Ok, I think I found something in your original tcpdump:

Nov 11 15:15:04.389556 failinghost.domain.com.ftp > 
ftp-proxy.domain.com.48293: P 202:233(31) ack 56 win 46 
<nop,nop,timestamp 172680957 3630957581> (DF) [tos 0x10]
   0000: 4510 0053 7066 4000 4006 0292 c2f5 20b4  [EMAIL PROTECTED]@...C5 B4
   0010: c2f5 20fe 0015 bca5 48d1 b99c bc2d 18c1  C5 C>..B<B%HCB9.B<-.C  
 0020: 8018 002e b0fa 0000 0101 080a 0a4a e6fd  ....B0C:.......JC&C=
   0030: d86c 040d 3235 3720 222f 2220 6973 2063  CCC

Reply via email to