Generated by PacketSnitch 4.0.0 on 10/28/2026, 4:18:49 PM — packetsnitch.com
| Metric | Value |
|---|---|
| Total packets | 794 |
| Total streams | 12 |
| Total traffic | 42.72 KB |
| Upstream | 21.18 KB |
| Downstream | 21.38 KB |
| Internet hosts | 1 |
| Encrypted packets | 0 |
| Unencrypted packets | 794 |
| Undecodable packets | 0 |
| Bookmarks | 0 |
| Stream length (avg / min / max) | 66.17 / 8 / 668 packets |
| TCP retransmissions | 0 |
| Out-of-order segments | 34 |
| Heatmap hits | 704 |
Protocols: ICMP, TCP (network/transport); FTP decoded at application layer. MIME types: application/octet-stream, text/plain, video/mpeg.
Hosts & ports:
172.24.20.31 ↔ 171.64.20.62 (UIT-DLZZWL3.stanford.edu) — 794 packets each.https://tinyurl.com/yr5zprz4 (28–29 bytes; trailing-dot variant also observed). Unrelated to the FTP session.global_thermonuclear_war.gamerules.txt (29 bytes) transferred; entries show zero content length with wildcard previews, indicating empty or placeholder transfers.172.24.20.31 and 171.64.20.62 (hostname: UIT-DLZZWL3.stanford.edu), both sending 794 packets eachglobal_thermonuclear_war.gamerules.txt (29 bytes) captured at packets #153 and #211 — both entries show zero content length with wildcard previews, indicating empty or placeholder transfersTCP FTP.credentials.username Username / TCP FTP.Credentials.username)an***usna***.. — likely a different FTP message field rather than a distinct credential; treat as one credential instancehttps://tinyurl.com/yr5zprz4 (28 bytes) added at 14:17:51Z via context menu, unrelated to the FTP sessionSix decode operations were performed on hex-formatted plaintext payloads, all yielding ASCII character sequences:
| Entry | Decoded Output | Notes |
|---|---|---|
| 1 | EX MACHINA AVAL | Partial/truncated string |
| 2 | EXMACHINAEVA | Continuous character sequence |
| 3 | EXMACHINA AVA | With space separator |
| 4 | EXMACHINEAVA | With embedded CR/LF sequences |
| 5–6 | i.wegrsxee.e | 12-byte hex 69 88 77 65 67 72 73 78 65 65 86 65; bytes 0x88/0x86 non-printable; Shannon entropy 2.92 (low redundancy); MIME application/octet-stream; hostname/domain-like fragment |
EX MACHINA / AVA variants appear across multiple decode attempts of the same underlying data with minor formatting differences (spaces, CR/LF, truncation)i.wegrsxee.e sequence is a distinct payload with low entropy, suggesting a Base64-encoded or alphanumeric identifier fragment rather than natural languageglobal_thermonuclear_war.gamerules.txt transfers appear empty/placeholder despite the 29-byte size labelUIT-DLZZWL3.stanford.edu (171.64.20.62). Geographic footprint: San Carlos, United States (704 heatmap hits).All FTP activity targets host 171.64.20.62.
| Packet | Credential / File | Detail |
|---|---|---|
| #1 | URL https://tinyurl.com/yr5zprz4. | Near-duplicate tinyurl links from session-auto-uri; trailing-dot variant |
| #152, #210 | global_thermonuclear_war.gamerules.txt (29 bytes) | Duplicate transfer across packets |
| #158 | FTP username (9-byte, an***us) | Captured twice under different labels/sources — duplicate |
| #160 | FTP username (27-byte, na***..) | Distinct credential, likely second FTP user |
Club Tux.txt (127 bytes): UTF-8 buffer with BOM containing char()-encoded ASCII; manual conv-import tokens across body/line entries (4 total, 8–124 bytes). Decoded content: EXMACHINAAVA (char(69) char(88) char(77) char(65) char(67) char(72) char(73) char(78) char(65) char(65) char(86) char(65)), Shannon entropy 3.66.XMACHINAAVA, 11 bytes) viewed separately in conversions workspace (entropy 2.73) — subset of the full EXMACHINAAVA sequence.https://tinyurl.com/yr5zprz4. (29 bytes, entropy 4.16) from packet #1 conversions.char()-style obfuscation in Club Tux.txt goodie imports is unusual and worth flagging.