscale 0> (DF) (ttl 64, id 1212, len 60)
  2576	17:27:25.584887 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2797503 0,nop,wscale 0> (DF) (ttl 64, id 1213, len 60)
  2577	17:27:31.595054 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2798103 0,nop,wscale 0> (DF) (ttl 64, id 1214, len 60)
  2578	17:27:36.914961 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1215, len 48)
  2579	17:27:39.075098 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1216, len 120)
  2580	17:27:43.585238 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2799303 0,nop,wscale 0> (DF) (ttl 64, id 1217, len 60)
  2581	17:28:07.605057 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2801703 0,nop,wscale 0> (DF) (ttl 64, id 1218, len 60)
  2582	17:28:25.425120 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1219, len 48)
  2583	17:28:27.084811 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1220, len 120)
  2584	17:28:55.595210 172.16.183.2.1072 > clusterc.icq.com.http: S [tcp sum ok] 1636950756:1636950756(0) win 32120 <mss 1460,sackOK,timestamp 2806503 0,nop,wscale 0> (DF) (ttl 64, id 1221, len 60)
  2585	17:28:55.613584 clusterc.icq.com.http > 172.16.183.2.1072: S [tcp sum ok] 2772861095:2772861095(0) ack 1636950757 win 33304 <nop,nop,timestamp 215212080 2806503,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 49, id 49633, len 64)
  2586	17:28:55.614541 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2806504 215212080> (DF) (ttl 64, id 1222, len 52)
  2587	17:28:56.605829 172.16.183.2.1072 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2806604 215212080> (DF) (ttl 64, id 1223, len 104)
  2588	17:28:56.625421 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 215212181 2806604> (DF) (ttl 49, id 49634, len 52)
  2589	17:28:57.360800 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49635, len 1500)
  2590	17:28:57.361572 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2806684 215212253> (DF) (ttl 64, id 1224, len 52)
  2591	17:28:57.377806 clusterc.icq.com.http > 172.16.183.2.1072: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49636, len 1500)
  2592	17:28:57.394988 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2806688 215212253> (DF) (ttl 64, id 1225, len 52)
  2593	17:28:57.395234 clusterc.icq.com.http > 172.16.183.2.1072: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 215212253 2806604> (DF) (ttl 49, id 49637, len 1477)
  2594	17:28:57.412297 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 215212256 2806684> (DF) (ttl 49, id 49638, len 1500)
  2595	17:28:57.424855 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2806691 215212253> (DF) (ttl 64, id 1226, len 52)
  2596	17:28:57.430025 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 215212256 2806684> (DF) (ttl 49, id 49639, len 1500)
  2597	17:28:57.443629 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 215212260 2806688> (DF) (ttl 49, id 49640, len 1252)
  2598	17:28:57.445475 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2806693 215212256> (DF) (ttl 64, id 1227, len 52)
  2599	17:28:57.459112 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 215212260 2806688> (DF) (ttl 49, id 49641, len 1500)
  2600	17:28:57.473900 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49642, len 1500)
  2601	17:28:57.475025 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2806696 215212260> (DF) (ttl 64, id 1228, len 52)
  2602	17:28:57.486497 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49643, len 1252)
  2603	17:28:57.501727 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 215212263 2806691> (DF) (ttl 49, id 49644, len 1500)
  2604	17:28:57.505474 172.16.183.2.1072 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2806699 215212263> (DF) (ttl 64, id 1229, len 52)
  2605	17:28:57.516996 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49645, len 1500)
  2606	17:28:57.519976 172.16.183.2.1072 > clusterc.icq.com.http: P [bad tcp cksum 46b5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2607	17:28:57.519976 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2806700 215212265> (DF) (ttl 64, id 1230, len 52)
  2608	17:28:57.530087 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49646, len 1252)
  2609	17:28:57.530838 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1231, len 40)
  2610	17:28:57.543832 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 215212265 2806693> (DF) (ttl 49, id 49647, len 1500)
  2611	17:28:57.544570 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1232, len 40)
  2612	17:28:57.557145 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49648, len 1500)
  2613	17:28:57.557900 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1233, len 40)
  2614	17:28:57.567777 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49649, len 1252)
  2615	17:28:57.568507 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1234, len 40)
  2616	17:28:57.581530 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 215212268 2806696> (DF) (ttl 49, id 49650, len 1500)
  2617	17:28:57.582259 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1235, len 40)
  2618	17:28:57.594859 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49651, len 1500)
  2619	17:28:57.595699 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1236, len 40)
  2620	17:28:57.605723 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49652, len 1252)
  2621	17:28:57.606451 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1237, len 40)
  2622	17:28:57.619237 clusterc.icq.com.http > 172.16.183.2.1072: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 215212271 2806699> (DF) (ttl 49, id 49653, len 1500)
  2623	17:28:57.619953 172.16.183.2.1072 > clusterc.icq.com.http: R [tcp sum ok] 1636950809:1636950809(0) win 0 (ttl 255, id 1238, len 40)
  2624	17:28:59.536790 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50770+ A? web.icq.com. [|domain] (ttl 64, id 1239, len 57)
  2625	17:28:59.549517 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50770 5/2/1 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (189) (ttl 61, id 65379, len 217)
  2626	17:28:59.550442 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2806902 0,nop,wscale 0> (DF) (ttl 64, id 1240, len 60)
  2627	17:29:02.555426 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2807202 0,nop,wscale 0> (DF) (ttl 64, id 1241, len 60)
  2628	17:29:08.545325 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2807802 0,nop,wscale 0> (DF) (ttl 64, id 1242, len 60)
  2629	17:29:20.545238 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2809002 0,nop,wscale 0> (DF) (ttl 64, id 1243, len 60)
  2630	17:29:44.545243 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2811402 0,nop,wscale 0> (DF) (ttl 64, id 1244, len 60)
  2631	17:30:01.875082 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1245, len 48)
  2632	17:30:03.035010 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1246, len 120)
  2633	17:30:32.545132 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2816202 0,nop,wscale 0> (DF) (ttl 64, id 1247, len 60)
  2634	17:32:02.475240 172.16.183.2.ftp > dom11-246.menta.net.4114: S [tcp sum ok] 1597986128:1597986128(0) ack 1242601390 win 32120 <mss 1460,nop,wscale 0> (DF) (ttl 64, id 1248, len 48)
  2635	17:32:03.134914 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1249, len 120)
  2636	17:32:08.644898 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2825802 0,nop,wscale 0> (DF) (ttl 64, id 1250, len 60)
  2637	17:34:03.095175 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1251, len 120)
  2638	17:34:08.605097 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2837802 0,nop,wscale 0> (DF) (ttl 64, id 1252, len 60)
  2639	17:36:03.115069 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1253, len 120)
  2640	17:36:08.624774 172.16.183.2.1073 > clusterc.icq.com.http: S [tcp sum ok] 1732361294:1732361294(0) win 32120 <mss 1460,sackOK,timestamp 2849802 0,nop,wscale 0> (DF) (ttl 64, id 1254, len 60)
  2641	17:36:08.641412 clusterc.icq.com.http > 172.16.183.2.1073: S [tcp sum ok] 4244920612:4244920612(0) ack 1732361295 win 65535 <nop,nop,timestamp 501116800 2849802,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 23297, len 64)
  2642	17:36:08.642023 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2849803 501116800> (DF) (ttl 64, id 1255, len 52)
  2643	17:36:09.635363 172.16.183.2.1073 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2849903 501116800> (DF) (ttl 64, id 1256, len 104)
  2644	17:36:09.750861 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] ack 53 win 33278 <nop,nop,timestamp 501116911 2849903> (DF) (ttl 240, id 23298, len 52)
  2645	17:36:16.354334 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23299, len 1500)
  2646	17:36:16.355326 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2850598 501117570> (DF) (ttl 64, id 1257, len 52)
  2647	17:36:16.366653 clusterc.icq.com.http > 172.16.183.2.1073: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23300, len 1500)
  2648	17:36:16.378453 clusterc.icq.com.http > 172.16.183.2.1073: P [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501117570 2849903> (DF) (ttl 240, id 23301, len 1477)
  2649	17:36:16.381560 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2850601 501117570> (DF) (ttl 64, id 1258, len 52)
  2650	17:36:16.390776 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501117573 2850598> (DF) (ttl 240, id 23302, len 1500)
  2651	17:36:16.402610 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501117573 2850598> (DF) (ttl 240, id 23303, len 1500)
  2652	17:36:16.403336 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2850603 501117573> (DF) (ttl 64, id 1259, len 52)
  2653	17:36:16.412519 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23304, len 1252)
  2654	17:36:16.424549 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23305, len 1500)
  2655	17:36:16.431558 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2850606 501117576> (DF) (ttl 64, id 1260, len 52)
  2656	17:36:16.436607 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501117576 2850601> (DF) (ttl 240, id 23306, len 1500)
  2657	17:36:16.445532 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23307, len 1252)
  2658	17:36:16.451577 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2850608 501117576> (DF) (ttl 64, id 1261, len 52)
  2659	17:36:16.456573 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23308, len 1500)
  2660	17:36:16.468148 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501117578 2850603> (DF) (ttl 240, id 23309, len 1500)
  2661	17:36:16.468893 172.16.183.2.1073 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2850609 501117578> (DF) (ttl 64, id 1262, len 52)
  2662	17:36:16.473197 172.16.183.2.1073 > clusterc.icq.com.http: P [bad tcp cksum efa5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2663	17:36:16.473197 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2850610 501117578> (DF) (ttl 64, id 1263, len 52)
  2664	17:36:16.476806 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23310, len 1252)
  2665	17:36:16.477578 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1264, len 40)
  2666	17:36:16.487842 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23311, len 1500)
  2667	17:36:16.488619 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1265, len 40)
  2668	17:36:16.498688 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501117581 2850606> (DF) (ttl 240, id 23312, len 1500)
  2669	17:36:16.499515 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1266, len 40)
  2670	17:36:16.507854 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23313, len 1252)
  2671	17:36:16.508579 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1267, len 40)
  2672	17:36:16.518877 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23314, len 1500)
  2673	17:36:16.519662 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1268, len 40)
  2674	17:36:16.529723 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501117583 2850608> (DF) (ttl 240, id 23315, len 1500)
  2675	17:36:16.530506 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1269, len 40)
  2676	17:36:16.537901 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23316, len 1252)
  2677	17:36:16.538584 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1270, len 40)
  2678	17:36:16.548199 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23317, len 1500)
  2679	17:36:16.549003 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1271, len 40)
  2680	17:36:16.558569 clusterc.icq.com.http > 172.16.183.2.1073: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501117584 2850609> (DF) (ttl 240, id 23318, len 1500)
  2681	17:36:16.567752 172.16.183.2.1073 > clusterc.icq.com.http: R [tcp sum ok] 1732361347:1732361347(0) win 0 (ttl 255, id 1272, len 40)
  2682	17:36:18.537288 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50771+ A? web.icq.com. [|domain] (ttl 64, id 1273, len 57)
  2683	17:36:18.566243 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50771 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (216) (ttl 61, id 30915, len 244)
  2684	17:36:18.567533 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2850814 0,nop,wscale 0> (DF) (ttl 64, id 1274, len 60)
  2685	17:36:21.565072 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2851115 0,nop,wscale 0> (DF) (ttl 64, id 1275, len 60)
  2686	17:36:27.565114 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2851715 0,nop,wscale 0> (DF) (ttl 64, id 1276, len 60)
  2687	17:36:39.565311 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2852915 0,nop,wscale 0> (DF) (ttl 64, id 1277, len 60)
  2688	17:37:03.635195 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2855315 0,nop,wscale 0> (DF) (ttl 64, id 1278, len 60)
  2689	17:37:51.625268 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2860115 0,nop,wscale 0> (DF) (ttl 64, id 1279, len 60)
  2690	17:38:02.985089 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1280, len 120)
  2691	17:39:27.615218 172.16.183.2.1074 > clusterc.icq.com.http: S [tcp sum ok] 2203503749:2203503749(0) win 32120 <mss 1460,sackOK,timestamp 2869715 0,nop,wscale 0> (DF) (ttl 64, id 1281, len 60)
  2692	17:39:27.635612 clusterc.icq.com.http > 172.16.183.2.1074: S [tcp sum ok] 1993303337:1993303337(0) ack 2203503750 win 65535 <nop,nop,timestamp 17831032 2869715,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 52401, len 64)
  2693	17:39:27.636290 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2869717 17831032> (DF) (ttl 64, id 1282, len 52)
  2694	17:39:28.635479 172.16.183.2.1074 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2869817 17831032> (DF) (ttl 64, id 1283, len 104)
  2695	17:39:28.653614 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 17831133 2869817> (DF) (ttl 240, id 52402, len 52)
  2696	17:39:29.167974 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 17831183 2869817> (DF) (ttl 240, id 52403, len 1500)
  2697	17:39:29.168780 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2869885 17831183> (DF) (ttl 64, id 1284, len 52)
  2698	17:39:29.181775 clusterc.icq.com.http > 172.16.183.2.1074: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 17831183 2869817> (DF) (ttl 240, id 52404, len 1500)
  2699	17:39:29.199245 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 17831187 2869885> (DF) (ttl 240, id 52405, len 1477)
  2700	17:39:29.209860 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2869889 17831183> (DF) (ttl 64, id 1285, len 52)
  2701	17:39:29.213044 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 17831187 2869885> (DF) (ttl 240, id 52406, len 1500)
  2702	17:39:29.224912 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2869891 17831187> (DF) (ttl 64, id 1286, len 52)
  2703	17:39:29.240662 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52407, len 1500)
  2704	17:39:29.251541 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52408, len 1252)
  2705	17:39:29.263808 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 17831191 2869889> (DF) (ttl 240, id 52409, len 1500)
  2706	17:39:29.264816 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 9866 win 31856 <nop,nop,timestamp 2869895 17831191> (DF) (ttl 64, id 1287, len 52)
  2707	17:39:29.276375 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 17831192 2869891> (DF) (ttl 240, id 52410, len 1500)
  2708	17:39:29.286033 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 17831192 2869891> (DF) (ttl 240, id 52411, len 1252)
  2709	17:39:29.289839 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2869898 17831192> (DF) (ttl 64, id 1288, len 52)
  2710	17:39:29.298299 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52412, len 1500)
  2711	17:39:29.309836 172.16.183.2.1074 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2869900 17831196> (DF) (ttl 64, id 1289, len 52)
  2712	17:39:29.310099 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52413, len 1500)
  2713	17:39:29.318366 172.16.183.2.1074 > clusterc.icq.com.http: P [bad tcp cksum d1f3!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2714	17:39:29.318366 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2869900 17831196> (DF) (ttl 64, id 1290, len 52)
  2715	17:39:29.320016 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52414, len 1252)
  2716	17:39:29.320765 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1291, len 40)
  2717	17:39:29.332529 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 17831196 2869895> (DF) (ttl 240, id 52415, len 1500)
  2718	17:39:29.333259 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1292, len 40)
  2719	17:39:29.344111 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52416, len 1500)
  2720	17:39:29.345054 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1293, len 40)
  2721	17:39:29.353508 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52417, len 1252)
  2722	17:39:29.354195 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1294, len 40)
  2723	17:39:29.364560 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 17831199 2869898> (DF) (ttl 240, id 52418, len 1500)
  2724	17:39:29.365486 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1295, len 40)
  2725	17:39:29.375405 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 17831201 2869900> (DF) (ttl 240, id 52419, len 1500)
  2726	17:39:29.376162 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1296, len 40)
  2727	17:39:29.384557 clusterc.icq.com.http > 172.16.183.2.1074: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 17831201 2869900> (DF) (ttl 240, id 52420, len 1252)
  2728	17:39:29.385445 172.16.183.2.1074 > clusterc.icq.com.http: R [tcp sum ok] 2203503802:2203503802(0) win 0 (ttl 255, id 1297, len 40)
  2729	17:39:31.347462 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50772+ A? web.icq.com. [|domain] (ttl 64, id 1298, len 57)
  2730	17:39:31.362364 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50772 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 43497, len 233)
  2731	17:39:31.363402 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2870102 0,nop,wscale 0> (DF) (ttl 64, id 1299, len 60)
  2732	17:39:34.374993 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2870402 0,nop,wscale 0> (DF) (ttl 64, id 1300, len 60)
  2733	17:39:40.365202 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2871002 0,nop,wscale 0> (DF) (ttl 64, id 1301, len 60)
  2734	17:39:52.355360 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2872202 0,nop,wscale 0> (DF) (ttl 64, id 1302, len 60)
  2735	17:40:02.875314 172.16.183.2.ftp > dom11-246.menta.net.4134: P [tcp sum ok] 1:81(80) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1303, len 120)
  2736	17:40:16.385268 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2874602 0,nop,wscale 0> (DF) (ttl 64, id 1304, len 60)
  2737	17:41:04.395140 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2879402 0,nop,wscale 0> (DF) (ttl 64, id 1305, len 60)
  2738	17:41:54.005412 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 81:137(56) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1306, len 96)
  2739	17:42:02.965287 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1307, len 176)
  2740	17:42:40.485187 172.16.183.2.1075 > clusterc.icq.com.http: S [tcp sum ok] 2406909328:2406909328(0) win 32120 <mss 1460,sackOK,timestamp 2889002 0,nop,wscale 0> (DF) (ttl 64, id 1308, len 60)
  2741	17:42:40.502196 clusterc.icq.com.http > 172.16.183.2.1075: S [tcp sum ok] 2720615512:2720615512(0) ack 2406909329 win 65535 <nop,nop,timestamp 501155987 2889002,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 21951, len 64)
  2742	17:42:40.502909 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2889003 501155987> (DF) (ttl 64, id 1309, len 52)
  2743	17:42:41.485450 172.16.183.2.1075 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2889103 501155987> (DF) (ttl 64, id 1310, len 104)
  2744	17:42:41.504680 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501156087 2889103> (DF) (ttl 240, id 21952, len 52)
  2745	17:42:42.047665 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501156139 2889103> (DF) (ttl 240, id 21953, len 1500)
  2746	17:42:42.048496 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2889179 501156139> (DF) (ttl 64, id 1311, len 52)
  2747	17:42:42.067851 clusterc.icq.com.http > 172.16.183.2.1075: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501156139 2889103> (DF) (ttl 240, id 21954, len 1500)
  2748	17:42:42.085565 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501156143 2889179> (DF) (ttl 240, id 21955, len 1477)
  2749	17:42:42.086325 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2889183 501156139> (DF) (ttl 64, id 1312, len 52)
  2750	17:42:42.102582 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501156143 2889179> (DF) (ttl 240, id 21956, len 1500)
  2751	17:42:42.114905 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2889186 501156143> (DF) (ttl 64, id 1313, len 52)
  2752	17:42:42.120313 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501156147 2889183> (DF) (ttl 240, id 21957, len 1500)
  2753	17:42:42.134668 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501156147 2889183> (DF) (ttl 240, id 21958, len 1252)
  2754	17:42:42.135666 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2889188 501156147> (DF) (ttl 64, id 1314, len 52)
  2755	17:42:42.152099 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21959, len 1500)
  2756	17:42:42.168118 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21960, len 1500)
  2757	17:42:42.168884 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2889191 501156147> (DF) (ttl 64, id 1315, len 52)
  2758	17:42:42.180977 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501156150 2889186> (DF) (ttl 240, id 21961, len 1252)
  2759	17:42:42.194935 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 12514 win 31856 <nop,nop,timestamp 2889194 501156150> (DF) (ttl 64, id 1316, len 52)
  2760	17:42:42.196200 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501156152 2889188> (DF) (ttl 240, id 21962, len 1500)
  2761	17:42:42.211235 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501156152 2889188> (DF) (ttl 240, id 21963, len 1500)
  2762	17:42:42.212036 172.16.183.2.1075 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2889196 501156152> (DF) (ttl 64, id 1317, len 52)
  2763	17:42:42.217125 172.16.183.2.1075 > clusterc.icq.com.http: P [bad tcp cksum 1c1c!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2764	17:42:42.217125 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2889196 501156152> (DF) (ttl 64, id 1318, len 52)
  2765	17:42:42.223832 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21964, len 1252)
  2766	17:42:42.224828 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1319, len 40)
  2767	17:42:42.239305 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21965, len 1500)
  2768	17:42:42.240089 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1320, len 40)
  2769	17:42:42.254108 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21966, len 1500)
  2770	17:42:42.255128 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1321, len 40)
  2771	17:42:42.265237 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501156155 2889191> (DF) (ttl 240, id 21967, len 1252)
  2772	17:42:42.265921 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1322, len 40)
  2773	17:42:42.279225 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501156158 2889194> (DF) (ttl 240, id 21968, len 1500)
  2774	17:42:42.279995 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1323, len 40)
  2775	17:42:42.292762 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501156158 2889194> (DF) (ttl 240, id 21969, len 1500)
  2776	17:42:42.293564 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1324, len 40)
  2777	17:42:42.303404 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21970, len 1252)
  2778	17:42:42.304129 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1325, len 40)
  2779	17:42:42.316913 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21971, len 1500)
  2780	17:42:42.317722 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1326, len 40)
  2781	17:42:42.330217 clusterc.icq.com.http > 172.16.183.2.1075: . [tcp sum ok] 26250:27698(1448) ack 53 win 33304 <nop,nop,timestamp 501156160 2889196> (DF) (ttl 240, id 21972, len 1500)
  2782	17:42:42.331033 172.16.183.2.1075 > clusterc.icq.com.http: R [tcp sum ok] 2406909381:2406909381(0) win 0 (ttl 255, id 1327, len 40)
  2783	17:42:44.226807 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50773+ A? web.icq.com. [|domain] (ttl 64, id 1328, len 57)
  2784	17:42:44.239329 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50773 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 56238, len 233)
  2785	17:42:44.240359 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2889398 0,nop,wscale 0> (DF) (ttl 64, id 1329, len 60)
  2786	17:42:47.234928 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2889698 0,nop,wscale 0> (DF) (ttl 64, id 1330, len 60)
  2787	17:42:53.275330 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2890298 0,nop,wscale 0> (DF) (ttl 64, id 1331, len 60)
  2788	17:43:05.275221 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2891498 0,nop,wscale 0> (DF) (ttl 64, id 1332, len 60)
  2789	17:43:29.305144 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2893898 0,nop,wscale 0> (DF) (ttl 64, id 1333, len 60)
  2790	17:44:02.755107 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1334, len 176)
  2791	17:44:17.225168 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2898698 0,nop,wscale 0> (DF) (ttl 64, id 1335, len 60)
  2792	17:45:53.225260 172.16.183.2.1076 > clusterc.icq.com.http: S [tcp sum ok] 2606150862:2606150862(0) win 32120 <mss 1460,sackOK,timestamp 2908298 0,nop,wscale 0> (DF) (ttl 64, id 1336, len 60)
  2793	17:45:53.242663 clusterc.icq.com.http > 172.16.183.2.1076: S [tcp sum ok] 1990489637:1990489637(0) ack 2606150863 win 65535 <nop,nop,timestamp 501175261 2908298,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 18083, len 64)
  2794	17:45:53.243018 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2908299 501175261> (DF) (ttl 64, id 1337, len 52)
  2795	17:45:54.235539 172.16.183.2.1076 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2908399 501175261> (DF) (ttl 64, id 1338, len 104)
  2796	17:45:54.356289 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 501175373 2908399> (DF) (ttl 240, id 18084, len 52)
  2797	17:45:54.955403 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 501175431 2908399> (DF) (ttl 240, id 18085, len 1500)
  2798	17:45:54.956144 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2908476 501175431> (DF) (ttl 64, id 1339, len 52)
  2799	17:45:54.972896 clusterc.icq.com.http > 172.16.183.2.1076: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 501175431 2908399> (DF) (ttl 240, id 18086, len 1500)
  2800	17:45:54.976406 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2908478 501175431> (DF) (ttl 64, id 1340, len 52)
  2801	17:45:54.991355 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 501175435 2908476> (DF) (ttl 240, id 18087, len 1477)
  2802	17:45:55.006397 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 501175435 2908476> (DF) (ttl 240, id 18088, len 1500)
  2803	17:45:55.021664 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 501175437 2908478> (DF) (ttl 240, id 18089, len 1500)
  2804	17:45:55.022408 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 7218 win 31856 <nop,nop,timestamp 2908482 501175435> (DF) (ttl 64, id 1341, len 52)
  2805	17:45:55.033825 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 501175437 2908478> (DF) (ttl 240, id 18090, len 1252)
  2806	17:45:55.044957 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2908485 501175437> (DF) (ttl 64, id 1342, len 52)
  2807	17:45:55.054679 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18091, len 1500)
  2808	17:45:55.069227 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18092, len 1500)
  2809	17:45:55.070036 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2908488 501175441> (DF) (ttl 64, id 1343, len 52)
  2810	17:45:55.080600 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18093, len 1252)
  2811	17:45:55.094115 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 501175441 2908482> (DF) (ttl 240, id 18094, len 1500)
  2812	17:45:55.106399 172.16.183.2.1076 > clusterc.icq.com.http: . [tcp sum ok] ack 13962 win 31856 <nop,nop,timestamp 2908492 501175441> (DF) (ttl 64, id 1344, len 52)
  2813	17:45:55.107412 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 501175443 2908485> (DF) (ttl 240, id 18095, len 1500)
  2814	17:45:55.112316 172.16.183.2.1076 > clusterc.icq.com.http: P [bad tcp cksum bde1!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2815	17:45:55.112316 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2908492 501175443> (DF) (ttl 64, id 1345, len 52)
  2816	17:45:55.118538 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 501175443 2908485> (DF) (ttl 240, id 18096, len 1252)
  2817	17:45:55.119297 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1346, len 40)
  2818	17:45:55.132038 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18097, len 1500)
  2819	17:45:55.132776 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1347, len 40)
  2820	17:45:55.145339 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18098, len 1500)
  2821	17:45:55.146144 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1348, len 40)
  2822	17:45:55.156716 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 501175446 2908488> (DF) (ttl 240, id 18099, len 1252)
  2823	17:45:55.157454 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1349, len 40)
  2824	17:45:55.168996 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18100, len 1500)
  2825	17:45:55.169714 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1350, len 40)
  2826	17:45:55.181311 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18101, len 1500)
  2827	17:45:55.182081 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1351, len 40)
  2828	17:45:55.191453 clusterc.icq.com.http > 172.16.183.2.1076: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 501175450 2908492> (DF) (ttl 240, id 18102, len 1252)
  2829	17:45:55.192134 172.16.183.2.1076 > clusterc.icq.com.http: R [tcp sum ok] 2606150915:2606150915(0) win 0 (ttl 255, id 1352, len 40)
  2830	17:45:57.117518 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50774+ A? web.icq.com. [|domain] (ttl 64, id 1353, len 57)
  2831	17:45:57.137969 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50774* 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com, 1.web-r.rotors.icq.com. A clusterb.icq.com (205) (ttl 61, id 3088, len 233)
  2832	17:45:57.139019 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2908694 0,nop,wscale 0> (DF) (ttl 64, id 1354, len 60)
  2833	17:46:00.144995 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2908994 0,nop,wscale 0> (DF) (ttl 64, id 1355, len 60)
  2834	17:46:02.715207 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1356, len 176)
  2835	17:46:06.145040 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2909594 0,nop,wscale 0> (DF) (ttl 64, id 1357, len 60)
  2836	17:46:18.195131 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2910794 0,nop,wscale 0> (DF) (ttl 64, id 1358, len 60)
  2837	17:46:42.205282 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2913194 0,nop,wscale 0> (DF) (ttl 64, id 1359, len 60)
  2838	17:47:30.235200 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2917994 0,nop,wscale 0> (DF) (ttl 64, id 1360, len 60)
  2839	17:48:02.795069 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1361, len 176)
  2840	17:49:06.225267 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2927594 0,nop,wscale 0> (DF) (ttl 64, id 1362, len 60)
  2841	17:50:02.785394 172.16.183.2.ftp > dom11-246.menta.net.4134: FP [tcp sum ok] 1:137(136) ack 1 win 32120 (DF) [tos 0x10]  (ttl 64, id 1363, len 176)
  2842	17:51:06.235156 172.16.183.2.1077 > clusterc.icq.com.http: S [tcp sum ok] 2799686873:2799686873(0) win 32120 <mss 1460,sackOK,timestamp 2939594 0,nop,wscale 0> (DF) (ttl 64, id 1364, len 60)
  2843	17:51:06.252361 clusterc.icq.com.http > 172.16.183.2.1077: S [tcp sum ok] 644265659:644265659(0) ack 2799686874 win 65535 <nop,nop,timestamp 26458326 2939594,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 14429, len 64)
  2844	17:51:06.252735 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2939595 26458326> (DF) (ttl 64, id 1365, len 52)
  2845	17:51:07.245427 172.16.183.2.1077 > clusterc.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2939695 26458326> (DF) (ttl 64, id 1366, len 104)
  2846	17:51:07.343293 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 26458435 2939695> (DF) (ttl 240, id 14430, len 52)
  2847	17:51:07.932059 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 26458492 2939695> (DF) (ttl 240, id 14431, len 1500)
  2848	17:51:07.932813 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2939783 26458492> (DF) (ttl 64, id 1367, len 52)
  2849	17:51:07.947574 clusterc.icq.com.http > 172.16.183.2.1077: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 26458492 2939695> (DF) (ttl 240, id 14432, len 1500)
  2850	17:51:07.963614 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 2897 win 31856 <nop,nop,timestamp 2939787 26458492> (DF) (ttl 64, id 1368, len 52)
  2851	17:51:07.966029 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 26458495 2939783> (DF) (ttl 240, id 14433, len 1477)
  2852	17:51:07.979368 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 26458495 2939783> (DF) (ttl 240, id 14434, len 1500)
  2853	17:51:07.993611 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 5770 win 31856 <nop,nop,timestamp 2939790 26458495> (DF) (ttl 64, id 1369, len 52)
  2854	17:51:07.994648 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 5770:7218(1448) ack 53 win 33304 <nop,nop,timestamp 26458498 2939787> (DF) (ttl 240, id 14435, len 1500)
  2855	17:51:08.005769 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 7218:8418(1200) ack 53 win 33304 <nop,nop,timestamp 26458498 2939787> (DF) (ttl 240, id 14436, len 1252)
  2856	17:51:08.023617 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 8418 win 31856 <nop,nop,timestamp 2939793 26458498> (DF) (ttl 64, id 1370, len 52)
  2857	17:51:08.030363 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 8418:9866(1448) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14437, len 1500)
  2858	17:51:08.043420 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 9866:11314(1448) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14438, len 1500)
  2859	17:51:08.044140 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 11314 win 31856 <nop,nop,timestamp 2939794 26458502> (DF) (ttl 64, id 1371, len 52)
  2860	17:51:08.054055 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 11314:12514(1200) ack 53 win 33304 <nop,nop,timestamp 26458502 2939790> (DF) (ttl 240, id 14439, len 1252)
  2861	17:51:08.065842 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 12514:13962(1448) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14440, len 1500)
  2862	17:51:08.077915 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 13962:15410(1448) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14441, len 1500)
  2863	17:51:08.078661 172.16.183.2.1077 > clusterc.icq.com.http: . [tcp sum ok] ack 15410 win 31856 <nop,nop,timestamp 2939798 26458502> (DF) (ttl 64, id 1372, len 52)
  2864	17:51:08.083061 172.16.183.2.1077 > clusterc.icq.com.http: P [bad tcp cksum cfc5!] 53:104(51) ack 15410 win 31856 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2865	17:51:08.083061 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 53:53(0) ack 15410 win 31856 <nop,nop,timestamp 2939798 26458502> (DF) (ttl 64, id 1373, len 52)
  2866	17:51:08.088288 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 15410:16610(1200) ack 53 win 33304 <nop,nop,timestamp 26458504 2939793> (DF) (ttl 240, id 14442, len 1252)
  2867	17:51:08.089096 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1374, len 40)
  2868	17:51:08.099821 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 16610:18058(1448) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14443, len 1500)
  2869	17:51:08.100613 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1375, len 40)
  2870	17:51:08.112148 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 18058:19506(1448) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14444, len 1500)
  2871	17:51:08.112923 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1376, len 40)
  2872	17:51:08.122291 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 19506:20706(1200) ack 53 win 33304 <nop,nop,timestamp 26458506 2939794> (DF) (ttl 240, id 14445, len 1252)
  2873	17:51:08.123022 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1377, len 40)
  2874	17:51:08.134066 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 20706:22154(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14446, len 1500)
  2875	17:51:08.135031 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1378, len 40)
  2876	17:51:08.145167 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 22154:23602(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14447, len 1500)
  2877	17:51:08.146035 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1379, len 40)
  2878	17:51:08.154803 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 23602:24802(1200) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14448, len 1252)
  2879	17:51:08.155523 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1380, len 40)
  2880	17:51:08.165597 clusterc.icq.com.http > 172.16.183.2.1077: . [tcp sum ok] 24802:26250(1448) ack 53 win 33304 <nop,nop,timestamp 26458510 2939798> (DF) (ttl 240, id 14449, len 1500)
  2881	17:51:08.166310 172.16.183.2.1077 > clusterc.icq.com.http: R [tcp sum ok] 2799686926:2799686926(0) win 0 (ttl 255, id 1381, len 40)
  2882	17:51:10.097264 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50775+ A? web.icq.com. [|domain] (ttl 64, id 1382, len 57)
  2883	17:51:10.109707 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50775 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 20522, len 233)
  2884	17:51:10.111031 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940000 0,nop,wscale 0> (DF) (ttl 64, id 1383, len 60)
  2885	17:51:13.125215 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940301 0,nop,wscale 0> (DF) (ttl 64, id 1384, len 60)
  2886	17:51:19.185144 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2940901 0,nop,wscale 0> (DF) (ttl 64, id 1385, len 60)
  2887	17:51:31.185203 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2942101 0,nop,wscale 0> (DF) (ttl 64, id 1386, len 60)
  2888	17:51:55.236139 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2944501 0,nop,wscale 0> (DF) (ttl 64, id 1387, len 60)
  2889	17:52:43.225298 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2949301 0,nop,wscale 0> (DF) (ttl 64, id 1388, len 60)
  2890	17:54:19.165346 172.16.183.2.1078 > clusterb.icq.com.http: S [tcp sum ok] 3150680822:3150680822(0) win 32120 <mss 1460,sackOK,timestamp 2958901 0,nop,wscale 0> (DF) (ttl 64, id 1389, len 60)
  2891	17:54:19.182776 clusterb.icq.com.http > 172.16.183.2.1078: S [tcp sum ok] 348233785:348233785(0) ack 3150680823 win 65535 <nop,nop,timestamp 201244130 2958901,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 27349, len 64)
  2892	17:54:19.183666 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2958902 201244130> (DF) (ttl 64, id 1390, len 52)
  2893	17:54:20.185730 172.16.183.2.1078 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2959002 201244130> (DF) (ttl 64, id 1391, len 104)
  2894	17:54:20.205712 clusterb.icq.com.http > 172.16.183.2.1078: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 201244233 2959002> (DF) (ttl 240, id 27350, len 52)
  2895	17:54:20.480933 clusterb.icq.com.http > 172.16.183.2.1078: P [tcp sum ok] 1:340(339) ack 53 win 33304 <nop,nop,timestamp 201244259 2959002> (DF) (ttl 240, id 27351, len 391)
  2896	17:54:20.481645 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 340 win 31856 <nop,nop,timestamp 2959045 201244259> (DF) (ttl 64, id 1392, len 52)
  2897	17:54:20.482123 clusterb.icq.com.http > 172.16.183.2.1078: F [tcp sum ok] 340:340(0) ack 53 win 33304 <nop,nop,timestamp 201244260 2959002> (DF) (ttl 240, id 27352, len 52)
  2898	17:54:20.482547 172.16.183.2.1078 > clusterb.icq.com.http: . [tcp sum ok] ack 341 win 31856 <nop,nop,timestamp 2959045 201244260> (DF) (ttl 64, id 1393, len 52)
  2899	17:54:45.241731 172.16.183.2.1078 > clusterb.icq.com.http: F [tcp sum ok] 53:53(0) ack 341 win 31856 <nop,nop,timestamp 2961522 201244260> (DF) (ttl 64, id 1394, len 52)
  2900	17:54:45.258426 172.16.183.2.1078 > clusterb.icq.com.http: P [bad tcp cksum 4050!] 1492520600:1492520651(51) ack 2802447091 win 33304 [tos 0x10]  (ttl 240, id 0, len 91, bad cksum 0!)
  2901	17:54:45.258426 clusterb.icq.com.http > 172.16.183.2.1078: . [tcp sum ok] ack 54 win 33304 <nop,nop,timestamp 201246738 2961522> (DF) (ttl 240, id 27353, len 52)
  2902	17:54:46.247095 172.16.183.2.1025 > ns2.dca.net.domain:  [udp sum ok] 50776+ A? web.icq.com. [|domain] (ttl 64, id 1395, len 57)
  2903	17:54:46.261560 ns2.dca.net.domain > 172.16.183.2.1025:  [udp sum ok] 50776 5/2/2 web.icq.com. CNAME web.web-r.rotors.icq.com., web.web-r.rotors.icq.com. CNAME 1.web-r.rotors.icq.com., 1.web-r.rotors.icq.com. A clusterb.icq.com, 1.web-r.rotors.icq.com. A clusterc.icq.com, 1.web-r.rotors.icq.com. A clustera.icq.com (205) (ttl 61, id 31560, len 233)
  2904	17:54:46.262557 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2961623 0,nop,wscale 0> (DF) (ttl 64, id 1396, len 60)
  2905	17:54:49.255349 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2961923 0,nop,wscale 0> (DF) (ttl 64, id 1397, len 60)
  2906	17:54:55.265009 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2962523 0,nop,wscale 0> (DF) (ttl 64, id 1398, len 60)
  2907	17:55:07.255220 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2963723 0,nop,wscale 0> (DF) (ttl 64, id 1399, len 60)
  2908	17:55:31.265246 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2966123 0,nop,wscale 0> (DF) (ttl 64, id 1400, len 60)
  2909	17:56:19.355034 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2970923 0,nop,wscale 0> (DF) (ttl 64, id 1401, len 60)
  2910	17:57:55.405318 172.16.183.2.1079 > clusterb.icq.com.http: S [tcp sum ok] 3361641695:3361641695(0) win 32120 <mss 1460,sackOK,timestamp 2980523 0,nop,wscale 0> (DF) (ttl 64, id 1402, len 60)
  2911	17:57:55.422333 clusterb.icq.com.http > 172.16.183.2.1079: S [tcp sum ok] 3173761707:3173761707(0) ack 3361641696 win 65535 <nop,nop,timestamp 502026126 2980523,nop,wscale 1,nop,nop,sackOK,mss 1460> (DF) (ttl 240, id 7053, len 64)
  2912	17:57:55.423002 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 1 win 32120 <nop,nop,timestamp 2980524 502026126> (DF) (ttl 64, id 1403, len 52)
  2913	17:57:56.415705 172.16.183.2.1079 > clusterb.icq.com.http: P [tcp sum ok] 1:53(52) ack 1 win 32120 <nop,nop,timestamp 2980624 502026126> (DF) (ttl 64, id 1404, len 104)
  2914	17:57:56.436155 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] ack 53 win 33304 <nop,nop,timestamp 502026228 2980624> (DF) (ttl 240, id 7054, len 52)
  2915	17:57:57.071747 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 1:1449(1448) ack 53 win 33304 <nop,nop,timestamp 502026289 2980624> (DF) (ttl 240, id 7055, len 1500)
  2916	17:57:57.072474 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 1449 win 31856 <nop,nop,timestamp 2980710 502026289> (DF) (ttl 64, id 1405, len 52)
  2917	17:57:57.091945 clusterb.icq.com.http > 172.16.183.2.1079: P [tcp sum ok] 1449:2897(1448) ack 53 win 33304 <nop,nop,timestamp 502026289 2980624> (DF) (ttl 240, id 7056, len 1500)
  2918	17:57:57.108931 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 2897:4322(1425) ack 53 win 33304 <nop,nop,timestamp 502026293 2980710> (DF) (ttl 240, id 7057, len 1477)
  2919	17:57:57.119957 172.16.183.2.1079 > clusterb.icq.com.http: . [tcp sum ok] ack 4322 win 31856 <nop,nop,timestamp 2980716 502026289> (DF) (ttl 64, id 1406, len 52)
  2920	17:57:57.126431 clusterb.icq.com.http > 172.16.183.2.1079: . [tcp sum ok] 4322:5770(1448) ack 53 win 33304 <nop,nop,timestamp 502026293 2980710> (DF) (ttl 240, id 7058, len 1500)
  2921	17:57:57.149958 172.16.183.2.1079 >