Johannes Ullrich was kind enough to donate mydoomp.pcap.gz. The infected system is 10.1.0.129, and 10.0.0.51 is the dns server. Thanks, Johannes!

I also maintain a page of Libpcap, winpcap, libdnet, and libnet applications.