Date: Tue, 24 Jul 2012 08:41:54 -0600 From: Jason Mattax <jmattax@storytotell.org> To: Daniel Hartmeier <daniel@benzedrine.cx> Cc: jmattax@clanspum.net, freebsd-pf@freebsd.org Subject: Re: PF suddenly malfunctioned Message-ID: <500EB432.6050803@storytotell.org> In-Reply-To: <20120724070700.GF32530@insomnia.benzedrine.cx> References: <effb611b289f2b14d345c1cd63c9828a.squirrel@mail.clanspum.net> <20120723100521.GC32530@insomnia.benzedrine.cx> <500E1202.20108@storytotell.org> <20120724070700.GF32530@insomnia.benzedrine.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
--------------060101000404050001020902
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
On 07/24/2012 01:07 AM, Daniel Hartmeier wrote:
> What's the client OS?
>
The client OS for this test is Ubuntu 12.04 LTS
jmattax@chani:~/pf_debugging$ uname -a
Linux chani 3.2.0-26-generic #41-Ubuntu SMP Thu Jun 14 16:26:01 UTC 2012
i686 i686 i386 GNU/Linux
> It looks like it might be an incompatibility between the client and the
> peculiar wikipedia server (or loadbalancer or proxy or whatever there
> is).
>
> Like the GET request gets lost, but the FIN arrives, and the server
> selectively ACKs the FIN, and the client doesn't retransmit the request.
> You ran the tcpdump for several seconds after the netcat was started?
> Maybe repeat it and wait longer, in case the output is buffered. The
> client should re-transmit.
>
I initially ran the tcpdumps until the client had nc return and give me
a new prompt in my shell (that took maybe a second). I just repeated it
as above letting the tcpdumps run longer and it captured the same number
of packets.
> If I tcpdump the same request here, I see the server selectively ACKing
> FINs even when the plain ACK does so, too. I've never seen this before.
>
> Can you try disabling SACK in the client?
>
> OpenBSD: sysctl net.inet.tcp.sack=0
> FreeBSD: sysctl net.inet.tcp.sack.enable=0
> Linux: sysctl net.ipv4.tcp_sack=0
I just did this, it did not change the behavior of nc it still returns
in a non-noticeable amount of time. The attached files with a 2 prefix
are the captures (plus like 30 seconds after) for this test.
The other thing I did was I accessed the wikipedia server at
208.80.154.225 on the firewall. I did this so that I could do the nc
command on the firewall, the output of the tcpdump of which is attached
as xl0_tcpdump_nc and seems to have the same behavior as the nc behind
the firewall. Then I could run links en.wikipedia.org/wiki/Main_Page
(which works about half the time) and capture the tcpdump of that into
the attached xl0_tcpd_links so that people here could look at those
outputs in case they reveal something useful. In this case the links
worked, in the cases where it doesn't I get a message along the bottom
that reads "Received 0 B of 57 kB, avg 0 B/s, cur 0 B/s"
Thanks for continuing to look at this
Jason
--------------060101000404050001020902
Content-Type: text/plain; charset=UTF-8;
name="pflog0_tcpdump2"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="pflog0_tcpdump2"
--------------060101000404050001020902
Content-Type: text/plain; charset=UTF-8;
name="re0_tcpdump2"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="re0_tcpdump2"
08:28:19.083955 IP (tos 0x0, ttl 64, id 4539, offset 0, flags [DF], proto TCP (6), length 60)
10.11.10.45.52111 > 91.198.174.225.80: Flags [S], cksum 0xc9e4 (correct), seq 1860497361, win 14600, options [mss 1460,nop,nop,TS val 3669610 ecr 0,nop,wscale 4], length 0
08:28:19.260717 IP (tos 0x0, ttl 52, id 0, offset 0, flags [DF], proto TCP (6), length 60)
91.198.174.225.80 > 10.11.10.45.52111: Flags [S.], cksum 0xfea4 (correct), seq 3314014153, ack 1860497362, win 5792, options [mss 1460,nop,nop,TS val 657598734 ecr 3669610,nop,wscale 9], length 0
08:28:19.262142 IP (tos 0x0, ttl 64, id 4540, offset 0, flags [DF], proto TCP (6), length 52)
10.11.10.45.52111 > 91.198.174.225.80: Flags [.], cksum 0x3d55 (correct), seq 1860497362, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 0
08:28:19.262738 IP (tos 0x0, ttl 64, id 4541, offset 0, flags [DF], proto TCP (6), length 108)
10.11.10.45.52111 > 91.198.174.225.80: Flags [P.], cksum 0xd56e (correct), seq 1860497362:1860497418, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 56
08:28:19.262880 IP (tos 0x0, ttl 64, id 4542, offset 0, flags [DF], proto TCP (6), length 52)
10.11.10.45.52111 > 91.198.174.225.80: Flags [F.], cksum 0x3d1c (correct), seq 1860497418, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 0
08:28:19.438800 IP (tos 0x0, ttl 52, id 65258, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 10.11.10.45.52111: Flags [.], cksum 0x40c8 (correct), seq 3314014154, ack 1860497362, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.440698 IP (tos 0x0, ttl 52, id 65259, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 10.11.10.45.52111: Flags [.], cksum 0x408f (correct), seq 3314014154, ack 1860497419, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.440930 IP (tos 0x0, ttl 52, id 65260, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 10.11.10.45.52111: Flags [F.], cksum 0x408e (correct), seq 3314014154, ack 1860497419, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.442272 IP (tos 0x0, ttl 64, id 4543, offset 0, flags [DF], proto TCP (6), length 52)
10.11.10.45.52111 > 91.198.174.225.80: Flags [.], cksum 0x3cdc (correct), seq 1860497419, ack 3314014155, win 913, options [nop,nop,TS val 3669699 ecr 657598752], length 0
--------------060101000404050001020902
Content-Type: text/plain; charset=UTF-8;
name="xl0_tcpdump2"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="xl0_tcpdump2"
08:28:19.084320 IP (tos 0x0, ttl 63, id 4539, offset 0, flags [DF], proto TCP (6), length 60)
192.168.0.200.52574 > 91.198.174.225.80: Flags [S], cksum 0x1add (correct), seq 1860497361, win 14600, options [mss 1460,nop,nop,TS val 3669610 ecr 0,nop,wscale 4], length 0
08:28:19.260526 IP (tos 0x0, ttl 53, id 0, offset 0, flags [DF], proto TCP (6), length 60)
91.198.174.225.80 > 192.168.0.200.52574: Flags [S.], cksum 0x4f9d (correct), seq 3314014153, ack 1860497362, win 5792, options [mss 1460,nop,nop,TS val 657598734 ecr 3669610,nop,wscale 9], length 0
08:28:19.262291 IP (tos 0x0, ttl 63, id 4540, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.52574 > 91.198.174.225.80: Flags [.], cksum 0x8e4d (correct), seq 1860497362, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 0
08:28:19.262852 IP (tos 0x0, ttl 63, id 4541, offset 0, flags [DF], proto TCP (6), length 108)
192.168.0.200.52574 > 91.198.174.225.80: Flags [P.], cksum 0x2667 (correct), seq 1860497362:1860497418, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 56
08:28:19.262978 IP (tos 0x0, ttl 63, id 4542, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.52574 > 91.198.174.225.80: Flags [F.], cksum 0x8e14 (correct), seq 1860497418, ack 3314014154, win 913, options [nop,nop,TS val 3669654 ecr 657598734], length 0
08:28:19.438626 IP (tos 0x0, ttl 53, id 65258, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 192.168.0.200.52574: Flags [.], cksum 0x91c0 (correct), seq 3314014154, ack 1860497362, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.440585 IP (tos 0x0, ttl 53, id 65259, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 192.168.0.200.52574: Flags [.], cksum 0x9187 (correct), seq 3314014154, ack 1860497419, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.440823 IP (tos 0x0, ttl 53, id 65260, offset 0, flags [DF], proto TCP (6), length 52)
91.198.174.225.80 > 192.168.0.200.52574: Flags [F.], cksum 0x9186 (correct), seq 3314014154, ack 1860497419, win 12, options [nop,nop,TS val 657598752 ecr 3669654], length 0
08:28:19.442415 IP (tos 0x0, ttl 63, id 4543, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.52574 > 91.198.174.225.80: Flags [.], cksum 0x8dd4 (correct), seq 1860497419, ack 3314014155, win 913, options [nop,nop,TS val 3669699 ecr 657598752], length 0
--------------060101000404050001020902
Content-Type: text/plain; charset=UTF-8;
name="xl0_tcpdump_links"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="xl0_tcpdump_links"
08:12:52.860041 IP (tos 0x0, ttl 64, id 4775, offset 0, flags [DF], proto TCP (6), length 60)
192.168.0.200.27797 > 208.80.154.225.80: Flags [S], cksum 0x74ff (correct), seq 1652546302, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 35518945 ecr 0], length 0
08:12:52.954499 IP (tos 0x0, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 60)
208.80.154.225.80 > 192.168.0.200.27797: Flags [S.], cksum 0x2dc8 (correct), seq 3002976197, ack 1652546303, win 5792, options [mss 1460,sackOK,TS val 1544640939 ecr 35518945,nop,wscale 9], length 0
08:12:52.954796 IP (tos 0x0, ttl 64, id 4777, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x5251 (correct), seq 1652546303, ack 3002976198, win 8326, options [nop,nop,TS val 35519040 ecr 1544640939], length 0
08:12:52.956096 IP (tos 0x0, ttl 64, id 4778, offset 0, flags [DF], proto TCP (6), length 502)
192.168.0.200.27797 > 208.80.154.225.80: Flags [P.], cksum 0xe230 (correct), seq 1652546303:1652546753, ack 3002976198, win 8326, options [nop,nop,TS val 35519041 ecr 1544640939], length 450
08:12:53.055505 IP (tos 0x0, ttl 58, id 40563, offset 0, flags [DF], proto TCP (6), length 52)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x70fc (correct), seq 3002976198, ack 1652546753, win 14, options [nop,nop,TS val 1544640949 ecr 35519041], length 0
08:12:53.058005 IP (tos 0x0, ttl 58, id 40564, offset 0, flags [DF], proto TCP (6), length 591)
208.80.154.225.80 > 192.168.0.200.27797: Flags [P.], cksum 0x61ba (correct), seq 3002976198:3002976737, ack 1652546753, win 14, options [nop,nop,TS val 1544640949 ecr 35519041], length 539
08:12:53.157463 IP (tos 0x0, ttl 64, id 4781, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x4d9f (correct), seq 1652546753, ack 3002976737, win 8326, options [nop,nop,TS val 35519243 ecr 1544640949], length 0
08:12:55.830341 IP (tos 0x0, ttl 58, id 40572, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x1c84 (correct), seq 3002976737:3002978177, ack 1652546753, win 14, options [nop,nop,TS val 1544641226 ecr 35519243], length 1440
08:12:55.830541 IP (tos 0x0, ttl 58, id 40573, offset 0, flags [DF], proto TCP (6), length 60)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xc5b8 (correct), seq 3002978177:3002978185, ack 1652546753, win 14, options [nop,nop,TS val 1544641226 ecr 35519243], length 8
08:12:55.830759 IP (tos 0x0, ttl 64, id 4783, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x3d26 (correct), seq 1652546753, ack 3002978185, win 8145, options [nop,nop,TS val 35521916 ecr 1544641226], length 0
08:12:55.836196 IP (tos 0x0, ttl 58, id 40574, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x62d4 (correct), seq 3002978185:3002979625, ack 1652546753, win 14, options [nop,nop,TS val 1544641226 ecr 35519243], length 1440
08:12:55.836325 IP (tos 0x0, ttl 58, id 40575, offset 0, flags [DF], proto TCP (6), length 60)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x82ce (correct), seq 3002979625:3002979633, ack 1652546753, win 14, options [nop,nop,TS val 1544641226 ecr 35519243], length 8
08:12:55.836468 IP (tos 0x0, ttl 64, id 4784, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x3778 (correct), seq 1652546753, ack 3002979633, win 8145, options [nop,nop,TS val 35521922 ecr 1544641226], length 0
08:12:55.930079 IP (tos 0x0, ttl 58, id 40576, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xa94d (correct), seq 3002979633:3002981073, ack 1652546753, win 14, options [nop,nop,TS val 1544641236 ecr 35521916], length 1440
08:12:55.935479 IP (tos 0x0, ttl 58, id 40577, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xdb42 (correct), seq 3002981073:3002982513, ack 1652546753, win 14, options [nop,nop,TS val 1544641236 ecr 35521916], length 1440
08:12:55.935677 IP (tos 0x0, ttl 64, id 4786, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x2bca (correct), seq 1652546753, ack 3002982513, win 8146, options [nop,nop,TS val 35522021 ecr 1544641236], length 0
08:12:55.935712 IP (tos 0x0, ttl 58, id 40578, offset 0, flags [DF], proto TCP (6), length 68)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x8e80 (correct), seq 3002982513:3002982529, ack 1652546753, win 14, options [nop,nop,TS val 1544641237 ecr 35521922], length 16
08:12:55.941149 IP (tos 0x0, ttl 58, id 40579, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x0393 (correct), seq 3002982529:3002983969, ack 1652546753, win 14, options [nop,nop,TS val 1544641237 ecr 35521922], length 1440
08:12:55.941348 IP (tos 0x0, ttl 64, id 4787, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x2614 (correct), seq 1652546753, ack 3002983969, win 8146, options [nop,nop,TS val 35522026 ecr 1544641237], length 0
08:12:56.034811 IP (tos 0x0, ttl 58, id 40580, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x9f57 (correct), seq 3002983969:3002985409, ack 1652546753, win 14, options [nop,nop,TS val 1544641247 ecr 35522021], length 1440
08:12:56.040200 IP (tos 0x0, ttl 58, id 40581, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xbe37 (correct), seq 3002985409:3002986849, ack 1652546753, win 14, options [nop,nop,TS val 1544641247 ecr 35522021], length 1440
08:12:56.040417 IP (tos 0x0, ttl 64, id 4789, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x1a66 (correct), seq 1652546753, ack 3002986849, win 8146, options [nop,nop,TS val 35522126 ecr 1544641247], length 0
08:12:56.045596 IP (tos 0x0, ttl 58, id 40582, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xdcc6 (correct), seq 3002986849:3002988289, ack 1652546753, win 14, options [nop,nop,TS val 1544641247 ecr 35522026], length 1440
08:12:56.050802 IP (tos 0x0, ttl 58, id 40583, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xb79d (correct), seq 3002988289:3002989729, ack 1652546753, win 14, options [nop,nop,TS val 1544641247 ecr 35522026], length 1440
08:12:56.050982 IP (tos 0x0, ttl 64, id 4790, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x0f1c (correct), seq 1652546753, ack 3002989729, win 8146, options [nop,nop,TS val 35522136 ecr 1544641247], length 0
08:12:56.139742 IP (tos 0x0, ttl 58, id 40584, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x9c13 (correct), seq 3002989729:3002991169, ack 1652546753, win 14, options [nop,nop,TS val 1544641257 ecr 35522126], length 1440
08:12:56.144918 IP (tos 0x0, ttl 58, id 40585, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x20c1 (correct), seq 3002991169:3002992609, ack 1652546753, win 14, options [nop,nop,TS val 1544641257 ecr 35522126], length 1440
08:12:56.145144 IP (tos 0x0, ttl 64, id 4795, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x0374 (correct), seq 1652546753, ack 3002992609, win 8146, options [nop,nop,TS val 35522230 ecr 1544641257], length 0
08:12:56.150073 IP (tos 0x0, ttl 58, id 40586, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x8bbc (correct), seq 3002992609:3002994049, ack 1652546753, win 14, options [nop,nop,TS val 1544641258 ecr 35522136], length 1440
08:12:56.155498 IP (tos 0x0, ttl 58, id 40587, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x1d16 (correct), seq 3002994049:3002995489, ack 1652546753, win 14, options [nop,nop,TS val 1544641258 ecr 35522136], length 1440
08:12:56.155675 IP (tos 0x0, ttl 64, id 4796, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xf827 (correct), seq 1652546753, ack 3002995489, win 8146, options [nop,nop,TS val 35522241 ecr 1544641258], length 0
08:12:56.244469 IP (tos 0x0, ttl 58, id 40588, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x984a (correct), seq 3002995489:3002996929, ack 1652546753, win 14, options [nop,nop,TS val 1544641268 ecr 35522230], length 1440
08:12:56.249614 IP (tos 0x0, ttl 58, id 40589, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x47c6 (correct), seq 3002996929:3002998369, ack 1652546753, win 14, options [nop,nop,TS val 1544641268 ecr 35522230], length 1440
08:12:56.249813 IP (tos 0x0, ttl 64, id 4798, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xec7f (correct), seq 1652546753, ack 3002998369, win 8146, options [nop,nop,TS val 35522335 ecr 1544641268], length 0
08:12:56.255024 IP (tos 0x0, ttl 58, id 40590, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x3e96 (correct), seq 3002998369:3002999809, ack 1652546753, win 14, options [nop,nop,TS val 1544641269 ecr 35522241], length 1440
08:12:56.260450 IP (tos 0x0, ttl 58, id 40591, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x7dd8 (correct), seq 3002999809:3003001249, ack 1652546753, win 14, options [nop,nop,TS val 1544641269 ecr 35522241], length 1440
08:12:56.260629 IP (tos 0x0, ttl 64, id 4799, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xe133 (correct), seq 1652546753, ack 3003001249, win 8146, options [nop,nop,TS val 35522346 ecr 1544641269], length 0
08:12:56.348670 IP (tos 0x0, ttl 58, id 40592, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x0797 (correct), seq 3003001249:3003002689, ack 1652546753, win 14, options [nop,nop,TS val 1544641278 ecr 35522335], length 1440
08:12:56.353834 IP (tos 0x0, ttl 58, id 40593, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x224a (correct), seq 3003002689:3003004129, ack 1652546753, win 14, options [nop,nop,TS val 1544641278 ecr 35522335], length 1440
08:12:56.354021 IP (tos 0x0, ttl 64, id 4801, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xd58d (correct), seq 1652546753, ack 3003004129, win 8146, options [nop,nop,TS val 35522439 ecr 1544641278], length 0
08:12:56.359255 IP (tos 0x0, ttl 58, id 40594, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x72e7 (correct), seq 3003004129:3003005569, ack 1652546753, win 14, options [nop,nop,TS val 1544641278 ecr 35522335], length 1440
08:12:56.364446 IP (tos 0x0, ttl 58, id 40595, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x2305 (correct), seq 3003005569:3003007009, ack 1652546753, win 14, options [nop,nop,TS val 1544641279 ecr 35522346], length 1440
08:12:56.364653 IP (tos 0x0, ttl 64, id 4802, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xca42 (correct), seq 1652546753, ack 3003007009, win 8146, options [nop,nop,TS val 35522450 ecr 1544641278], length 0
08:12:56.369841 IP (tos 0x0, ttl 58, id 40596, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x2fa0 (correct), seq 3003007009:3003008449, ack 1652546753, win 14, options [nop,nop,TS val 1544641279 ecr 35522346], length 1440
08:12:56.453412 IP (tos 0x0, ttl 58, id 40597, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xbd99 (correct), seq 3003008449:3003009889, ack 1652546753, win 14, options [nop,nop,TS val 1544641289 ecr 35522439], length 1440
08:12:56.453619 IP (tos 0x0, ttl 64, id 4804, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xbea8 (correct), seq 1652546753, ack 3003009889, win 8146, options [nop,nop,TS val 35522539 ecr 1544641279], length 0
08:12:56.458548 IP (tos 0x0, ttl 58, id 40598, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xeb3d (correct), seq 3003009889:3003011329, ack 1652546753, win 14, options [nop,nop,TS val 1544641289 ecr 35522439], length 1440
08:12:56.464208 IP (tos 0x0, ttl 58, id 40599, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x4237 (correct), seq 3003011329:3003012769, ack 1652546753, win 14, options [nop,nop,TS val 1544641290 ecr 35522450], length 1440
08:12:56.464395 IP (tos 0x0, ttl 64, id 4805, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xb353 (correct), seq 1652546753, ack 3003012769, win 8146, options [nop,nop,TS val 35522550 ecr 1544641289], length 0
08:12:56.464929 IP (tos 0x0, ttl 58, id 40600, offset 0, flags [DF], proto TCP (6), length 220)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x3783 (correct), seq 3003012769:3003012937, ack 1652546753, win 14, options [nop,nop,TS val 1544641290 ecr 35522450], length 168
08:12:56.552926 IP (tos 0x0, ttl 58, id 40601, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x9d72 (correct), seq 3003012937:3003014377, ack 1652546753, win 14, options [nop,nop,TS val 1544641298 ecr 35522539], length 1440
08:12:56.553124 IP (tos 0x0, ttl 64, id 4807, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xacb2 (correct), seq 1652546753, ack 3003014377, win 8146, options [nop,nop,TS val 35522638 ecr 1544641290], length 0
08:12:56.558079 IP (tos 0x0, ttl 58, id 40602, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x1835 (correct), seq 3003014377:3003015817, ack 1652546753, win 14, options [nop,nop,TS val 1544641298 ecr 35522539], length 1440
08:12:56.564009 IP (tos 0x0, ttl 58, id 40603, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xb1c3 (correct), seq 3003015817:3003017257, ack 1652546753, win 14, options [nop,nop,TS val 1544641300 ecr 35522550], length 1440
08:12:56.564189 IP (tos 0x0, ttl 64, id 4808, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0xa15f (correct), seq 1652546753, ack 3003017257, win 8146, options [nop,nop,TS val 35522649 ecr 1544641298], length 0
08:12:56.569152 IP (tos 0x0, ttl 58, id 40604, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x24d8 (correct), seq 3003017257:3003018697, ack 1652546753, win 14, options [nop,nop,TS val 1544641300 ecr 35522550], length 1440
08:12:56.651945 IP (tos 0x0, ttl 58, id 40605, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x52ad (correct), seq 3003018697:3003020137, ack 1652546753, win 14, options [nop,nop,TS val 1544641308 ecr 35522638], length 1440
08:12:56.652164 IP (tos 0x0, ttl 64, id 4810, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x95c5 (correct), seq 1652546753, ack 3003020137, win 8146, options [nop,nop,TS val 35522737 ecr 1544641300], length 0
08:12:56.657127 IP (tos 0x0, ttl 58, id 40606, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xf2e9 (correct), seq 3003020137:3003021577, ack 1652546753, win 14, options [nop,nop,TS val 1544641308 ecr 35522638], length 1440
08:12:56.663285 IP (tos 0x0, ttl 58, id 40607, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x5f8e (correct), seq 3003021577:3003023017, ack 1652546753, win 14, options [nop,nop,TS val 1544641310 ecr 35522649], length 1440
08:12:56.663455 IP (tos 0x0, ttl 64, id 4811, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x8a71 (correct), seq 1652546753, ack 3003023017, win 8146, options [nop,nop,TS val 35522749 ecr 1544641308], length 0
08:12:56.668915 IP (tos 0x0, ttl 58, id 40608, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xf0e8 (correct), seq 3003023017:3003024457, ack 1652546753, win 14, options [nop,nop,TS val 1544641310 ecr 35522649], length 1440
08:12:56.751236 IP (tos 0x0, ttl 58, id 40609, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x742c (correct), seq 3003024457:3003025897, ack 1652546753, win 14, options [nop,nop,TS val 1544641318 ecr 35522737], length 1440
08:12:56.751439 IP (tos 0x0, ttl 64, id 4813, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x7ed7 (correct), seq 1652546753, ack 3003025897, win 8146, options [nop,nop,TS val 35522837 ecr 1544641310], length 0
08:12:56.756406 IP (tos 0x0, ttl 58, id 40610, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xcf00 (correct), seq 3003025897:3003027337, ack 1652546753, win 14, options [nop,nop,TS val 1544641318 ecr 35522737], length 1440
08:12:56.762075 IP (tos 0x0, ttl 58, id 40611, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x5a81 (correct), seq 3003027337:3003028777, ack 1652546753, win 14, options [nop,nop,TS val 1544641319 ecr 35522749], length 1440
08:12:56.762248 IP (tos 0x0, ttl 64, id 4814, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x7385 (correct), seq 1652546753, ack 3003028777, win 8146, options [nop,nop,TS val 35522847 ecr 1544641318], length 0
08:12:56.767478 IP (tos 0x0, ttl 58, id 40612, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x0bf2 (correct), seq 3003028777:3003030217, ack 1652546753, win 14, options [nop,nop,TS val 1544641319 ecr 35522749], length 1440
08:12:56.850310 IP (tos 0x0, ttl 58, id 40613, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xaabe (correct), seq 3003030217:3003031657, ack 1652546753, win 14, options [nop,nop,TS val 1544641328 ecr 35522837], length 1440
08:12:56.850531 IP (tos 0x0, ttl 64, id 4816, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x67eb (correct), seq 1652546753, ack 3003031657, win 8146, options [nop,nop,TS val 35522936 ecr 1544641319], length 0
08:12:56.855658 IP (tos 0x0, ttl 58, id 40614, offset 0, flags [DF], proto TCP (6), length 1492)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0xb1cb (correct), seq 3003031657:3003033097, ack 1652546753, win 14, options [nop,nop,TS val 1544641328 ecr 35522837], length 1440
08:12:56.859244 IP (tos 0x0, ttl 58, id 40615, offset 0, flags [DF], proto TCP (6), length 1005)
208.80.154.225.80 > 192.168.0.200.27797: Flags [P.], cksum 0xb8fe (correct), seq 3003033097:3003034050, ack 1652546753, win 14, options [nop,nop,TS val 1544641328 ecr 35522837], length 953
08:12:56.859422 IP (tos 0x0, ttl 64, id 4817, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x5e44 (correct), seq 1652546753, ack 3003034050, win 8206, options [nop,nop,TS val 35522945 ecr 1544641328], length 0
08:13:15.867863 IP (tos 0x0, ttl 58, id 40616, offset 0, flags [DF], proto TCP (6), length 52)
208.80.154.225.80 > 192.168.0.200.27797: Flags [F.], cksum 0x76d4 (correct), seq 3003034050, ack 1652546753, win 14, options [nop,nop,TS val 1544643231 ecr 35522945], length 0
08:13:15.868091 IP (tos 0x0, ttl 64, id 5173, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [.], cksum 0x0c1c (correct), seq 1652546753, ack 3003034051, win 8326, options [nop,nop,TS val 35541953 ecr 1544643231], length 0
08:13:16.701079 IP (tos 0x0, ttl 64, id 5174, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.27797 > 208.80.154.225.80: Flags [F.], cksum 0x08da (correct), seq 1652546753, ack 3003034051, win 8326, options [nop,nop,TS val 35542786 ecr 1544643231], length 0
08:13:16.794496 IP (tos 0x0, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 52)
208.80.154.225.80 > 192.168.0.200.27797: Flags [.], cksum 0x28f6 (correct), seq 3003034051, ack 1652546754, win 14, options [nop,nop,TS val 1544643323 ecr 35542786], length 0
--------------060101000404050001020902
Content-Type: text/plain; charset=UTF-8;
name="xl0_tcpdump_nc"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="xl0_tcpdump_nc"
08:11:44.351453 IP (tos 0x0, ttl 64, id 4689, offset 0, flags [DF], proto TCP (6), length 60)
192.168.0.200.21231 > 208.80.154.225.80: Flags [S], cksum 0x8450 (correct), seq 2864621746, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 35450436 ecr 0], length 0
08:11:44.447520 IP (tos 0x0, ttl 58, id 0, offset 0, flags [DF], proto TCP (6), length 60)
208.80.154.225.80 > 192.168.0.200.21231: Flags [S.], cksum 0x125a (correct), seq 1253516475, ack 2864621747, win 5792, options [mss 1460,sackOK,TS val 1034923549 ecr 35450436,nop,wscale 9], length 0
08:11:44.447806 IP (tos 0x0, ttl 64, id 4691, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.21231 > 208.80.154.225.80: Flags [.], cksum 0x36e1 (correct), seq 2864621747, ack 1253516476, win 8326, options [nop,nop,TS val 35450533 ecr 1034923549], length 0
08:11:44.455698 IP (tos 0x0, ttl 64, id 4692, offset 0, flags [DF], proto TCP (6), length 108)
192.168.0.200.21231 > 208.80.154.225.80: Flags [P.], cksum 0xcef2 (correct), seq 2864621747:2864621803, ack 1253516476, win 8326, options [nop,nop,TS val 35450541 ecr 1034923549], length 56
08:11:44.455898 IP (tos 0x0, ttl 64, id 4693, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.21231 > 208.80.154.225.80: Flags [F.], cksum 0x36a0 (correct), seq 2864621803, ack 1253516476, win 8326, options [nop,nop,TS val 35450541 ecr 1034923549], length 0
08:11:44.551876 IP (tos 0x0, ttl 58, id 35483, offset 0, flags [DF], proto TCP (6), length 64)
208.80.154.225.80 > 192.168.0.200.21231: Flags [.], cksum 0x79e3 (correct), seq 1253516476, ack 2864621747, win 12, options [nop,nop,TS val 1034923560 ecr 35450533,nop,nop,sack 1 {2864621803:2864621804}], length 0
08:11:44.553442 IP (tos 0x0, ttl 58, id 35484, offset 0, flags [DF], proto TCP (6), length 52)
208.80.154.225.80 > 192.168.0.200.21231: Flags [.], cksum 0x570f (correct), seq 1253516476, ack 2864621804, win 12, options [nop,nop,TS val 1034923560 ecr 35450541], length 0
08:11:44.553677 IP (tos 0x0, ttl 58, id 35485, offset 0, flags [DF], proto TCP (6), length 52)
208.80.154.225.80 > 192.168.0.200.21231: Flags [F.], cksum 0x570e (correct), seq 1253516476, ack 2864621804, win 12, options [nop,nop,TS val 1034923560 ecr 35450541], length 0
08:11:44.553913 IP (tos 0x0, ttl 64, id 4695, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.200.21231 > 208.80.154.225.80: Flags [.], cksum 0x3633 (correct), seq 2864621804, ack 1253516477, win 8325, options [nop,nop,TS val 35450639 ecr 1034923560], length 0
--------------060101000404050001020902--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?500EB432.6050803>