Some bug or or Zaba broken?

It's important to get the data out, first... Then maybe, if I find time, some talking about it. Just, it appears to me, it could be two things: a bug, maybe related to the '.' instead of ',' in HR-encoding (US has '.' as separator in currency values, Croatia has ','). Or this bank would keep silent to its clients about the failure of its internet banking. If that latter (and I couldn't get them on the phone, could be too many queries), that's just not right.

While preparing to post, I retried. First, without the's (my hoster) invoice. It went fine. Then also I was able to pay my hoster's invoice... Phew!... So it is likely the bank, and it was like that for hours (I know it was like that since late --but not very late-- this morning)... Could it be related to Spectre or Meltdown (in case it was the bank, not a bug on this side)? We could know if maybe some employee whispered to us about it...


By uncenz:



WARNING: Familiarity with and use of some Unix-like OS such as GNU/Linux or BSD, (or being able to use Cygwin on Windows but I haven't tested that yet) is required to be able to follow.

Most of the original files of this section are produced with my (primitive) set of scripts:


Notice there are different scripts there, some I use for minimal anonymization of the dumps ( Ah, and another could be useful for downloading, instead of of click-downloading each file in a list (

For analysis/stream extraction I often use my modest and lacking in good programming practices, but doing what I created them for, scripts:




as well as:

workPCAPs which can run tshark-streams and tshark-hosts-conv on a lot of PCAPs non-interactively.

Readers are advised to try and analyze the traffic dumps for themselves, with the above programs (I also try to offer some educational usefulness to them). There would anyway be too little point posting all the streams and the listings that those would produce. I usually post just the ones among that produce which are crucial for the discussion in question.

And just another one thing: I post lots of command lines and snippets of scripts. Be aware that some of those are in HTML, so before using them, check that they correspond to what the page shows, and of course, report (find miro.rovis or such at the front page of back to me the typoes and errors if you find any.

The files necessary for this study are listed in:



and verify to: ls-1.sum signed by: ls-1.sum.asc