Solved: iptables - firewall computer not connecting to Remote Servers 443 Port

Create Account

Linux Security

Questions

Followers

Top Experts

tasha69

iptables - firewall computer not connecting to Remote Servers 443 Port

Hii,
I am stuck, I think i have tryed every combo but cant get my "FIREWALL" computer to connect to REMOTE SERVERS 443 Port (HTTPS). The windows machines on my LAN have no problem connecting to HTTPS websites...Can you give me an idea why i cant connect from the firewall machine itself...Is the rules for port 443 wrong...Any help? or something i can try? Here are my rules:
RedHat 7.2
Kernel 2.4.19
Iptables 1.2.7a

#!/bin/bash

# Enable broadcast echo protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
      echo 0 > $f
done

# Enable syn cookie protection.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptence
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
      echo 0 > $f
done

# Drop spoofed packets comeing in on an interface, ehich if replied
# to,would result the reply going out another interface.
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done

# Dont't send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
      echo 0 > $f
done

# Log packets with impossiable addreses.
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $f
done

# This will also update my ipaddress.
IP_INET=`/sbin/ifconfig eth0 | grep inet | cut -d: -f2 | cut -d\ -f1`

# Remove any existing rules from all chains.
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush

# Unlimited access on the loopback interface.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Set the default policy to drop.
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT DROP

iptables -t nat --policy PREROUTING ACCEPT
iptables -t nat --policy OUTPUT ACCEPT
iptables -t nat --policy POSTROUTING ACCEPT

iptables -t mangle --policy PREROUTING ACCEPT
iptables -t mangle --policy OUTPUT ACCEPT

# All of the bits are cleared
#iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
#iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
#iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOG
# SYN and FIN are both set
#iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG
# SYN and RST are both set.
#iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG
# FIN and RST are both set
#iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j REJECT
#iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
#iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG
# FIN is the only bit set, without the expected accompanyuing ACK
#iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
#iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j REJECT
#iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG
# PSH is the only bit set, without the expected accompaying ACK
#iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
#iptables -A FORWARD -p tcp --tcp-flags ACK,PSH PSH -j REJECT
#iptables -I INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG
# URG is the only bit set, without the expected accompayning ACK
#iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
#iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j DROP
#iptables -I INPUT -p tcp --tcp-flags ACK,URG URG -j LOG

# Allow stateful connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Drop Invalid connection
iptables -A INPUT -m state --state INVALID -j LOG \
--log-prefix "Invalid input: "
iptables -A INPUT -m state --state INVALID -j DROP

iptables -A OUTPUT -m state --state INVALID -j LOG \
--log-prefix "Invalid output: "
iptables -A OUTPUT -m state --state INVALID -j DROP

iptables -A FORWARD -m state --state INVALID -j LOG \
--log-prefix "Invalid forward: "
iptables -A FORWARD -m state --state INVALID -j DROP

# Dropped packets that pretend to be coming in from PRIVATE ADDRESSes.
iptables -A INPUT -i eth0 -s 10.0.0.1/8 -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.1/8 -j DROP
iptables -A INPUT -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.0.0/24 -j DROP
# iptables -A INPUT -i eth0 -s 127.0.0.1/8 -j DROP
iptables -A FORWARD -i eth0 -s 127.0.0.1/8 -j DROP

# Allow Access for DNS UDP for my ISP DNS server.
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p udp \
-s $IP_INET --sport 1024:65535 \
-d 229.53.4.130 --dport 53 \
-m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
-s $IP_INET --sport 1024:65535 \
-d 229.53.4.130 --dport 53 -j ACCEPT

if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p udp \
-s $IP_INET --sport 1024:65535 \
-d 229.53.4.150 --dport 53 \
-m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
-s $IP_INET --sport 1024:65535 \
-d 229.53.4.150 --dport 53 -j ACCEPT

# Allow access for my ISP DHCP server.
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p udp \
-s $IP_NET --sport 1024:65535 \
-d 229.53.4.129 --dport 67 \
-m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
-s $IP_INET --sport 1024:65535 \
-d 229.53.4.129 --dport 67 -j ACCEPT

iptables -A INPUT -i eth0 -p udp \
-s 229.53.4.129 --sport 67 \
-d $IP_INET --dport 1024:65535 -j ACCEPT

# Allow access to remote webservers PORT 80.
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p tcp \
-s $IP_INET --sport 1024:65535 \
--dport 80 -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p tcp \
-s $IP_INET --sport 1024:65535 \
--dport 80 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp ! --syn \
--sport 80 \
-d $IP_INET --dport 1024:65535 -j ACCEPT

# Attempt to connect to HHTPS connections.
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p tcp \
-m state --state NEW --dport 443 \
--sport 1024:65535 \
-j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p tcp \
-s $IP_INET --sport 1024:65535 \
--dport 443 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp \
--sport 443 \
-d $IP_INET --dport 1024:65535 -j ACCEPT

# Fragmented ICMP Messages.
iptables -A INPUT -i eth0 --fragment -p icmp -j LOG \
--log-prefix "Fragmented ICMP: "
iptables -A INPUT -i eth0 --fragment -p icmp -j DROP \

# Source Quench Control
iptables -A INPUT -i eth0 -p icmp \
--icmp-type source-quench -d $IP_INET -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type source-quench -j ACCEPT

# Parameter Problem Status.
iptables -A INPUT -i eth0 -p icmp \
--icmp-type parameter-problem -d $IP_INET -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type parameter-problem -j ACCEPT

# Destination Unreachable Error.
iptables -A INPUT -i eth0 -p icmp \
--icmp-type destination-unreachable -d $IP_INET -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type fragmentation-needed -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type destination-unreachable -j DROP

# Time Exceeded Status
iptables -A INPUT -i eth0 -p icmp \
--icmp-type time-exceeded -d $IP_INET -j ACCEPT

# Allow Outgoing pings to remote hosts
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type echo-request \
-m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type echo-request -j ACCEPT

# Incoming ping from Remote Hosts.
if [ "$CONNECTION_TRACKING" = "1" ]; then
iptables -A INPUT -i eth0 -p icmp \
-s 229.53.1.231 --icmp-type echo-request -d $IP_INET \
-m state --state NEW -j ACCEPT
fi

iptables -A INPUT -i eth0 -p icmp \
-s 229.53.1.231 --icmp-type echo-request -d $IP_INET -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp \
-s $IP_INET --icmp-type echo-reply -d 209.53.1.231 -j ACCEPT

# Fowarding is allowed in the direction
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -j ACCEPT

# Enables Packet Forwarding
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

Mihai Barbos🇨🇭

But does it accept connections to HTTP servers ?
Anyway you can add a rule to log tcp packets and get a better ideea about what's going on

tasha69

ASKER

Yes it connects to HTTP servers and i just created a rule for FTP servers also and it connects to FTP's now too.Just not HTTPS servers. I tryed iptables -Z and then iptables -vnL to see where that packets may get lost but dont see anywhere where there going!

ahoffmann🇩🇪

please post result of:
iptables -n -L|egrep -i 'policy|80|443'

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

Chain INPUT (policy DROP)
ACCEPT TCP -- 0.0.0.0/0 199.173.61.96 tcp spt:80 dpts:1024
:65535 flags:!0x16/0x02
ACCEPT TCP -- 0.0.0.0/0 199.173.61.96 tcp spt:443dpts:1024
:65535
Chain FORWARD (policy DROP)
Chain OUPUT (policy DROP)
ACCEPT TCP -- 199.173.61.96 0.0.0.0/0 tcp spt:1024:65535 dpts:80
ACCEPT TCP -- 199.173.61.96 0.0.0.0/0 tcp spt:1024:65535
dpts:443

ahoffmann🇩🇪

I'm uncertian if iptables treats an answer to a connection to a foreign port 80 as NEW or RELATED. AFAIK it is RELATED, so try to set $CONNECTION_TRACKING to 0
(didn't check what else happens in your script then)

tasha69

ASKER

Hmm i tryed setting the connectiong tracking to 0 and still didnt work?

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

Mihai Barbos🇨🇭

My ideea was that you add a rule like
iptables -A INPUT -p tcp -j LOG
for each chain and try to make a https connection.
Ofcourse for normal operation a rule like this would be baaad, but for one attempt, it should show what's happening

tasha69

ASKER

Here is the output of the rules i created:
iptables -A INPUT -p tcp -j LOG
iptables -A OUTPUT -p tcp -j LOG
###########################################################
Nov 8 01:25:56 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4020 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:25:57 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4021 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:00 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14483 DF PROTO=TCP SPT=4021 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:03 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4022 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:03 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:03 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4024 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:03 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4025 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:06 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4026 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:06 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4027 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:09 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16216 DF PROTO=TCP SPT=4027 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:15 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16217 DF PROTO=TCP SPT=4027 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:27 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16218 DF PROTO=TCP SPT=4027 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:26:51 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16219 DF PROTO=TCP SPT=4027 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:23 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4028 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:24 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4029 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:24 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4030 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:24 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4031 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:24 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4032 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:28 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4033 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:29 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:32 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30687 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:38 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30688 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:27:50 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30689 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:28:14 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30690 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:29:02 c9Rw113y54tl kernel: IN= OUT=eth0 SRC=222.222.61.96 DST=142.205.209.80 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30691 DF PROTO=TCP SPT=4034 DPT=443 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Nov 8 01:31:11 c9Rw113y54tl modprobe: modprobe: Can't locate module char-major-14
Nov 8 01:32:14 c9Rw113y54tl last message repeated 3 times
Nov 8 01:33:28 c9Rw113y54tl last message repeated 3 times
>>>>>>>>>>>>>>NOT MY REAL IPADDRESS BUT REAL DST ADDRESS<<<<<<<<<<<<

Mihai Barbos🇨🇭

I think that something is really wrong. The rules you've added come after the https rules, right ?
If that's so, you have the rules you checked earlier:
Chain INPUT (policy DROP)
ACCEPT TCP -- 0.0.0.0/0 199.173.61.96 tcp spt:80 dpts:1024:65535 flags:!0x16/0x02
ACCEPT TCP -- 0.0.0.0/0 199.173.61.96 tcp spt:443dpts:1024:65535
Chain FORWARD (policy DROP)
Chain OUPUT (policy DROP)
ACCEPT TCP -- 199.173.61.96 0.0.0.0/0 tcp spt:1024:65535 dpts:80
ACCEPT TCP -- 199.173.61.96 0.0.0.0/0 tcp spt:1024:65535 dpts:443

If I can read,the log shows tcp packets that do not pass through the last rule, although they should.
I'm not familiar with RH but did you also apply the patch-o-matic to the kernel sources ?

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

Ok here is the output from putting the rules right after my HTTPS(port443) rules:
iptables -A INPUT -p tcp -j LOG
iptables -A OUTPUT -p tcp -j LOG

MAC=00:45:8a:ca:da:d3:00:03:42:1e:c0:45:08:00 SRC=207.68.172.246 DST=222.222.61.96 LEN=40 TOS=0x08 PREC=0x20 TTL=60 ID=63000 PROTO=TCP SPT=80 DPT=3618 WINDOW=16384 RES=0x00 ACK RST URGP=0
Nov 8 02:13:15 c7fd3113y54tl kernel: IN=eth0 OUT= MAC=00:45:8a:ca:da:d3:00:03:42:1e:c0:45:08:00 SRC=207.68.171.244 DST=222.222.61.96 LEN=40 TOS=0x08 PREC=0x20 TTL=60 ID=61897 PROTO=TCP SPT=80 DPT=3614 WINDOW=16384 RES=0x00 ACK RST URGP=0
Nov 8 02:13:15 c7fd3113y54tl kernel: IN=eth0 OUT= MAC=00:45:8a:ca:da:d3:00:03:42:1e:c0:45:08:00 SRC=207.68.178.236 DST=222.222.61.96 LEN=40 TOS=0x08 PREC=0x20 TTL=61 ID=47286 PROTO=TCP SPT=80 DPT=3620 WINDOW=16384 RES=0x00 ACK RST URGP=0
Nov 8 02:19:40 c7fd3113y54tl kernel: IN=eth0 OUT= MAC=00:45:8a:ca:da:d3:00:03:42:1e:c0:45:08:00 SRC=202.105.110.111 DST=222.222.61.96 LEN=48 TOS=0x08 PREC=0x20 TTL=105 ID=45852 DF PROTO=TCP SPT=3948 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0
Nov 8 02:19:40 c7fd3113y54tl kernel: IN=eth0 OUT= MAC=00:45:8a:ca:da:d3:00:03:42:1e:c0:45:08:00 SRC=202.105.110.111 DST=222.222.61.96 LEN=48 TOS=0x08 PREC=0x20 TTL=105 ID=45852 DF PROTO=TCP SPT=3948 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0

>>>>>>>>>>>>>>>>>Thats alll it logged when i put the log rules right after the HTTPS rules<<<<<<<<<<<<<<<<<<<<<<

Im not sure what you mean about applying the P-O-M to the kernel source!

ahoffmann🇩🇪

it's hard to guess which rule is wrong, or which need to be set without having the complete rule set (I mean iptables -L -n -v, not the script generating the rules).

Best is you start testing with a clean iptables ruleset, means nothing in there except the INPUT/OUTPUT rules for port 443, then insert the other rule(generated by the script) in the appropriate order, and check when you connection fails.

tasha69

ASKER

Hmmm i commented out all the rules except these ones and still didnt work? What was the comment about the P-O-M i didnt understand that part.:)

# This will also update my ipaddress.
IP_INET=`/sbin/ifconfig eth0 | grep inet | cut -d: -f2 | cut -d\ -f1`

# Remove any existing rules from all chains.
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush

# Unlimited access on the loopback interface.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Set the default policy to drop.
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT DROP

# Allow stateful connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -m state --state NEW -j ACCEPT

Forwarding is allowed in the direction
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -j ACCEPT

# Enables Packet Forwarding
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

tasha69

ASKER

I left these ones too in the script too!

#!/bin/bash

# Enable broadcast echo protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done

# Enable syn cookie protection.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptence
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done

# Drop spoofed packets comeing in on an interface, ehich if replied
# to,would result the reply going out another interface.
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done

# Dont't send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $f
done

# Log packets with impossiable addreses.
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $f

ahoffmann🇩🇪

path-o-matic is not your problem, 'cause you use standard iptables rules, nothing special there.

In you example above, please remove the -m state also, just rules for port 80 and 443 in the INPUT and OUTPUT chain are sufficient.
If you then can connect using port 80, but not on port 443, then please post result of
tcpdump -l -n port 443
(tcpdump while you try to connect port 443)

tasha69

ASKER

Ok with just the HTTP and HTTPS rules in place and the -m state taking out it didnt connect to port 80 the website either but then i added my DNS server then it connected to HTTP but still nothing to HTTPS and the command
tcpdum -l n port 443
bash:tcpdump:command not found

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

tcpdum <--- that was a typo in my comment!! I really typed tcpdump -l -n port 443
bash:tcpdump:command not found

ahoffmann🇩🇪

if it connects port 80, but not 443, I asume that 443 is not active.
To prove this, we need tcpdump output. tcpdump is in /sbin, usually, best you're root for doing this.

Or could it be that the server on 443 only accepts connections to sites where it can reverse map the FQHN ? means that it does not even ask for the certificate if reverse lookup fails?

what does
telnet remote.host.tld 443
do? does it return with an error, or does it hang?

tasha69

ASKER

Ok guys,

Thanks for all you help...I just re-installed RedHat 7.3...re-compiled my kernel too 2.4.19 and un-installed IPCHAINS and tryed to connect to HTTPS and still CANT connect.Soo im guessing my last problem with IPTABLES had nothing to do with the iptables. it is something else.I have no Rules in my IPTABLES im using Mozilla 1.1 and trying to connect to more than 1 HTTPS site? Any ideas?

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

ahoffmann🇩🇪

does folloing work:

telnet other-site 443

tasha69

ASKER

I tryed both of these with
telnet easyweb.tdcanadatrust.com 443
and
telnet shop.chapters.indigo.ca

unable to connect to remote host:connection timed out

ahoffmann🇩🇪

both work for me,
please post result of
tcpdump -l -n -i <interface to internet>

when doing above telnet

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

Mihai Barbos🇨🇭

Are you passing through another firewall / proxy ? We don't know your network configuration, but are you convinced that there is no filtering beetwen your machine and the internet somewhere at the next hops ?
Transparent proxies about which nobody knew nothing have been seen before.

tasha69

ASKER

tcpdump: listening on eth0
01:26:38.522292 200.181.152.64.4212 > 182.169.22.24.1214: . ack 1177697152 win 17680 (DF) [tos 0x28]
01:26:38.523572 182.169.22.24.1214 > 200.181.152.64.4212: . 16321:17681(1360) ack 0 win 17323
01:26:39.044229 152.173.20.241.32776 > 209.53.4.130.53: 44090+[|domain] (DF)
01:26:39.242258 209.53.4.130.53 > 152.173.20.241.32776: 44090[|domain] (DF) [tos 0x28]
01:26:39.242848 152.173.20.241.32844 > 152.205.209.80.443: SWE 578938292:578938292(0) win 5840 <mss 1460,sackOK,timestamp 289114[|tcp]> (DF) [tos 0x10]
01:26:42.238263 152.173.20.241.32844 > 152.205.209.80.443: SWE 578938292:578938292(0) win 5840 <mss 1460,sackOK,timestamp 289414[|tcp]> (DF) [tos 0x10]
01:26:43.630449 200.181.152.64.4212 > 182.169.22.24.1214: . ack 2721 win 17680 (DF) [tos 0x28]
01:26:43.631741 182.169.22.24.1214 > 200.181.152.64.4212: . 17681:19041(1360) ack 0 win 17323
01:26:43.632900 182.169.22.24.1214 > 200.181.152.64.4212: . 19041:20401(1360) ack 0 win 17323
01:26:43.636374 200.181.152.64.4212 > 182.169.22.24.1214: . ack 5441 win 17680 (DF) [tos 0x28]
01:26:43.637644 182.169.22.24.1214 > 200.181.152.64.4212: . 20401:21761(1360) ack 0 win 17323
01:26:43.638805 182.169.22.24.1214 > 200.181.152.64.4212: . 21761:23121(1360) ack 0 win 17323
01:26:43.649672 200.181.152.64.4212 > 182.169.22.24.1214: . ack 8161 win 17680 (DF) [tos 0x28]
01:26:43.650959 182.169.22.24.1214 > 200.181.152.64.4212: . 23121:24481(1360) ack 0 win 17323
01:26:43.652118 182.169.22.24.1214 > 200.181.152.64.4212: . 24481:25841(1360) ack 0 win 17323
01:26:43.662985 200.181.152.64.4212 > 182.169.22.24.1214: . ack 10881 win 17680 (DF) [tos 0x28]
01:26:43.664273 182.169.22.24.1214 > 200.181.152.64.4212: . 25841:27201(1360) ack 0 win 17323
01:26:43.665433 182.169.22.24.1214 > 200.181.152.64.4212: . 27201:28561(1360) ack 0 win 17323
01:26:43.670120 200.181.152.64.4212 > 182.169.22.24.1214: . ack 13601 win 17680 (DF) [tos 0x28]
01:26:43.671402 182.169.22.24.1214 > 200.181.152.64.4212: . 28561:29921(1360) ack 0 win 17323
01:26:43.671669 182.169.22.24.1214 > 200.181.152.64.4212: P 29921:30177(256) ack 0 win 17323
01:26:43.683439 200.181.152.64.4212 > 182.169.22.24.1214: . ack 16321 win 17680 (DF) [tos 0x28]
01:26:47.124660 200.181.152.64.4212 > 182.169.22.24.1214: . ack 17681 win 17680 (DF) [tos 0x28]
01:26:47.403295 200.181.152.64.4212 > 182.169.22.24.1214: . ack 20401 win 17680 (DF) [tos 0x28]
01:26:47.409699 200.181.152.64.4212 > 182.169.22.24.1214: . ack 23121 win 17680 (DF) [tos 0x28]
01:26:47.416343 200.181.152.64.4212 > 182.169.22.24.1214: . ack 25841 win 17680 (DF) [tos 0x28]
01:26:47.422993 200.181.152.64.4212 > 182.169.22.24.1214: . ack 28561 win 17680 (DF) [tos 0x28]
01:26:47.429644 200.181.152.64.4212 > 182.169.22.24.1214: . ack 30177 win 17680 (DF) [tos 0x28]
01:26:47.431525 182.169.22.24.1214 > 200.181.152.64.4212: . 30177:31537(1360) ack 0 win 17323
01:26:47.432686 182.169.22.24.1214 > 200.181.152.64.4212: . 31537:32897(1360) ack 0 win 17323
01:26:47.433845 182.169.22.24.1214 > 200.181.152.64.4212: . 32897:34257(1360) ack 0 win 17323
01:26:47.435007 182.169.22.24.1214 > 200.181.152.64.4212: . 34257:35617(1360) ack 0 win 17323
01:26:47.436168 182.169.22.24.1214 > 200.181.152.64.4212: . 35617:36977(1360) ack 0 win 17323
01:26:47.437330 182.169.22.24.1214 > 200.181.152.64.4212: . 36977:38337(1360) ack 0 win 17323
01:26:47.438492 182.169.22.24.1214 > 200.181.152.64.4212: . 38337:39697(1360) ack 0 win 17323
01:26:47.439653 182.169.22.24.1214 > 200.181.152.64.4212: . 39697:41057(1360) ack 0 win 17323
01:26:47.440813 182.169.22.24.1214 > 200.181.152.64.4212: . 41057:42417(1360) ack 0 win 17323
01:26:47.441974 182.169.22.24.1214 > 200.181.152.64.4212: . 42417:43777(1360) ack 0 win 17323
01:26:47.443134 182.169.22.24.1214 > 200.181.152.64.4212: . 43777:45137(1360) ack 0 win 17323
01:26:47.444296 182.169.22.24.1214 > 200.181.152.64.4212: . 45137:46497(1360) ack 0 win 17323
01:26:47.445457 182.169.22.24.1214 > 200.181.152.64.4212: . 46497:47857(1360) ack 0 win 17323
01:26:48.238264 152.173.20.241.32844 > 152.205.209.80.443: SWE 578938292:578938292(0) win 5840 <mss 1460,sackOK,timestamp 290014[|tcp]> (DF) [tos 0x10]
01:26:49.556009 182.169.22.24.1214 > 81.86.196.195.1485: . 1324888540:1324890000(1460) ack 503313858 win 17115
01:26:50.090298 182.169.22.24.1027 > 152.179.8.254.1900: udp 132
01:26:50.090453 182.169.22.24.1027 > 152.179.8.254.1900: udp 133
01:26:50.101260 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:26:50.104709 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:26:50.492491 81.86.196.195.1485 > 182.169.22.24.1214: . ack 5110 win 17520 <nop,nop,sack sack 2 {10950:11680}[|tcp]> (DF) [tos 0x28]
01:26:50.493900 182.169.22.24.1214 > 81.86.196.195.1485: . 5110:6570(1460) ack 1 win 17115
01:26:50.495141 182.169.22.24.1214 > 81.86.196.195.1485: . 6570:8030(1460) ack 1 win 17115
01:26:50.496382 182.169.22.24.1214 > 81.86.196.195.1485: . 8030:9490(1460) ack 1 win 17115
01:26:50.497625 182.169.22.24.1214 > 81.86.196.195.1485: . 9490:10950(1460) ack 1 win 17115
01:26:51.539316 81.86.196.195.1485 > 182.169.22.24.1214: . ack 5110 win 17520 <nop,nop,sack sack 3 {6570:9490}[|tcp]> (DF) [tos 0x28]
01:26:51.540687 182.169.22.24.1214 > 81.86.196.195.1485: . 10950:12410(1460) ack 1 win 17115
01:26:52.633195 81.86.196.195.1485 > 182.169.22.24.1214: . ack 5110 win 17520 <nop,nop,sack sack 3 {10950:12410}[|tcp]> (DF) [tos 0x28]
01:26:52.634574 182.169.22.24.1214 > 81.86.196.195.1485: . 5110:6570(1460) ack 1 win 17115
01:26:52.635817 182.169.22.24.1214 > 81.86.196.195.1485: . 9490:10950(1460) ack 1 win 17115
01:26:52.998156 arp who-has 152.173.61.96 tell 152.173.0.254
01:26:53.214109 81.86.196.195.1485 > 182.169.22.24.1214: . ack 9490 win 17520 <nop,nop,sack sack 2 {10950:12410}[|tcp]> (DF) [tos 0x28]
01:26:53.326448 81.86.196.195.1485 > 182.169.22.24.1214: . ack 12410 win 17520 (DF) [tos 0x28]
01:26:53.327829 182.169.22.24.1214 > 81.86.196.195.1485: . 12410:13870(1460) ack 1 win 17115
01:26:53.329071 182.169.22.24.1214 > 81.86.196.195.1485: . 13870:15330(1460) ack 1 win 17115
01:26:54.051993 81.86.196.195.1485 > 182.169.22.24.1214: . ack 15330 win 17520 (DF) [tos 0x28]
01:26:54.053380 182.169.22.24.1214 > 81.86.196.195.1485: . 15330:16790(1460) ack 1 win 17115
01:26:54.054621 182.169.22.24.1214 > 81.86.196.195.1485: . 16790:18250(1460) ack 1 win 17115
01:26:54.055862 182.169.22.24.1214 > 81.86.196.195.1485: . 18250:19710(1460) ack 1 win 17115
01:26:55.297389 81.86.196.195.1485 > 182.169.22.24.1214: . ack 15330 win 17520 <nop,nop,sack sack 1 {16790:18250} > (DF) [tos 0x28]
01:26:55.298754 182.169.22.24.1214 > 81.86.196.195.1485: . 19710:21170(1460) ack 1 win 17115
01:26:55.342722 81.86.196.195.1485 > 182.169.22.24.1214: . ack 15330 win 17520 <nop,nop,sack sack 1 {16790:19710} > (DF) [tos 0x28]
01:26:55.344077 182.169.22.24.1214 > 81.86.196.195.1485: . 15330:16790(1460) ack 1 win 17115
01:26:56.005453 81.86.196.195.1485 > 182.169.22.24.1214: . ack 15330 win 17520 <nop,nop,sack sack 1 {16790:21170} > (DF) [tos 0x28]
01:26:56.006828 182.169.22.24.1214 > 81.86.196.195.1485: . 21170:22630(1460) ack 1 win 17115
01:26:56.008069 182.169.22.24.1214 > 81.86.196.195.1485: . 22630:24090(1460) ack 1 win 17115
01:26:56.056442 81.86.196.195.1485 > 182.169.22.24.1214: . ack 21170 win 17520 (DF) [tos 0x28]
01:26:56.641309 200.181.152.64.4212 > 182.169.22.24.1214: . ack 32897 win 17680 (DF) [tos 0x28]
01:26:56.642596 182.169.22.24.1214 > 200.181.152.64.4212: . 47857:49217(1360) ack 0 win 17323
01:26:56.643755 182.169.22.24.1214 > 200.181.152.64.4212: . 49217:50577(1360) ack 0 win 17323
01:26:56.647486 200.181.152.64.4212 > 182.169.22.24.1214: . ack 35617 win 17680 (DF) [tos 0x28]
01:26:56.648727 182.169.22.24.1214 > 200.181.152.64.4212: . 50577:51937(1360) ack 0 win 17323
01:26:56.649887 182.169.22.24.1214 > 200.181.152.64.4212: . 51937:53297(1360) ack 0 win 17323
01:26:56.667672 200.181.152.64.4212 > 182.169.22.24.1214: . ack 38337 win 17680 (DF) [tos 0x28]
01:26:56.668965 182.169.22.24.1214 > 200.181.152.64.4212: . 53297:54657(1360) ack 0 win 17323
01:26:56.670126 182.169.22.24.1214 > 200.181.152.64.4212: . 54657:56017(1360) ack 0 win 17323
01:26:56.680986 200.181.152.64.4212 > 182.169.22.24.1214: . ack 41057 win 17680 (DF) [tos 0x28]
01:26:56.682277 182.169.22.24.1214 > 200.181.152.64.4212: . 56017:57377(1360) ack 0 win 17323
01:26:56.683439 182.169.22.24.1214 > 200.181.152.64.4212: . 57377:58737(1360) ack 0 win 17323
01:26:56.694295 200.181.152.64.4212 > 182.169.22.24.1214: . ack 43777 win 17680 (DF) [tos 0x28]
01:26:56.695584 182.169.22.24.1214 > 200.181.152.64.4212: . 58737:60097(1360) ack 0 win 17323
01:26:56.696744 182.169.22.24.1214 > 200.181.152.64.4212: . 60097:61457(1360) ack 0 win 17323
01:26:56.899504 200.181.152.64.4212 > 182.169.22.24.1214: . ack 46497 win 17680 (DF) [tos 0x28]
01:26:56.900798 182.169.22.24.1214 > 200.181.152.64.4212: . 61457:62817(1360) ack 0 win 17323
01:26:56.901960 182.169.22.24.1214 > 200.181.152.64.4212: . 62817:64177(1360) ack 0 win 17323
01:26:57.003711 81.86.196.195.1485 > 182.169.22.24.1214: . ack 24090 win 17520 (DF) [tos 0x28]
01:26:57.005088 182.169.22.24.1214 > 81.86.196.195.1485: . 24090:25550(1460) ack 1 win 17115
01:26:57.006330 182.169.22.24.1214 > 81.86.196.195.1485: . 25550:27010(1460) ack 1 win 17115
01:26:58.021203 81.86.196.195.1485 > 182.169.22.24.1214: . ack 27010 win 17520 (DF) [tos 0x28]
01:26:58.022587 182.169.22.24.1214 > 81.86.196.195.1485: . 27010:28470(1460) ack 1 win 17115
01:26:58.023831 182.169.22.24.1214 > 81.86.196.195.1485: . 28470:29930(1460) ack 1 win 17115
01:26:58.337300 200.181.152.64.4212 > 182.169.22.24.1214: . ack 47857 win 17680 (DF) [tos 0x28]
01:26:58.338580 182.169.22.24.1214 > 200.181.152.64.4212: . 64177:65537(1360) ack 0 win 17323
01:26:59.671120 182.169.22.24.3773 > 24.212.30.203.1861: P 1104356452:1104356474(22) ack 3621710550 win 17410 (DF)
01:27:00.187935 182.169.22.24.1214 > 81.86.196.195.1485: . 27010:28470(1460) ack 1 win 17115
01:27:00.238268 152.173.20.241.32844 > 152.205.209.80.443: SWE 578938292:578938292(0) win 5840 <mss 1460,sackOK,timestamp 291214[|tcp]> (DF) [tos 0x10]
01:27:00.267602 200.155.71.198.1029 > 152.173.20.241.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
01:27:00.267690 152.173.20.241 > 200.155.71.198: icmp: 152.173.20.241 udp port 137 unreachable [tos 0xc8]
01:27:00.462701 24.212.30.203.1861 > 182.169.22.24.3773: . ack 22 win 17414 (DF) [tos 0x28]
01:27:00.824857 200.181.152.64.4212 > 182.169.22.24.1214: . ack 50577 win 17680 (DF) [tos 0x28]
01:27:00.826154 182.169.22.24.1214 > 200.181.152.64.4212: . 65537:66897(1360) ack 0 win 17323
01:27:00.827314 182.169.22.24.1214 > 200.181.152.64.4212: . 66897:68257(1360) ack 0 win 17323
01:27:00.831512 200.181.152.64.4212 > 182.169.22.24.1214: . ack 53297 win 17680 (DF) [tos 0x28]
01:27:00.832787 182.169.22.24.1214 > 200.181.152.64.4212: . 68257:69617(1360) ack 0 win 17323
01:27:00.833948 182.169.22.24.1214 > 200.181.152.64.4212: . 69617:70977(1360) ack 0 win 17323
01:27:00.844582 200.181.152.64.4212 > 182.169.22.24.1214: . ack 56017 win 17680 (DF) [tos 0x28]
01:27:00.845865 182.169.22.24.1214 > 200.181.152.64.4212: . 70977:72337(1360) ack 0 win 17323
01:27:00.847025 182.169.22.24.1214 > 200.181.152.64.4212: . 72337:73697(1360) ack 0 win 17323
01:27:00.857647 200.181.152.64.4212 > 182.169.22.24.1214: . ack 58737 win 17680 (DF) [tos 0x28]
01:27:00.858936 182.169.22.24.1214 > 200.181.152.64.4212: . 73697:75057(1360) ack 0 win 17323
01:27:00.860098 182.169.22.24.1214 > 200.181.152.64.4212: . 75057:76417(1360) ack 0 win 17323
01:27:00.864287 200.181.152.64.4212 > 182.169.22.24.1214: . ack 61457 win 17680 (DF) [tos 0x28]
01:27:00.865510 182.169.22.24.1214 > 200.181.152.64.4212: . 76417:77777(1360) ack 0 win 17323
01:27:00.866670 182.169.22.24.1214 > 200.181.152.64.4212: . 77777:79137(1360) ack 0 win 17323
01:27:00.877592 200.181.152.64.4212 > 182.169.22.24.1214: . ack 64177 win 17680 (DF) [tos 0x28]
01:27:00.878885 182.169.22.24.1214 > 200.181.152.64.4212: . 79137:80497(1360) ack 0 win 17323
01:27:00.880047 182.169.22.24.1214 > 200.181.152.64.4212: . 80497:81857(1360) ack 0 win 17323
01:27:00.983529 200.181.152.64.4212 > 182.169.22.24.1214: . ack 65537 win 17680 (DF) [tos 0x28]
01:27:00.984810 182.169.22.24.1214 > 200.181.152.64.4212: . 81857:83217(1360) ack 0 win 17323
01:27:02.528028 80.26.34.58.60444 > 182.169.22.24.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
01:27:02.528447 182.169.22.24.137 > 80.26.34.58.60444: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST
01:27:04.601183 182.169.22.24.1214 > 81.86.196.195.1485: . 27010:28470(1460) ack 1 win 17115
01:27:04.700583 arp who-has 152.173.40.197 tell 152.173.0.254
01:27:05.603143 81.86.196.195.1485 > 182.169.22.24.1214: . ack 28470 win 17520 (DF) [tos 0x28]
01:27:05.604513 182.169.22.24.1214 > 81.86.196.195.1485: . 28470:29930(1460) ack 1 win 17115
01:27:05.605754 182.169.22.24.1214 > 81.86.196.195.1485: . 29930:31390(1460) ack 1 win 17115
01:27:06.511245 81.86.196.195.1485 > 182.169.22.24.1214: . ack 31390 win 17520 (DF) [tos 0x28]
01:27:06.512622 182.169.22.24.1214 > 81.86.196.195.1485: . 31390:32850(1460) ack 1 win 17115
01:27:06.513864 182.169.22.24.1214 > 81.86.196.195.1485: . 32850:34310(1460) ack 1 win 17115
01:27:07.026761 arp who-has 152.173.40.197 tell 152.173.0.254
01:27:07.443009 81.86.196.195.1485 > 182.169.22.24.1214: . ack 31390 win 17520 <nop,nop,sack sack 1 {32850:34310} > (DF) [tos 0x28]
01:27:07.444381 182.169.22.24.1214 > 81.86.196.195.1485: . 34310:35770(1460) ack 1 win 17115
01:27:08.512935 182.169.22.24.1214 > 81.86.196.195.1485: . 31390:32850(1460) ack 1 win 17115
01:27:09.249365 81.86.196.195.1485 > 182.169.22.24.1214: . ack 34310 win 17520 (DF) [tos 0x28]
01:27:09.250743 182.169.22.24.1214 > 81.86.196.195.1485: . 34310:35770(1460) ack 1 win 17115
01:27:09.251986 182.169.22.24.1214 > 81.86.196.195.1485: . 35770:37230(1460) ack 1 win 17115
01:27:10.317863 200.181.152.64.4212 > 182.169.22.24.1214: . ack 68257 win 17680 (DF) [tos 0x28]
01:27:10.319152 182.169.22.24.1214 > 200.181.152.64.4212: . 83217:84577(1360) ack 0 win 17323
01:27:10.320313 182.169.22.24.1214 > 200.181.152.64.4212: . 84577:85937(1360) ack 0 win 17323
01:27:10.324764 200.181.152.64.4212 > 182.169.22.24.1214: . ack 70977 win 17680 (DF) [tos 0x28]
01:27:10.326046 182.169.22.24.1214 > 200.181.152.64.4212: . 85937:87297(1360) ack 0 win 17323
01:27:10.327208 182.169.22.24.1214 > 200.181.152.64.4212: . 87297:88657(1360) ack 0 win 17323
01:27:10.344476 200.181.152.64.4212 > 182.169.22.24.1214: . ack 73697 win 17680 (DF) [tos 0x28]
01:27:10.345764 182.169.22.24.1214 > 200.181.152.64.4212: . 88657:90017(1360) ack 0 win 17323
01:27:10.346926 182.169.22.24.1214 > 200.181.152.64.4212: . 90017:91377(1360) ack 0 win 17323
01:27:10.350391 200.181.152.64.4212 > 182.169.22.24.1214: . ack 76417 win 17680 (DF) [tos 0x28]
01:27:10.351628 182.169.22.24.1214 > 200.181.152.64.4212: . 91377:92737(1360) ack 0 win 17323
01:27:10.352788 182.169.22.24.1214 > 200.181.152.64.4212: . 92737:94097(1360) ack 0 win 17323
01:27:10.363700 200.181.152.64.4212 > 182.169.22.24.1214: . ack 79137 win 17680 (DF) [tos 0x28]
01:27:10.364992 182.169.22.24.1214 > 200.181.152.64.4212: . 94097:95457(1360) ack 0 win 17323
01:27:10.365259 182.169.22.24.1214 > 200.181.152.64.4212: P 95457:95713(256) ack 0 win 17323
01:27:10.370842 200.181.152.64.4212 > 182.169.22.24.1214: . ack 81857 win 17680 (DF) [tos 0x28]
01:27:10.589342 200.181.152.64.4212 > 182.169.22.24.1214: . ack 83217 win 17680 (DF) [tos 0x28]
01:27:12.835239 200.181.152.64.4212 > 182.169.22.24.1214: . ack 85937 win 17680 (DF) [tos 0x28]
01:27:12.841138 200.181.152.64.4212 > 182.169.22.24.1214: . ack 88657 win 17680 (DF) [tos 0x28]
01:27:12.848525 200.181.152.64.4212 > 182.169.22.24.1214: . ack 91377 win 17680 (DF) [tos 0x28]
01:27:12.862083 200.181.152.64.4212 > 182.169.22.24.1214: . ack 94097 win 17680 (DF) [tos 0x28]
01:27:12.868229 200.181.152.64.4212 > 182.169.22.24.1214: . ack 95713 win 17680 (DF) [tos 0x28]
01:27:12.870636 182.169.22.24.1214 > 200.181.152.64.4212: . 95713:97073(1360) ack 0 win 17323
01:27:12.871799 182.169.22.24.1214 > 200.181.152.64.4212: . 97073:98433(1360) ack 0 win 17323
01:27:12.872959 182.169.22.24.1214 > 200.181.152.64.4212: . 98433:99793(1360) ack 0 win 17323
01:27:12.874121 182.169.22.24.1214 > 200.181.152.64.4212: . 99793:101153(1360) ack 0 win 17323
01:27:12.875282 182.169.22.24.1214 > 200.181.152.64.4212: . 101153:102513(1360) ack 0 win 17323
01:27:12.876444 182.169.22.24.1214 > 200.181.152.64.4212: . 102513:103873(1360) ack 0 win 17323
01:27:12.877604 182.169.22.24.1214 > 200.181.152.64.4212: . 103873:105233(1360) ack 0 win 17323
01:27:12.878764 182.169.22.24.1214 > 200.181.152.64.4212: . 105233:106593(1360) ack 0 win 17323
01:27:12.879926 182.169.22.24.1214 > 200.181.152.64.4212: . 106593:107953(1360) ack 0 win 17323
01:27:12.881088 182.169.22.24.1214 > 200.181.152.64.4212: . 107953:109313(1360) ack 0 win 17323
01:27:12.882250 182.169.22.24.1214 > 200.181.152.64.4212: . 109313:110673(1360) ack 0 win 17323
01:27:12.883411 182.169.22.24.1214 > 200.181.152.64.4212: . 110673:112033(1360) ack 0 win 17323
01:27:12.884572 182.169.22.24.1214 > 200.181.152.64.4212: . 112033:113393(1360) ack 0 win 17323
01:27:13.227072 182.169.22.24.1214 > 81.86.196.195.1485: . 34310:35770(1460) ack 1 win 17115
01:27:14.353343 81.86.196.195.1485 > 182.169.22.24.1214: . ack 35770 win 17520 (DF) [tos 0x28]
01:27:14.354712 182.169.22.24.1214 > 81.86.196.195.1485: . 35770:37230(1460) ack 1 win 17115
01:27:14.355953 182.169.22.24.1214 > 81.86.196.195.1485: . 37230:38690(1460) ack 1 win 17115
01:27:15.087377 182.169.22.24.1027 > 152.179.8.254.1900: udp 132
01:27:15.087530 182.169.22.24.1027 > 152.179.8.254.1900: udp 133
01:27:15.098109 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:27:15.101312 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:27:21.507088 200.181.152.64.4212 > 182.169.22.24.1214: . ack 98433 win 17680 (DF) [tos 0x28]
01:27:21.508380 182.169.22.24.1214 > 200.181.152.64.4212: . 113393:114753(1360) ack 0 win 17323
01:27:21.509539 182.169.22.24.1214 > 200.181.152.64.4212: . 114753:116113(1360) ack 0 win 17323
01:27:21.527059 200.181.152.64.4212 > 182.169.22.24.1214: . ack 99793 win 17680 (DF) [tos 0x28]
01:27:21.528335 182.169.22.24.1214 > 200.181.152.64.4212: . 116113:117473(1360) ack 0 win 17323
01:27:21.546273 200.181.152.64.4212 > 182.169.22.24.1214: . ack 101153 win 17680 (DF) [tos 0x28]
01:27:21.547547 182.169.22.24.1214 > 200.181.152.64.4212: . 117473:118833(1360) ack 0 win 17323
01:27:21.569685 200.181.152.64.4212 > 182.169.22.24.1214: . ack 102513 win 17680 (DF) [tos 0x28]
01:27:21.570968 182.169.22.24.1214 > 200.181.152.64.4212: . 118833:120193(1360) ack 0 win 17323
01:27:21.589884 200.181.152.64.4212 > 182.169.22.24.1214: . ack 105233 win 17680 (DF) [tos 0x28]
01:27:21.591174 182.169.22.24.1214 > 200.181.152.64.4212: . 120193:121553(1360) ack 0 win 17323
01:27:21.592334 182.169.22.24.1214 > 200.181.152.64.4212: . 121553:122913(1360) ack 0 win 17323
01:27:21.603164 200.181.152.64.4212 > 182.169.22.24.1214: . ack 107953 win 17680 (DF) [tos 0x28]
01:27:21.604454 182.169.22.24.1214 > 200.181.152.64.4212: . 122913:124273(1360) ack 0 win 17323
01:27:21.605615 182.169.22.24.1214 > 200.181.152.64.4212: . 124273:125633(1360) ack 0 win 17323
01:27:21.616486 200.181.152.64.4212 > 182.169.22.24.1214: . ack 110673 win 17680 (DF) [tos 0x28]
01:27:21.617773 182.169.22.24.1214 > 200.181.152.64.4212: . 125633:126993(1360) ack 0 win 17323
01:27:21.618935 182.169.22.24.1214 > 200.181.152.64.4212: . 126993:128353(1360) ack 0 win 17323
01:27:21.622654 200.181.152.64.4212 > 182.169.22.24.1214: . ack 113393 win 17680 (DF) [tos 0x28]
01:27:21.623936 182.169.22.24.1214 > 200.181.152.64.4212: . 128353:129713(1360) ack 0 win 17323
01:27:21.625098 182.169.22.24.1214 > 200.181.152.64.4212: . 129713:131073(1360) ack 0 win 17323
01:27:22.354485 182.169.22.24.1214 > 81.86.196.195.1485: . 35770:37230(1460) ack 1 win 17115
01:27:23.305316 81.86.196.195.1485 > 182.169.22.24.1214: . ack 38690 win 17520 (DF) [tos 0x28]
01:27:23.306695 182.169.22.24.1214 > 81.86.196.195.1485: . 38690:40150(1460) ack 1 win 17115
01:27:23.307937 182.169.22.24.1214 > 81.86.196.195.1485: . 40150:41610(1460) ack 1 win 17115
01:27:24.031113 200.181.152.64.4212 > 182.169.22.24.1214: . ack 116113 win 17680 (DF) [tos 0x28]
01:27:24.032421 182.169.22.24.1214 > 200.181.152.64.4212: . 131073:132433(1360) ack 0 win 17323
01:27:24.033582 182.169.22.24.1214 > 200.181.152.64.4212: . 132433:133793(1360) ack 0 win 17323
01:27:24.037040 200.181.152.64.4212 > 182.169.22.24.1214: . ack 118833 win 17680 (DF) [tos 0x28]
01:27:24.038262 182.169.22.24.1214 > 200.181.152.64.4212: . 133793:135153(1360) ack 0 win 17323
01:27:24.039423 182.169.22.24.1214 > 200.181.152.64.4212: . 135153:136513(1360) ack 0 win 17323
01:27:24.043938 200.181.152.64.4212 > 182.169.22.24.1214: . ack 121553 win 17680 (DF) [tos 0x28]
01:27:24.045221 182.169.22.24.1214 > 200.181.152.64.4212: . 136513:137873(1360) ack 0 win 17323
01:27:24.046383 182.169.22.24.1214 > 200.181.152.64.4212: . 137873:139233(1360) ack 0 win 17323
01:27:24.156272 200.181.152.64.4212 > 182.169.22.24.1214: . ack 124273 win 17680 (DF) [tos 0x28]
01:27:24.157564 182.169.22.24.1214 > 200.181.152.64.4212: . 139233:140593(1360) ack 0 win 17323
01:27:24.158726 182.169.22.24.1214 > 200.181.152.64.4212: . 140593:141953(1360) ack 0 win 17323
01:27:24.182893 200.181.152.64.4212 > 182.169.22.24.1214: . ack 125633 win 17680 (DF) [tos 0x28]
01:27:24.184175 182.169.22.24.1214 > 200.181.152.64.4212: . 141953:143313(1360) ack 0 win 17323
01:27:24.196174 200.181.152.64.4212 > 182.169.22.24.1214: . ack 128353 win 17680 (DF) [tos 0x28]
01:27:24.197466 182.169.22.24.1214 > 200.181.152.64.4212: . 143313:144673(1360) ack 0 win 17323
01:27:24.198619 182.169.22.24.1214 > 200.181.152.64.4212: . 144673:146033(1360) ack 0 win 17323
01:27:24.209739 200.181.152.64.4212 > 182.169.22.24.1214: . ack 131073 win 17680 (DF) [tos 0x28]
01:27:24.211021 182.169.22.24.1214 > 200.181.152.64.4212: . 146033:147393(1360) ack 0 win 17323
01:27:24.212178 182.169.22.24.1214 > 200.181.152.64.4212: . 147393:148753(1360) ack 0 win 17323
01:27:24.238268 152.173.20.241.32844 > 152.205.209.80.443: SWE 578938292:578938292(0) win 5840 <mss 1460,sackOK,timestamp 293614[|tcp]> (DF) [tos 0x10]
01:27:24.555137 81.86.196.195.1485 > 182.169.22.24.1214: . ack 38690 win 17520 <nop,nop,sack sack 1 {40150:41610} > (DF) [tos 0x28]
01:27:24.556503 182.169.22.24.1214 > 81.86.196.195.1485: . 41610:43070(1460) ack 1 win 17115
01:27:25.500206 81.86.196.195.1485 > 182.169.22.24.1214: . ack 38690 win 17520 <nop,nop,sack sack 1 {40150:43070} > (DF) [tos 0x28]
01:27:25.501567 182.169.22.24.1214 > 81.86.196.195.1485: . 38690:40150(1460) ack 1 win 17115
01:27:26.337847 81.86.196.195.1485 > 182.169.22.24.1214: . ack 43070 win 17520 (DF) [tos 0x28]
01:27:26.339221 182.169.22.24.1214 > 81.86.196.195.1485: . 43070:44530(1460) ack 1 win 17115
01:27:26.340463 182.169.22.24.1214 > 81.86.196.195.1485: . 44530:45990(1460) ack 1 win 17115
01:27:27.815807 81.86.196.195.1485 > 182.169.22.24.1214: . ack 43070 win 17520 <nop,nop,sack sack 1 {44530:45990} > (DF) [tos 0x28]
01:27:27.817176 182.169.22.24.1214 > 81.86.196.195.1485: . 45990:47450(1460) ack 1 win 17115
01:27:29.238236 arp who-has 152.173.0.254 tell 152.173.20.241
01:27:29.247172 arp reply 152.173.0.254 is-at 0:3:42:1e:c0:45
01:27:32.597034 200.181.152.64.4212 > 182.169.22.24.1214: . ack 133793 win 17680 (DF) [tos 0x28]
01:27:32.598325 182.169.22.24.1214 > 200.181.152.64.4212: . 148753:150113(1360) ack 0 win 17323
01:27:32.599485 182.169.22.24.1214 > 200.181.152.64.4212: . 150113:151473(1360) ack 0 win 17323
01:27:32.603202 200.181.152.64.4212 > 182.169.22.24.1214: . ack 136513 win 17680 (DF) [tos 0x28]
01:27:32.604423 182.169.22.24.1214 > 200.181.152.64.4212: . 151473:152833(1360) ack 0 win 17323
01:27:32.605584 182.169.22.24.1214 > 200.181.152.64.4212: . 152833:154193(1360) ack 0 win 17323
01:27:32.610108 200.181.152.64.4212 > 182.169.22.24.1214: . ack 139233 win 17680 (DF) [tos 0x28]
01:27:32.611389 182.169.22.24.1214 > 200.181.152.64.4212: . 154193:155553(1360) ack 0 win 17323
01:27:32.612548 182.169.22.24.1214 > 200.181.152.64.4212: . 155553:156913(1360) ack 0 win 17323
01:27:32.616504 200.181.152.64.4212 > 182.169.22.24.1214: . ack 141953 win 17680 (DF) [tos 0x28]
01:27:32.617786 182.169.22.24.1214 > 200.181.152.64.4212: . 156913:158273(1360) ack 0 win 17323
01:27:32.618946 182.169.22.24.1214 > 200.181.152.64.4212: . 158273:159633(1360) ack 0 win 17323
01:27:32.630070 200.181.152.64.4212 > 182.169.22.24.1214: . ack 144673 win 17680 (DF) [tos 0x28]
01:27:32.631355 182.169.22.24.1214 > 200.181.152.64.4212: . 159633:160993(1360) ack 0 win 17323
01:27:32.631623 182.169.22.24.1214 > 200.181.152.64.4212: P 160993:161249(256) ack 0 win 17323
01:27:32.636454 200.181.152.64.4212 > 182.169.22.24.1214: . ack 147393 win 17680 (DF) [tos 0x28]
01:27:32.855223 200.181.152.64.4212 > 182.169.22.24.1214: . ack 148753 win 17680 (DF) [tos 0x28]
01:27:35.673900 200.181.152.64.4212 > 182.169.22.24.1214: . ack 151473 win 17680 (DF) [tos 0x28]
01:27:35.680296 200.181.152.64.4212 > 182.169.22.24.1214: . ack 154193 win 17680 (DF) [tos 0x28]
01:27:35.693609 200.181.152.64.4212 > 182.169.22.24.1214: . ack 156913 win 17680 (DF) [tos 0x28]
01:27:35.707155 200.181.152.64.4212 > 182.169.22.24.1214: . ack 159633 win 17680 (DF) [tos 0x28]
01:27:35.713554 200.181.152.64.4212 > 182.169.22.24.1214: . ack 161249 win 17680 (DF) [tos 0x28]
01:27:35.715260 182.169.22.24.1214 > 200.181.152.64.4212: . 161249:162609(1360) ack 0 win 17323
01:27:35.716419 182.169.22.24.1214 > 200.181.152.64.4212: . 162609:163969(1360) ack 0 win 17323
01:27:35.717580 182.169.22.24.1214 > 200.181.152.64.4212: . 163969:165329(1360) ack 0 win 17323
01:27:35.718742 182.169.22.24.1214 > 200.181.152.64.4212: . 165329:166689(1360) ack 0 win 17323
01:27:35.719903 182.169.22.24.1214 > 200.181.152.64.4212: . 166689:168049(1360) ack 0 win 17323
01:27:35.721065 182.169.22.24.1214 > 200.181.152.64.4212: . 168049:169409(1360) ack 0 win 17323
01:27:35.722226 182.169.22.24.1214 > 200.181.152.64.4212: . 169409:170769(1360) ack 0 win 17323
01:27:35.723388 182.169.22.24.1214 > 200.181.152.64.4212: . 170769:172129(1360) ack 0 win 17323
01:27:35.724548 182.169.22.24.1214 > 200.181.152.64.4212: . 172129:173489(1360) ack 0 win 17323
01:27:35.725709 182.169.22.24.1214 > 200.181.152.64.4212: . 173489:174849(1360) ack 0 win 17323
01:27:35.726873 182.169.22.24.1214 > 200.181.152.64.4212: . 174849:176209(1360) ack 0 win 17323
01:27:35.728034 182.169.22.24.1214 > 200.181.152.64.4212: . 176209:177569(1360) ack 0 win 17323
01:27:35.729195 182.169.22.24.1214 > 200.181.152.64.4212: . 177569:178929(1360) ack 0 win 17323
01:27:37.702369 arp who-has 152.173.40.197 tell 152.173.0.254
01:27:40.082737 182.169.22.24.1027 > 152.179.8.254.1900: udp 132
01:27:40.082889 182.169.22.24.1027 > 152.179.8.254.1900: udp 133
01:27:40.093718 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:27:40.096672 209.53.1.231 > 182.169.22.24: icmp: 152.179.8.254 udp port 1900 unreachable [tos 0x28]
01:27:41.633327 182.169.22.24.3773 > 24.212.30.203.1861: P 22:23(1) ack 1 win 17410 (DF)
01:27:42.314412 182.169.22.24.1214 > 81.86.196.195.1485: . 43070:44530(1460) ack 1 win 17115
01:27:42.459577 24.212.30.203.1861 > 182.169.22.24.3773: P 1:2(1) ack 23 win 17413 (DF) [tos 0x28]
01:27:42.614116 182.169.22.24.3773 > 24.212.30.203.1861: . ack 2 win 17409 (DF)
01:27:43.529304 81.86.196.195.1485 > 182.169.22.24.1214: . ack 45990 win 17520 (DF) [tos 0x28]
01:27:43.530683 182.169.22.24.1214 > 81.86.196.195.1485: . 45990:47450(1460) ack 1 win 17115
01:27:43.531200 182.169.22.24.1214 > 81.86.196.195.1485: P 47450:48016(566) ack 1 win 17115
01:27:44.281959 81.86.196.195.1485 > 182.169.22.24.1214: . ack 45990 win 17520 <nop,nop,sack sack 1 {47450:48016} > (DF) [tos 0x28]
01:27:44.567740 81.86.196.195.1485 > 182.169.22.24.1214: . ack 48016 win 17520 (DF) [tos 0x28]
01:27:44.569509 182.169.22.24.1214 > 81.86.196.195.1485: . 48016:49476(1460) ack 1 win 17115
01:27:44.570753 182.169.22.24.1214 > 81.86.196.195.1485: . 49476:50936(1460) ack 1 win 17115
01:27:44.852040 200.181.152.64.4212 > 182.169.22.24.1214: . ack 163969 win 17680 (DF) [tos 0x28]
01:27:44.853340 182.169.22.24.1214 > 200.181.152.64.4212: . 178929:180289(1360) ack 0 win 17323
01:27:44.854502 182.169.22.24.1214 > 200.181.152.64.4212: . 180289:181649(1360) ack 0 win 17323
01:27:44.858953 200.181.152.64.4212 > 182.169.22.24.1214: . ack 166689 win 17680 (DF) [tos 0x28]
01:27:44.860240 182.169.22.24.1214 > 200.181.152.64.4212: . 181649:183009(1360) ack 0 win 17323
01:27:44.861401 182.169.22.24.1214 > 200.181.152.64.4212: . 183009:184369(1360) ack 0 win 17323
01:27:44.865120 200.181.152.64.4212 > 182.169.22.24.1214: . ack 169409 win 17680 (DF) [tos 0x28]
01:27:44.866363 182.169.22.24.1214 > 200.181.152.64.4212: . 184369:185729(1360) ack 0 win 17323
01:27:44.867523 182.169.22.24.1214 > 200.181.152.64.4212: . 185729:187089(1360) ack 0 win 17323
01:27:44.878904 200.181.152.64.4212 > 182.169.22.24.1214: . ack 172129 win 17680 (DF) [tos 0x28]
01:27:44.880196 182.169.22.24.1214 > 200.181.152.64.4212: . 187089:188449(1360) ack 0 win 17323
01:27:44.881358 182.169.22.24.1214 > 200.181.152.64.4212: . 188449:189809(1360) ack 0 win 17323
01:27:44.898625 200.181.152.64.4212 > 182.169.22.24.1214: . ack 173489 win 17680 (DF) [tos 0x28]
01:27:44.899900 182.169.22.24.1214 > 200.181.152.64.4212: . 189809:191169(1360) ack 0 win 17323
01:27:44.925232 200.181.152.64.4212 > 182.169.22.24.1214: . ack 174849 win 17680 (DF) [tos 0x28]
01:27:44.926510 182.169.22.24.1214 > 200.181.152.64.4212: . 191169:192529(1360) ack 0 win 17323
01:27:44.938777 200.181.152.64.4212 > 182.169.22.24.1214: . ack 177569 win 17680 (DF) [tos 0x28]
01:27:44.940061 182.169.22.24.1214 > 200.181.152.64.4212: . 192529:193889(1360) ack 0 win 17323
01:27:44.941223 182.169.22.24.1214 > 200.181.152.64.4212: . 193889:195249(1360) ack 0 win 17323
01:27:45.762122 81.86.196.195.1485 > 182.169.22.24.1214: . ack 50936 win 17520 (DF) [tos 0x28]
01:27:45.763498 182.169.22.24.1214 > 81.86.196.195.1485: . 50936:52396(1460) ack 1 win 17115
01:27:45.764741 182.169.22.24.1214 > 81.86.196.195.1485: . 52396:53856(1460) ack 1 win 17115
01:27:46.564529 200.181.152.64.4212 > 182.169.22.24.1214: . ack 178929 win 17680 (DF) [tos 0x28]
01:27:46.565808 182.169.22.24.1214 > 200.181.152.64.4212: . 195249:196609(1360) ack 0 win 17323
01:27:47.455155 81.86.196.195.1485 > 182.169.22.24.1214: . ack 50936 win 17520 <nop,nop,sack sack 1 {52396:53856} > (DF) [tos 0x28]
01:27:47.456523 182.169.22.24.1214 > 81.86.196.195.1485: . 53856:55316(1460) ack 1 win 17115
01:27:47.931267 182.169.22.24.1214 > 81.86.196.195.1485: . 50936:52396(1460) ack 1 win 17115
01:27:48.150484 NetBeui Packet
01:27:48.207550 200.181.152.64.4212 > 182.169.22.24.1214: . ack 181649 win 17680 (DF) [tos 0x28]
01:27:48.208847 182.169.22.24.1214 > 200.181.152.64.4212: . 196609:197969(1360) ack 0 win 17323
01:27:48.210007 182.169.22.24.1214 > 200.181.152.64.4212: . 197969:199329(1360) ack 0 win 17323
01:27:48.214471 200.181.152.64.4212 > 182.169.22.24.1214: . ack 184369 win 17680 (DF) [tos 0x28]
01:27:48.215754 182.169.22.24.1214 > 200.181.152.64.4212: . 199329:200689(1360) ack 0 win 17323
01:27:48.216915 182.169.22.24.1214 > 200.181.152.64.4212: . 200689:202049(1360) ack 0 win 17323
01:27:48.221364 200.181.152.64.4212 > 182.169.22.24.1214: . ack 187089 win 17680 (DF) [tos 0x28]
01:27:48.222608 182.169.22.24.1214 > 200.181.152.64.4212: . 202049:203409(1360) ack 0 win 17323
01:27:48.223768 182.169.22.24.1214 > 200.181.152.64.4212: . 203409:204769(1360) ack 0 win 17323
01:27:48.227529 200.181.152.64.4212 > 182.169.22.24.1214: . ack 189809 win 17680 (DF) [tos 0x28]
01:27:48.228793 182.169.22.24.1214 > 200.181.152.64.4212: . 204769:206129(1360) ack 0 win 17323
01:27:48.229955 182.169.22.24.1214 > 200.181.152.64.4212: . 206129:207489(1360) ack 0 win 17323
01:27:48.254141 200.181.152.64.4212 > 182.169.22.24.1214: . ack 192529 win 17680 (DF) [tos 0x28]
01:27:48.255433 182.169.22.24.1214 > 200.181.152.64.4212: . 207489:208849(1360) ack 0 win 17323
01:27:48.256594 182.169.22.24.1214 > 200.181.152.64.4212: . 208849:210209(1360) ack 0 win 17323
01:27:48.260772 200.181.152.64.4212 > 182.169.22.24.1214: . ack 195249 win 17680 (DF) [tos 0x28]
01:27:48.261996 182.169.22.24.1214 > 200.181.152.64.4212: . 210209:211569(1360) ack 0 win 17323
01:27:48.263155 182.169.22.24.1214 > 200.181.152.64.4212: . 211569:212929(1360) ack 0 win 17323
01:27:48.579086 81.86.196.195.1485 > 182.169.22.24.1214: . ack 50936 win 17520 <nop,nop,sack sack 1 {52396:55316} > (DF) [tos 0x28]
01:27:48.580449 182.169.22.24.1214 > 81.86.196.195.1485: . 50936:52396(1460) ack 1 win 17115
01:27:49.647079 81.86.196.195.1485 > 182.169.22.24.1214: . ack 55316 win 17520 (DF) [tos 0x28]
01:27:49.648462 182.169.22.24.1214 > 81.86.196.195.1485: . 55316:56776(1460) ack 1 win 17115
01:27:49.649703 182.169.22.24.1214 > 81.86.196.195.1485: . 56776:58236(1460) ack 1 win 17115
01:27:51.395289 81.86.196.195.1485 > 182.169.22.24.1214: . ack 58236 win 17520 (DF) [tos 0x28]
01:27:51.396666 182.169.22.24.1214 > 81.86.196.195.1485: . 58236:59696(1460) ack 1 win 17115
01:27:51.397909 182.169.22.24.1214 > 81.86.196.195.1485: . 59696:61156(1460) ack 1 win 17115
01:27:51.871273 200.181.152.64.4212 > 182.169.22.24.1214: . ack 196609 win 17680 (DF) [tos 0x28]
01:27:51.872557 182.169.22.24.1214 > 200.181.152.64.4212: . 212929:215289(1360) ack 0 win 17323

350 packets received by filter
0 packets dropped by kernel

ahoffmann🇩🇪

stupid question(s):
- you're absolutely shure that you have an appropriate default gateway (check with netstat -rn)
- you're absolutely shure that iptables does not block any packets

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

tasha69

ASKER

Yep..I have seperated this machine it has 1 networkcard now and connected directly to the net. I can surf the net have no problem connecting to FTP sites: here is the output from my iptables even though i have no rules in place.iptables -Z then i tryed to connect by telnet then i ran iptables -vnL
Chain INPUT (policy ACCEPT 4 packets, 321 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 10 packets, 749 bytes)
pkts bytes target prot opt in out source destination
netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
182.175.0.0 0.0.0.0 255.255.192.0 U 40 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 40 0 0 lo
0.0.0.0 182.175.0.254 0.0.0.0 UG 40 0 0 eth0
Could it be somehting i didnt re-compile in the kernel?or maybe a bug i nthe kernel<---HEHE im not sure i even know if that makes sense...

Mihai Barbos🇨🇭

try to do a traceroute to those https servers

tasha69

ASKER

traceroute to easyweb.tdcanadatrust.com (142.205.233.80), 30 hops max, 38 byte packets
1 209.53.1.231 (209.53.1.231) 9.407 ms 9.193 ms 9.575 ms
2 nwmrbc01dr12.bb.telus.com (209.53.1.158) 9.813 ms vancbc01dr11.bb.telus.com (209.53.1.126) 9.381 ms nwmrbc01dr12.bb.telus.com (209.53.1.158) 9.924 ms
3 vancbc01dr01.bb.telus.com (154.11.10.69) 9.668 ms nwmrbc01dr01.bb.telus.com (154.11.10.73) 10.184 ms vancbc01dr01.bb.telus.com (154.11.10.69) 9.916 ms
4 vancbc01gr01.bb.telus.com (204.174.217.4) 10.160 ms vancbc01gr01.bb.telus.com (154.11.4.65) 10.169 ms vancbc01gr01.bb.telus.com (204.174.217.4) 9.700 ms
5 vancbc01br01.bb.telus.com (154.11.10.49) 64.221 ms 65.203 ms 64.527 ms
6 clgrab21br01.bb.telus.com (154.11.10.22) 65.001 ms 64.482 ms 64.532 ms
7 wnpgmb38br00.bb.telus.com (154.11.10.158) 64.491 ms 64.224 ms 64.514 ms
8 wnpgmbabbr00.bb.telus.com (154.11.11.49) 64.765 ms 65.448 ms 65.313 ms
9 toroonnlbr00.bb.telus.com (154.11.11.41) 64.935 ms 64.669 ms 64.770 ms
10 toroonxnbr00.bb.telus.com (154.11.11.38) 64.757 ms 64.479 ms 64.533 ms
11 toroonxngr00.bb.telus.com (154.11.11.54) 63.687 ms 64.133 ms 63.780 ms
12 toroonnlgr00.bb.telus.com (154.11.6.85) 63.781 ms 63.418 ms 63.768 ms
13 peer.toroonnlgr00.bb.telus.com (154.11.3.30) 64.015 ms 63.631 ms 65.269 ms
14 srp2-0.core2-tor.bb.attcanada.ca (216.191.65.242) 64.272 ms 65.394 ms 64.968 ms
15 pos4-0-0.bgp1-tor.bb.attcanada.ca (216.191.67.46) 65.957 ms 64.821 ms 65.725 ms
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

Do you guys think something could have happened when un-installed ipchains or something? I un-installed lokkit also...

tasha69

ASKER

I DUAL-BOOT windows withthat machine and with windows i have no problem connecting to the site. Should i install another Browser I have netscape and mozilla right now. Maybe Opreha

ahoffmann🇩🇪

strange ..
please post anything you get when doing:

telnet easyweb.tdcanadatrust.com 80
telnet easyweb.tdcanadatrust.com 443

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

tasha69

ASKER

Ok this is strange with my 2.4.18 kernel i can connect to the HTTPS but not with my 2.4.19 kernel? and telnet to
telnet easyweb.tdcanadatrust.com 80
connected to easyweb.tdcanadatrust.com

telnet easyweb.tdcanadatrust.com 443
unable to connect to remote host:connection timed out

ahoffmann🇩🇪

you did not post "anything", unfortunately :-(

'cause port 80 works, but not 443, I assume that there is no server listening at 443.

Mihai Barbos🇨🇭

What's the IP you get when booting windoze ?
Who is 152.205.209.80, since from your tcpdump it looks like your machine is trying to conect to this one on 443.

What you can also do is to try to get rid of the other noise around you and connect your machine through a hub. Connect also another linux box in that hub and listen to the traffic both when you use windoze and linux. There should be a difference in traffic since it work with one and it doesn't work with the other.

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

Mihai Barbos🇨🇭

Ooops. easyweb.tdcanadatrust.com has 142.205.209.80. Your tcpdump shows 152.205.209.80. ??????? Your DNS woke up on the wrong side ?
Use nslookup and find out if you're getting the wrong address or thre's something funny with your machine.

Mihai Barbos🇨🇭

Sorry for the posting flood, but the log from iptables looks ok, the tcpdump one doesn't. You've got a small guy somewhere in your machine that's messing around with the destination address of your packets. Now I'm even more confused than usually.
What NIC and driver are you using ?

tasha69

ASKER

Kernel 2.4.18 Using Mozilla works just fine telneting to port 443 and port 80 work.

But using the kernel 2.4.19 telneting to port 80 i get a connection but not to port 443:
Here is TCPDUMP without all that other traffic im using MOzilla to try and connect.to HTTPS
01:39:39.164999 142.179.50.241.32849 > 142.505.509.230.80: SWE 2441036095:2441036095(0) win 5840 <mss 1460,sackOK,timestamp 795305[|tcp]> (DF)
01:39:39.175268 142.505.509.230.80 > 142.179.50.241.32849: S 1801778929:1801778929(0) ack 2441036096 win 8760 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]> (DF) [tos 0x28]
01:39:39.175375 142.179.50.241.32849 > 142.505.509.230.80: . ack 1 win 5840 <nop,nop,timestamp 795306 482234526> (DF)
01:39:39.175688 142.179.50.241.32849 > 142.505.509.230.80: P 1:459(458) ack 1 win 5840 <nop,nop,timestamp 795307 482234526> (DF)
01:39:39.192752 142.505.509.230.80 > 142.179.50.241.32849: . ack 459 win 15926 <nop,nop,timestamp 482234528 795307> [tos 0x28]
01:39:39.316588 142.505.509.230.80 > 142.179.50.241.32849: P 1:819(818) ack 459 win 16384 <nop,nop,timestamp 482234540 795307> [tos 0x28]
01:39:39.316679 142.179.50.241.32849 > 142.505.509.230.80: . ack 819 win 7962 <nop,nop,timestamp 795321 482234540> (DF)
01:39:39.360567 142.179.50.241.32850 > 142.505.509.230.80: SWE 2446161224:2446161224(0) win 5840 <mss 1460,sackOK,timestamp 795325[|tcp]> (DF)
01:39:39.377658 142.505.509.230.80 > 142.179.50.241.32849: P 819:2218(1399) ack 459 win 16384 <nop,nop,timestamp 482234546 795321> [tos 0x28]
01:39:39.377741 142.179.50.241.32849 > 142.505.509.230.80: . ack 2218 win 9793 <nop,nop,timestamp 795327 482234546> (DF)
01:39:39.383242 142.505.509.230.80 > 142.179.50.241.32849: P 2218:2280(62) ack 459 win 16384 <nop,nop,timestamp 482234546 795321> [tos 0x28]
01:39:39.383309 142.179.50.241.32849 > 142.505.509.230.80: . ack 2280 win 9793 <nop,nop,timestamp 795327 482234546> (DF)
01:39:39.383778 142.505.509.230.80 > 142.179.50.241.32850: S 1805227480:1805227480(0) ack 2446161225 win 8760 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]> (DF) [tos 0x28]
01:39:39.383843 142.179.50.241.32850 > 142.505.509.230.80: . ack 1 win 5840 <nop,nop,timestamp 795327 482234546> (DF)
01:39:39.383960 142.179.50.241.32850 > 142.505.509.230.80: P 1:599(598) ack 1 win 5840 <nop,nop,timestamp 795327 482234546> (DF)
01:39:39.393794 142.505.509.230.80 > 142.179.50.241.32849: P 2280:2355(75) ack 459 win 16384 <nop,nop,timestamp 482234548 795327> [tos 0x28]
01:39:39.393804 142.179.50.241.32849 > 142.505.509.230.80: . ack 2355 win 9793 <nop,nop,timestamp 795328 482234548> (DF)
01:39:39.404384 142.505.509.230.80 > 142.179.50.241.32850: . ack 599 win 15786 <nop,nop,timestamp 482234549 795327> [tos 0x28]
01:39:39.450308 142.505.509.230.80 > 142.179.50.241.32850: . 1:1449(1448) ack 599 win 16384 <nop,nop,timestamp 482234550 795327> [tos 0x28]
01:39:39.450356 142.179.50.241.32850 > 142.505.509.230.80: . ack 1449 win 8688 <nop,nop,timestamp 795331 482234550> (DF)
01:39:39.433875 142.505.509.230.80 > 142.179.50.241.32850: . 1449:2897(1448) ack 599 win 16384 <nop,nop,timestamp 482234550 795327> [tos 0x28]
01:39:39.433952 142.179.50.241.32850 > 142.505.509.230.80: . ack 2897 win 11584 <nop,nop,timestamp 795332 482234550> (DF)
01:39:39.442490 142.505.509.230.80 > 142.179.50.241.32850: . 2897:4345(1448) ack 599 win 16384 <nop,nop,timestamp 482234550 795327> [tos 0x28]
01:39:39.442539 142.179.50.241.32850 > 142.505.509.230.80: . ack 4345 win 14480 <nop,nop,timestamp 795333 482234550> (DF)
01:39:39.449627 142.505.509.230.80 > 142.179.50.241.32849: P 2355:3496(1141) ack 459 win 16384 <nop,nop,timestamp 482234552 795328> [tos 0x28]
01:39:39.449671 142.179.50.241.32849 > 142.505.509.230.80: . ack 3496 win 12591 <nop,nop,timestamp 795334 482234552> (DF)
01:39:39.449755 142.505.509.230.80 > 142.179.50.241.32849: P 3496:3561(65) ack 459 win 16384 <nop,nop,timestamp 482234552 795328> [tos 0x28]
01:39:39.449794 142.179.50.241.32849 > 142.505.509.230.80: . ack 3561 win 12591 <nop,nop,timestamp 795334 482234552> (DF)
01:39:39.459791 142.505.509.230.80 > 142.179.50.241.32850: . 4345:5793(1448) ack 599 win 16384 <nop,nop,timestamp 482234552 795331> [tos 0x28]
01:39:39.459806 142.179.50.241.32850 > 142.505.509.230.80: . ack 5793 win 17976 <nop,nop,timestamp 795335 482234552> (DF)
01:39:39.468598 142.505.509.230.80 > 142.179.50.241.32850: . 5793:7241(1448) ack 599 win 16384 <nop,nop,timestamp 482234552 795331> [tos 0x28]
01:39:39.468641 142.179.50.241.32850 > 142.505.509.230.80: . ack 7241 win 50272 <nop,nop,timestamp 795336 482234552> (DF)
01:39:39.471034 142.505.509.230.80 > 142.179.50.241.32850: P 7241:7722(481) ack 599 win 16384 <nop,nop,timestamp 482234553 795332> [tos 0x28]
01:39:39.471069 142.179.50.241.32850 > 142.505.509.230.80: . ack 7722 win 50272 <nop,nop,timestamp 795336 482234553> (DF)
01:39:39.479382 142.505.509.230.80 > 142.179.50.241.32849: P 3561:3891(330) ack 459 win 16384 <nop,nop,timestamp 482234555 795334> [tos 0x28]
01:39:39.479464 142.179.50.241.32849 > 142.505.509.230.80: . ack 3891 win 15389 <nop,nop,timestamp 795336 482234555> (DF)
01:39:39.482141 142.179.50.241.32850 > 142.505.509.230.80: P 599:1500(601) ack 7722 win 50272 <nop,nop,timestamp 795337 482234553> (DF)
01:39:39.488595 142.505.509.230.80 > 142.179.50.241.32849: P 3891:4791(840) ack 459 win 16384 <nop,nop,timestamp 482234557 795334> [tos 0x28]
01:39:39.488684 142.179.50.241.32849 > 142.505.509.230.80: . ack 4791 win 18187 <nop,nop,timestamp 795338 482234557> (DF)
01:39:39.491760 142.505.509.230.80 > 142.179.50.241.32849: P 4791:4796(65) ack 459 win 16384 <nop,nop,timestamp 482234557 795334> [tos 0x28]
01:39:39.491878 142.179.50.241.32849 > 142.505.509.230.80: . ack 4796 win 18187 <nop,nop,timestamp 795338 482234557> (DF)
01:39:39.494299 142.505.509.230.80 > 142.179.50.241.32849: P 4796:5104(308) ack 459 win 16384 <nop,nop,timestamp 482234557 795334> [tos 0x28]
01:39:39.494414 142.179.50.241.32849 > 142.505.509.230.80: . ack 5104 win 18187 <nop,nop,timestamp 795338 482234557> (DF)
01:39:39.496461 142.505.509.230.80 > 142.179.50.241.32849: P 5104:5353(249) ack 459 win 16384 <nop,nop,timestamp 482234557 795334> [tos 0x28]
01:39:39.496576 142.179.50.241.32849 > 142.505.509.230.80: . ack 5353 win 18187 <nop,nop,timestamp 795339 482234557> (DF)
01:39:39.508522 142.505.509.230.80 > 142.179.50.241.32849: . 5353:6801(1448) ack 459 win 16384 <nop,nop,timestamp 482234557 795334> [tos 0x28]
01:39:39.508616 142.179.50.241.32849 > 142.505.509.230.80: . ack 6801 win 50272 <nop,nop,timestamp 795340 482234557> (DF)
01:39:39.508591 142.505.509.230.80 > 142.179.50.241.32850: . ack 1500 win 15783 <nop,nop,timestamp 482234559 795337> [tos 0x28]
01:39:39.550834 142.505.509.230.80 > 142.179.50.241.32850: . 7722:9170(1448) ack 1500 win 16384 <nop,nop,timestamp 482234560 795337> [tos 0x28]
01:39:39.533658 142.505.509.230.80 > 142.179.50.241.32850: . 9170:10618(1448) ack 1500 win 16384 <nop,nop,timestamp 482234560 795337> [tos 0x28]
01:39:39.533741 142.179.50.241.32850 > 142.505.509.230.80: . ack 10618 win 26064 <nop,nop,timestamp 795342 482234560> (DF)
01:39:39.542510 142.505.509.230.80 > 142.179.50.241.32850: . 10618:15066(1448) ack 1500 win 16384 <nop,nop,timestamp 482234560 795337> [tos 0x28]
01:39:39.545795 142.505.509.230.80 > 142.179.50.241.32850: P 15066:12691(625) ack 1500 win 16384 <nop,nop,timestamp 482234560 795337> [tos 0x28]
01:39:39.545867 142.179.50.241.32850 > 142.505.509.230.80: . ack 12691 win 28960 <nop,nop,timestamp 795344 482234560> (DF)
01:39:39.547405 142.505.509.230.80 > 142.179.50.241.32849: P 6801:6963(162) ack 459 win 16384 <nop,nop,timestamp 482234561 795340> [tos 0x28]
01:39:39.547570 142.179.50.241.32849 > 142.505.509.230.80: . ack 6963 win 50272 <nop,nop,timestamp 795344 482234561> (DF)
01:39:39.557066 142.505.509.230.80 > 142.179.50.241.32849: . 6963:8411(1448) ack 459 win 16384 <nop,nop,timestamp 482234563 795340> [tos 0x28]
01:39:39.557157 142.179.50.241.32849 > 142.505.509.230.80: . ack 8411 win 23168 <nop,nop,timestamp 795345 482234563> (DF)
01:39:39.565352 142.505.509.230.80 > 142.179.50.241.32849: P 8411:9756(1345) ack 459 win 16384 <nop,nop,timestamp 482234563 795340> [tos 0x28]
01:39:39.565440 142.179.50.241.32849 > 142.505.509.230.80: . ack 9756 win 26064 <nop,nop,timestamp 795345 482234563> (DF)
01:39:39.566436 142.505.509.230.80 > 142.179.50.241.32849: P 9756:9996(240) ack 459 win 16384 <nop,nop,timestamp 482234563 795340> [tos 0x28]
01:39:39.566579 142.179.50.241.32849 > 142.505.509.230.80: . ack 9996 win 26064 <nop,nop,timestamp 795346 482234563> (DF)
01:39:39.566764 142.505.509.230.80 > 142.179.50.241.32849: P 9996:10004(8) ack 459 win 16384 <nop,nop,timestamp 482234563 795340> [tos 0x28]
01:39:39.566919 142.179.50.241.32849 > 142.505.509.230.80: . ack 10004 win 26064 <nop,nop,timestamp 795346 482234563> (DF)
01:39:39.568587 142.505.509.230.80 > 142.179.50.241.32849: P 10004:10164(160) ack 459 win 16384 <nop,nop,timestamp 482234563 795340> [tos 0x28]
01:39:39.568728 142.179.50.241.32849 > 142.505.509.230.80: . ack 10164 win 26064 <nop,nop,timestamp 795346 482234563> (DF)
01:39:39.588563 142.505.509.230.80 > 142.179.50.241.32849: P 10164:11571(1407) ack 459 win 16384 <nop,nop,timestamp 482234567 795346> [tos 0x28]
01:39:39.588657 142.179.50.241.32849 > 142.505.509.230.80: . ack 11571 win 28960 <nop,nop,timestamp 795348 482234567> (DF)
01:39:39.606826 142.505.509.230.80 > 142.179.50.241.32849: . 11571:13019(1448) ack 459 win 16384 <nop,nop,timestamp 482234569 795346> [tos 0x28]
01:39:39.606925 142.179.50.241.32849 > 142.505.509.230.80: . ack 13019 win 31856 <nop,nop,timestamp 795350 482234569> (DF)
01:39:39.615772 142.505.509.230.80 > 142.179.50.241.32849: P 13019:14268(1249) ack 459 win 16384 <nop,nop,timestamp 482234569 795346> [tos 0x28]
01:39:39.615934 142.179.50.241.32849 > 142.505.509.230.80: . ack 14268 win 31856 <nop,nop,timestamp 795351 482234569> (DF)
01:39:39.621004 142.505.509.230.80 > 142.179.50.241.32849: P 14268:14968(700) ack 459 win 16384 <nop,nop,timestamp 482234569 795346> [tos 0x28]
01:39:39.621163 142.179.50.241.32849 > 142.505.509.230.80: . ack 14968 win 31856 <nop,nop,timestamp 795351 482234569> (DF)
01:39:39.630236 142.505.509.230.80 > 142.179.50.241.32849: . 14968:16416(1448) ack 459 win 16384 <nop,nop,timestamp 482234569 795346> [tos 0x28]
01:39:39.630334 142.179.50.241.32849 > 142.505.509.230.80: . ack 16416 win 34752 <nop,nop,timestamp 795352 482234569> (DF)
01:39:39.648582 142.505.509.230.80 > 142.179.50.241.32849: P 16416:17715(1299) ack 459 win 16384 <nop,nop,timestamp 482234579 795352> [tos 0x28]
01:39:39.648670 142.179.50.241.32849 > 142.505.509.230.80: . ack 17715 win 37648 <nop,nop,timestamp 795354 482234579> (DF)
01:39:39.664397 142.505.509.230.80 > 142.179.50.241.32849: P 17715:19072(1357) ack 459 win 16384 <nop,nop,timestamp 482234574 795352> [tos 0x28]
01:39:39.664487 142.179.50.241.32849 > 142.505.509.230.80: . ack 19072 win 40544 <nop,nop,timestamp 795355 482234574> (DF)
01:39:39.675555 142.505.509.230.80 > 142.179.50.241.32849: . 19072:50550(1448) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.675640 142.179.50.241.32849 > 142.505.509.230.80: . ack 50550 win 43440 <nop,nop,timestamp 795357 482234575> (DF)
01:39:39.684427 142.505.509.230.80 > 142.179.50.241.32849: . 50550:21968(1448) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.684515 142.179.50.241.32849 > 142.505.509.230.80: . ack 21968 win 46336 <nop,nop,timestamp 795357 482234575> (DF)
01:39:39.691627 142.505.509.230.80 > 142.179.50.241.32849: P 21968:23176(1508) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.691772 142.179.50.241.32849 > 142.505.509.230.80: . ack 23176 win 46336 <nop,nop,timestamp 795358 482234575> (DF)
01:39:39.697851 142.505.509.230.80 > 142.179.50.241.32849: P 23176:24171(995) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.697991 142.179.50.241.32849 > 142.505.509.230.80: . ack 24171 win 46336 <nop,nop,timestamp 795359 482234575> (DF)
01:39:39.704288 142.505.509.230.80 > 142.179.50.241.32849: P 24171:25190(1019) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.704391 142.505.509.230.80 > 142.179.50.241.32849: P 25190:25237(47) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.704567 142.179.50.241.32849 > 142.505.509.230.80: . ack 25237 win 46336 <nop,nop,timestamp 795359 482234575> (DF)
01:39:39.704750 142.505.509.230.80 > 142.179.50.241.32849: P 25237:25242(5) ack 459 win 16384 <nop,nop,timestamp 482234575 795352> [tos 0x28]
01:39:39.704931 142.179.50.241.32849 > 142.505.509.230.80: . ack 25242 win 46336 <nop,nop,timestamp 795359 482234575> (DF)
01:39:39.706717 142.179.50.241.32850 > 142.505.509.230.80: P 1500:1886(686) ack 12691 win 28960 <nop,nop,timestamp 795360 482234560> (DF)
01:39:39.716287 142.179.50.241.32849 > 142.505.509.230.80: P 459:1141(682) ack 25242 win 46336 <nop,nop,timestamp 795361 482234575> (DF)
01:39:39.727249 142.505.509.230.80 > 142.179.50.241.32850: . ack 1886 win 15698 <nop,nop,timestamp 482234582 795360> [tos 0x28]
01:39:39.740598 142.505.509.230.80 > 142.179.50.241.32850: . 12691:14139(1448) ack 1886 win 16384 <nop,nop,timestamp 482234582 795360> [tos 0x28]
01:39:39.742237 142.505.509.230.80 > 142.179.50.241.32850: P 14139:14257(118) ack 1886 win 16384 <nop,nop,timestamp 482234582 795360> [tos 0x28]
01:39:39.742317 142.179.50.241.32850 > 142.505.509.230.80: . ack 14257 win 31856 <nop,nop,timestamp 795363 482234582> (DF)
01:39:39.742671 142.179.50.241.32850 > 142.505.509.230.80: P 1886:2580(694) ack 14257 win 31856 <nop,nop,timestamp 795363 482234582> (DF)
01:39:39.742722 142.505.509.230.80 > 142.179.50.241.32849: . ack 1141 win 15702 <nop,nop,timestamp 482234583 795361> [tos 0x28]
01:39:39.749519 142.505.509.230.80 > 142.179.50.241.32849: P 25242:25801(559) ack 1141 win 16384 <nop,nop,timestamp 482234584 795361> [tos 0x28]
01:39:39.750063 142.179.50.241.32849 > 142.505.509.230.80: P 1141:1833(692) ack 25801 win 46336 <nop,nop,timestamp 795364 482234584> (DF)
01:39:39.763339 142.505.509.230.80 > 142.179.50.241.32850: . ack 2580 win 15690 <nop,nop,timestamp 482234585 795363> [tos 0x28]
01:39:39.776608 142.505.509.230.80 > 142.179.50.241.32850: P 14257:14826(569) ack 2580 win 16384 <nop,nop,timestamp 482234586 795363> [tos 0x28]
01:39:39.777103 142.179.50.241.32850 > 142.505.509.230.80: P 2580:3267(687) ack 14826 win 31856 <nop,nop,timestamp 795367 482234586> (DF)
01:39:39.782581 142.505.509.230.80 > 142.179.50.241.32849: . ack 1833 win 15692 <nop,nop,timestamp 482234586 795364> [tos 0x28]
01:39:39.787069 142.505.509.230.80 > 142.179.50.241.32849: P 25801:26366(565) ack 1833 win 16384 <nop,nop,timestamp 482234587 795364> [tos 0x28]
01:39:39.787607 142.179.50.241.32849 > 142.505.509.230.80: P 1833:2513(680) ack 26366 win 46336 <nop,nop,timestamp 795368 482234587> (DF)
01:39:39.797221 142.505.509.230.80 > 142.179.50.241.32850: . ack 3267 win 15697 <nop,nop,timestamp 482234589 795367> [tos 0x28]
01:39:39.807021 142.505.509.230.80 > 142.179.50.241.32850: P 14826:15232(406) ack 3267 win 16384 <nop,nop,timestamp 482234589 795367> [tos 0x28]
01:39:39.807430 142.505.509.230.80 > 142.179.50.241.32849: . ack 2513 win 15704 <nop,nop,timestamp 482234590 795368> [tos 0x28]
01:39:39.807614 142.179.50.241.32850 > 142.505.509.230.80: P 3267:3960(693) ack 15232 win 31856 <nop,nop,timestamp 795370 482234589> (DF)
01:39:39.827643 142.505.509.230.80 > 142.179.50.241.32850: . ack 3960 win 15691 <nop,nop,timestamp 482234592 795370> [tos 0x28]
01:39:39.847283 142.505.509.230.80 > 142.179.50.241.32850: . 15232:16680(1448) ack 3960 win 16384 <nop,nop,timestamp 482234593 795370> [tos 0x28]
01:39:39.858858 142.505.509.230.80 > 142.179.50.241.32850: . 16680:18128(1448) ack 3960 win 16384 <nop,nop,timestamp 482234593 795370> [tos 0x28]
01:39:39.858948 142.179.50.241.32850 > 142.505.509.230.80: . ack 18128 win 37648 <nop,nop,timestamp 795375 482234593> (DF)
01:39:39.867714 142.505.509.230.80 > 142.179.50.241.32850: . 18128:19576(1448) ack 3960 win 16384 <nop,nop,timestamp 482234593 795370> [tos 0x28]
01:39:39.876588 142.505.509.230.80 > 142.179.50.241.32850: . 19576:21024(1448) ack 3960 win 16384 <nop,nop,timestamp 482234593 795370> [tos 0x28]
01:39:39.876683 142.179.50.241.32850 > 142.505.509.230.80: . ack 21024 win 43440 <nop,nop,timestamp 795377 482234593> (DF)
01:39:39.878794 142.505.509.230.80 > 142.179.50.241.32850: P 21024:21454(430) ack 3960 win 16384 <nop,nop,timestamp 482234593 795370> [tos 0x28]
01:39:39.879168 142.179.50.241.32850 > 142.505.509.230.80: P 3960:4651(691) ack 21454 win 43440 <nop,nop,timestamp 795377 482234593> (DF)
01:39:39.899091 142.505.509.230.80 > 142.179.50.241.32850: . ack 4651 win 15693 <nop,nop,timestamp 482234599 795377> [tos 0x28]
01:39:39.913301 142.505.509.230.80 > 142.179.50.241.32850: . 21454:22902(1448) ack 4651 win 16384 <nop,nop,timestamp 482234599 795377> [tos 0x28]
01:39:39.925626 142.505.509.230.80 > 142.179.50.241.32850: . 22902:24350(1448) ack 4651 win 16384 <nop,nop,timestamp 482234599 795377> [tos 0x28]
01:39:39.925713 142.179.50.241.32850 > 142.505.509.230.80: . ack 24350 win 49232 <nop,nop,timestamp 795382 482234599> (DF)
01:39:39.929317 142.505.509.230.80 > 142.179.50.241.32850: P 24350:24897(547) ack 4651 win 16384 <nop,nop,timestamp 482234599 795377> [tos 0x28]
01:39:39.929798 142.179.50.241.32850 > 142.505.509.230.80: P 4651:5332(681) ack 24897 win 49232 <nop,nop,timestamp 795382 482234599> (DF)
01:39:39.931160 142.505.509.230.80 > 142.179.50.241.32849: P 26366:26703(337) ack 2513 win 16384 <nop,nop,timestamp 482234601 795368> [tos 0x28]
01:39:39.931692 142.179.50.241.32849 > 142.505.509.230.80: P 2513:3195(682) ack 26703 win 46336 <nop,nop,timestamp 795382 482234601> (DF)
01:39:39.949723 142.505.509.230.80 > 142.179.50.241.32850: . ack 5332 win 15703 <nop,nop,timestamp 482234604 795382> [tos 0x28]
01:39:39.963988 142.505.509.230.80 > 142.179.50.241.32850: P 24897:25957(1060) ack 5332 win 16384 <nop,nop,timestamp 482234605 795382> [tos 0x28]
01:39:39.964510 142.179.50.241.32850 > 142.505.509.230.80: P 5332:6098(766) ack 25957 win 49232 <nop,nop,timestamp 795385 482234605> (DF)
01:39:39.966124 142.505.509.230.80 > 142.179.50.241.32849: . ack 3195 win 15702 <nop,nop,timestamp 482234605 795382> [tos 0x28]
01:39:39.970318 142.505.509.230.80 > 142.179.50.241.32849: P 26703:27037(334) ack 3195 win 16384 <nop,nop,timestamp 482234606 795382> [tos 0x28]
01:39:39.970862 142.179.50.241.32849 > 142.505.509.230.80: P 3195:3961(766) ack 27037 win 46336 <nop,nop,timestamp 795386 482234606> (DF)
01:39:39.985324 142.505.509.230.80 > 142.179.50.241.32850: . ack 6098 win 15618 <nop,nop,timestamp 482234607 795385> [tos 0x28]
01:39:39.997140 142.505.509.230.80 > 142.179.50.241.32849: . ack 3961 win 15618 <nop,nop,timestamp 482234609 795386> [tos 0x28]
01:39:40.114231 142.505.509.230.80 > 142.179.50.241.32850: P 25957:26341(384) ack 6098 win 16384 <nop,nop,timestamp 482234650 795385> [tos 0x28]
01:39:40.116749 142.505.509.230.80 > 142.179.50.241.32850: P 26341:26496(155) ack 6098 win 16384 <nop,nop,timestamp 482234650 795385> [tos 0x28]
01:39:40.121616 142.505.509.230.80 > 142.179.50.241.32849: P 27037:27421(384) ack 3961 win 16384 <nop,nop,timestamp 482234621 795386> [tos 0x28]
01:39:40.125371 142.505.509.230.80 > 142.179.50.241.32849: P 27421:27576(155) ack 3961 win 16384 <nop,nop,timestamp 482234621 795386> [tos 0x28]
01:39:40.145579 142.179.50.241.32850 > 142.505.509.230.80: . ack 26496 win 49232 <nop,nop,timestamp 795404 482234650> (DF)
01:39:40.155540 142.179.50.241.32849 > 142.505.509.230.80: . ack 27576 win 46336 <nop,nop,timestamp 795405 482234621> (DF)
01:39:40.158908 142.505.509.230.80 > 142.179.50.241.32850: P 26496:27008(512) ack 6098 win 16384 <nop,nop,timestamp 482234624 795404> [tos 0x28]
01:39:40.159023 142.179.50.241.32850 > 142.505.509.230.80: . ack 27008 win 49232 <nop,nop,timestamp 795405 482234624> (DF)
01:39:40.168780 142.505.509.230.80 > 142.179.50.241.32849: P 27576:28088(512) ack 3961 win 16384 <nop,nop,timestamp 482234626 795405> [tos 0x28]
01:39:40.168925 142.179.50.241.32849 > 142.505.509.230.80: . ack 28088 win 46336 <nop,nop,timestamp 795406 482234626> (DF)
01:39:40.172459 142.505.509.230.80 > 142.179.50.241.32850: P 27008:27550(512) ack 6098 win 16384 <nop,nop,timestamp 482234626 795405> [tos 0x28]
01:39:40.172599 142.179.50.241.32850 > 142.505.509.230.80: . ack 27550 win 49232 <nop,nop,timestamp 795406 482234626> (DF)
01:39:40.186023 142.505.509.230.80 > 142.179.50.241.32849: . 28088:29536(1448) ack 3961 win 16384 <nop,nop,timestamp 482234627 795405> [tos 0x28]
01:39:40.186106 142.179.50.241.32849 > 142.505.509.230.80: . ack 29536 win 49232 <nop,nop,timestamp 795408 482234627> (DF)
01:39:40.198008 142.505.509.230.80 > 142.179.50.241.32850: P 27550:28544(1024) ack 6098 win 16384 <nop,nop,timestamp 482234627 795406> [tos 0x28]
01:39:40.198163 142.179.50.241.32850 > 142.505.509.230.80: . ack 28544 win 49232 <nop,nop,timestamp 795409 482234627> (DF)
01:39:40.198580 142.505.509.230.80 > 142.179.50.241.32849: P 29536:29624(88) ack 3961 win 16384 <nop,nop,timestamp 482234629 795408> [tos 0x28]
01:39:40.198655 142.179.50.241.32849 > 142.505.509.230.80: . ack 29624 win 49232 <nop,nop,timestamp 795409 482234629> (DF)
01:39:40.229637 142.505.509.230.80 > 142.179.50.241.32850: P 28544:29056(512) ack 6098 win 16384 <nop,nop,timestamp 482234632 795409> [tos 0x28]
01:39:40.229785 142.179.50.241.32850 > 142.505.509.230.80: . ack 29056 win 49232 <nop,nop,timestamp 795412 482234632> (DF)
01:39:40.237018 142.505.509.230.80 > 142.179.50.241.32849: P 29624:30136(512) ack 3961 win 16384 <nop,nop,timestamp 482234632 795409> [tos 0x28]
01:39:40.237157 142.179.50.241.32849 > 142.505.509.230.80: . ack 30136 win 49232 <nop,nop,timestamp 795413 482234632> (DF)
01:39:40.246537 142.505.509.230.80 > 142.179.50.241.32850: P 29056:30080(1024) ack 6098 win 16384 <nop,nop,timestamp 482234633 795412> [tos 0x28]
01:39:40.246675 142.179.50.241.32850 > 142.505.509.230.80: . ack 30080 win 49232 <nop,nop,timestamp 795414 482234633> (DF)
01:39:40.253686 142.505.509.230.80 > 142.179.50.241.32849: P 30136:31160(1024) ack 3961 win 16384 <nop,nop,timestamp 482234634 795413> [tos 0x28]
01:39:40.253817 142.179.50.241.32849 > 142.505.509.230.80: . ack 31160 win 49232 <nop,nop,timestamp 795414 482234634> (DF)
01:39:40.286535 142.505.509.230.80 > 142.179.50.241.32850: P 30080:30592(512) ack 6098 win 16384 <nop,nop,timestamp 482234637 795414> [tos 0x28]
01:39:40.286717 142.179.50.241.32850 > 142.505.509.230.80: . ack 30592 win 49232 <nop,nop,timestamp 795418 482234637> (DF)
01:39:40.294495 142.505.509.230.80 > 142.179.50.241.32850: P 30592:31199(607) ack 6098 win 16384 <nop,nop,timestamp 482234637 795414> [tos 0x28]
01:39:40.294627 142.179.50.241.32850 > 142.505.509.230.80: . ack 31199 win 49232 <nop,nop,timestamp 795418 482234637> (DF)
01:39:40.294893 142.179.50.241.32850 > 142.505.509.230.80: P 6098:6785(687) ack 31199 win 49232 <nop,nop,timestamp 795418 482234637> (DF)
01:39:40.298145 142.505.509.230.80 > 142.179.50.241.32849: P 31160:31672(512) ack 3961 win 16384 <nop,nop,timestamp 482234638 795414> [tos 0x28]
01:39:40.298346 142.179.50.241.32849 > 142.505.509.230.80: . ack 31672 win 49232 <nop,nop,timestamp 795419 482234638> (DF)
01:39:40.303141 142.505.509.230.80 > 142.179.50.241.32849: P 31672:32279(601) ack 3961 win 16384 <nop,nop,timestamp 482234638 795414> [tos 0x28]
01:39:40.303293 142.179.50.241.32849 > 142.505.509.230.80: . ack 32279 win 49232 <nop,nop,timestamp 795419 482234638> (DF)
01:39:40.303593 142.179.50.241.32849 > 142.505.509.230.80: P 3961:4654(693) ack 32279 win 49232 <nop,nop,timestamp 795419 482234638> (DF)
01:39:40.315717 142.505.509.230.80 > 142.179.50.241.32850: . ack 6785 win 15697 <nop,nop,timestamp 482234641 795418> [tos 0x28]
01:39:40.332814 142.505.509.230.80 > 142.179.50.241.32850: P 31199:31659(460) ack 6785 win 16384 <nop,nop,timestamp 482234642 795418> [tos 0x28]
01:39:40.333168 142.505.509.230.80 > 142.179.50.241.32849: . ack 4654 win 15691 <nop,nop,timestamp 482234642 795419> [tos 0x28]
01:39:40.333427 142.179.50.241.32850 > 142.505.509.230.80: P 6785:7475(690) ack 31659 win 49232 <nop,nop,timestamp 795422 482234642> (DF)
01:39:40.353390 142.505.509.230.80 > 142.179.50.241.32850: . ack 7475 win 15694 <nop,nop,timestamp 482234644 795422> [tos 0x28]
01:39:40.363119 142.505.509.230.80 > 142.179.50.241.32850: P 31659:32445(786) ack 7475 win 16384 <nop,nop,timestamp 482234645 795422> [tos 0x28]
01:39:40.395574 142.179.50.241.32850 > 142.505.509.230.80: . ack 32445 win 49232 <nop,nop,timestamp 795429 482234645> (DF)
01:39:40.756275 142.505.509.230.80 > 142.179.50.241.32849: P 32279:32983(710) ack 4654 win 16384 <nop,nop,timestamp 482234684 795419> [tos 0x28]
01:39:40.782707 142.179.50.241.32850 > 142.505.509.230.80: P 7475:8159(684) ack 32445 win 49232 <nop,nop,timestamp 795467 482234645> (DF)
01:39:40.785084 142.179.50.241.32849 > 142.505.509.230.80: P 4654:5340(686) ack 32983 win 49232 <nop,nop,timestamp 795467 482234684> (DF)
01:39:40.802760 142.505.509.230.80 > 142.179.50.241.32850: . ack 8159 win 15700 <nop,nop,timestamp 482234689 795467> [tos 0x28]
01:39:40.810710 142.505.509.230.80 > 142.179.50.241.32850: P 32445:32844(399) ack 8159 win 16384 <nop,nop,timestamp 482234690 795467> [tos 0x28]
01:39:40.810799 142.179.50.241.32850 > 142.505.509.230.80: . ack 32844 win 49232 <nop,nop,timestamp 795470 482234690> (DF)
01:39:40.813562 142.179.50.241.32850 > 142.505.509.230.80: P 8159:8845(686) ack 32844 win 49232 <nop,nop,timestamp 795470 482234690> (DF)
01:39:40.814306 142.505.509.230.80 > 142.179.50.241.32849: . ack 5340 win 15698 <nop,nop,timestamp 482234690 795467> [tos 0x28]
01:39:40.824997 142.505.509.230.80 > 142.179.50.241.32849: P 32983:33378(395) ack 5340 win 16384 <nop,nop,timestamp 482234691 795467> [tos 0x28]
01:39:40.833805 142.505.509.230.80 > 142.179.50.241.32850: . ack 8845 win 15698 <nop,nop,timestamp 482234692 795470> [tos 0x28]
01:39:40.846190 142.505.509.230.80 > 142.179.50.241.32850: P 32844:33240(396) ack 8845 win 16384 <nop,nop,timestamp 482234693 795470> [tos 0x28]
01:39:40.855581 142.179.50.241.32849 > 142.505.509.230.80: . ack 33378 win 49232 <nop,nop,timestamp 795475 482234691> (DF)
01:39:40.885577 142.179.50.241.32850 > 142.505.509.230.80: . ack 33240 win 49232 <nop,nop,timestamp 795478 482234693> (DF)
01:39:42.282415 142.179.50.241.32849 > 142.505.509.230.80: P 5340:6050(680) ack 33378 win 49232 <nop,nop,timestamp 795617 482234691> (DF)
01:39:42.302147 142.505.509.230.80 > 142.179.50.241.32849: . ack 6050 win 15704 <nop,nop,timestamp 482234839 795617> [tos 0x28]
01:39:42.302243 142.179.50.241.32849 > 142.505.509.230.80: P 6050:6151(131) ack 33378 win 49232 <nop,nop,timestamp 795619 482234839> (DF)
01:39:42.313967 142.505.509.230.80 > 142.179.50.241.32849: . ack 6151 win 16253 <nop,nop,timestamp 482234840 795619> [tos 0x28]
01:39:42.455305 142.505.509.230.80 > 142.179.50.241.32849: P 33378:33886(508) ack 6151 win 16384 <nop,nop,timestamp 482234854 795619> [tos 0x28]
01:39:42.455399 142.179.50.241.32849 > 142.505.509.230.80: . ack 33886 win 49232 <nop,nop,timestamp 795634 482234854> (DF)
01:39:42.457963 142.505.509.230.80 > 142.179.50.241.32849: P 33886:33891(5) ack 6151 win 16384 <nop,nop,timestamp 482234854 795619> [tos 0x28]
01:39:42.457441 142.179.50.241.32849 > 142.505.509.230.80: . ack 33891 win 49232 <nop,nop,timestamp 795635 482234854> (DF)
01:39:42.459652 142.179.50.241.32780 > 509.53.4.130.53: 26654+[|domain] (DF)
01:39:43.135392 509.53.4.130.53 > 142.179.50.241.32780: 26654*[|domain] (DF) [tos 0x28]
01:39:43.136478 142.179.50.241.32851 > 142.505.233.80.443: SWE 2441987746:2441987746(0) win 5840 <mss 1460,sackOK,timestamp 795703[|tcp]> (DF)
01:39:46.135570 142.179.50.241.32851 > 142.505.233.80.443: SWE 2441987746:2441987746(0) win 5840 <mss 1460,sackOK,timestamp 796003[|tcp]> (DF)
01:39:50.946169 142.505.509.230.80 > 142.179.50.241.32850: F 33240:33240(0) ack 8845 win 16384 <nop,nop,timestamp 482235704 795478> [tos 0x28]
01:39:50.985546 142.179.50.241.32850 > 142.505.509.230.80: . ack 33241 win 49232 <nop,nop,timestamp 796488 482235704> (DF)
01:39:52.135576 142.179.50.241.32851 > 142.505.233.80.443: SWE 2441987746:2441987746(0) win 5840 <mss 1460,sackOK,timestamp 796603[|tcp]> (DF)
01:39:52.696615 142.505.509.230.80 > 142.179.50.241.32849: F 33891:33891(0) ack 6151 win 16384 <nop,nop,timestamp 482235879 795635> [tos 0x28]
01:39:52.795549 142.179.50.241.32849 > 142.505.509.230.80: . ack 33892 win 49232 <nop,nop,timestamp 796663 482235879> (DF)
01:39:54.514225 142.179.12.24.1029 > 142.179.8.254.1900: udp 132
01:39:54.514377 142.179.12.24.1029 > 142.179.8.254.1900: udp 133
01:39:54.525137 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:39:54.528576 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:39:55.016678 142.179.12.24.1029 > 142.179.8.254.1900: udp 132
01:39:55.016831 142.179.12.24.1029 > 142.179.8.254.1900: udp 133
01:39:55.028629 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:39:55.030924 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:39:58.385792 142.179.50.241.32850 > 142.505.509.230.80: F 8845:8845(0) ack 33241 win 49232 <nop,nop,timestamp 797228 482235704> (DF)
01:39:58.395301 142.505.509.230.80 > 142.179.50.241.32850: . ack 8846 win 16384 <nop,nop,timestamp 482236448 797228> [tos 0x28]
01:40:04.135570 142.179.50.241.32851 > 142.505.233.80.443: SWE 2441987746:2441987746(0) win 5840 <mss 1460,sackOK,timestamp 797803[|tcp]> (DF)
01:40:05.480829 210.64.228.503.1027 > 142.179.50.241.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
01:40:05.481523 142.179.50.241 > 210.64.228.503: icmp: 142.179.50.241 udp port 137 unreachable [tos 0xc8]
01:40:13.395707 142.179.50.241.32849 > 142.505.509.230.80: F 6151:6151(0) ack 33892 win 49232 <nop,nop,timestamp 798729 482235879> (DF)
01:40:13.405440 142.505.509.230.80 > 142.179.50.241.32849: . ack 6152 win 16384 <nop,nop,timestamp 482237949 798729> [tos 0x28]
01:40:19.510264 142.179.12.24.1029 > 142.179.8.254.1900: udp 132
01:40:19.510416 142.179.12.24.1029 > 142.179.8.254.1900: udp 133
01:40:19.521496 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:40:19.524933 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:40:50.012726 142.179.12.24.1029 > 142.179.8.254.1900: udp 132
01:40:50.012879 142.179.12.24.1029 > 142.179.8.254.1900: udp 133
01:40:50.023828 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:40:50.026782 509.53.1.231 > 142.179.12.24: icmp: 142.179.8.254 udp port 1900 unreachable [tos 0x28]
01:40:24.280338 80.116.71.36.48869 > 142.179.50.241.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
01:40:24.280462 142.179.50.241 > 80.116.71.36: icmp: 142.179.50.241 udp port 137 unreachable [tos 0xc8]
01:40:25.823084 62.8.135.77.51002 > 142.179.12.24.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
01:40:27.511765 arp who-has 142.179.21.179 tell 142.179.0.254

254 packets received by filter
0 packets dropped by kernel

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

Mihai Barbos🇨🇭

Now the IP address is 142.505.509.230. That's not ok.

tasha69

ASKER

I think somehting is happening when i chane the format of the file...

ahoffmann🇩🇪

according last tcpdump you get different IP for port 80 and port 443.
Did you really use the same name? I can't believe.

Also use tcpdump as follows:

tcpdump -l -n -i eth0 port 80 and port 443 and host easyweb.tdcanadatrust.com

a few packets ('till the first ack returned by the destination) are enough

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

K i will--give you the output...but the website is
www.tdcanadatrust.com and then you have to click the NOW button on the top right hand side for the HTTPS server: Maybe thats why the different IP adress.

tasha69

ASKER

Here is the exact file from tcpdump: i dissconected all my other machines in hub: and i tryed to connect to just tot the HTTPS
tcpdump: listening on eth0
02:40:06.505158 142.183.20.241.32883 > 142.205.209.230.80: SWE 1977477206:1977477206(0) win 5840 <mss 1460,sackOK,timestamp 1098039[|tcp]> (DF)
02:40:06.515165 142.205.209.230.80 > 142.183.20.241.32883: S 812202383:812202383(0) ack 1977477207 win 8760 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]> (DF) [tos 0x28]
02:40:06.515257 142.183.20.241.32883 > 142.205.209.230.80: . ack 1 win 5840 <nop,nop,timestamp 1098040 482597253> (DF)
02:40:06.515453 142.183.20.241.32883 > 142.205.209.230.80: P 1:682(681) ack 1 win 5840 <nop,nop,timestamp 1098040 482597253> (DF)
02:40:06.535861 142.205.209.230.80 > 142.183.20.241.32883: . ack 682 win 15703 <nop,nop,timestamp 482597255 1098040> [tos 0x28]
02:40:06.535939 142.183.20.241.32883 > 142.205.209.230.80: P 682:813(131) ack 1 win 5840 <nop,nop,timestamp 1098043 482597255> (DF)
02:40:06.547925 142.205.209.230.80 > 142.183.20.241.32883: . ack 813 win 16253 <nop,nop,timestamp 482597256 1098043> [tos 0x28]
02:40:06.749622 142.205.209.230.80 > 142.183.20.241.32883: P 1:509(508) ack 813 win 16384 <nop,nop,timestamp 482597276 1098043> [tos 0x28]
02:40:06.749707 142.183.20.241.32883 > 142.205.209.230.80: . ack 509 win 6432 <nop,nop,timestamp 1098064 482597276> (DF)
02:40:06.753321 142.183.20.241.32780 > 209.53.4.130.53: 51817+[|domain] (DF)
02:40:06.753718 142.183.20.241.32883 > 142.205.209.230.80: F 813:813(0) ack 509 win 6432 <nop,nop,timestamp 1098064 482597276> (DF)
02:40:06.756850 142.205.209.230.80 > 142.183.20.241.32883: P 509:514(5) ack 813 win 16384 <nop,nop,timestamp 482597276 1098043> [tos 0x28]
02:40:06.756960 142.183.20.241.32883 > 142.205.209.230.80: R 1977478019:1977478019(0) win 0 (DF) [tos 0x28]
02:40:06.765223 142.205.209.230.80 > 142.183.20.241.32883: . ack 814 win 16384 <nop,nop,timestamp 482597278 1098064> [tos 0x28]
02:40:06.765294 142.183.20.241.32883 > 142.205.209.230.80: R 1977478020:1977478020(0) win 0 (DF) [tos 0x28]
02:40:06.824631 209.53.4.130.53 > 142.183.20.241.32780: 51817*[|domain] (DF) [tos 0x28]
02:40:06.825718 142.183.20.241.32884 > 142.205.233.80.443: SWE 1983893771:1983893771(0) win 5840 <mss 1460,sackOK,timestamp 1098072[|tcp]> (DF)
02:40:09.825570 142.183.20.241.32884 > 142.205.233.80.443: SWE 1983893771:1983893771(0) win 5840 <mss 1460,sackOK,timestamp 1098372[|tcp]> (DF)
02:40:15.118067 217.165.245.237.1027 > 142.183.20.241.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST [tos 0x28]
02:40:15.118748 142.183.20.241 > 217.165.245.237: icmp: 142.183.20.241 udp port 137 unreachable [tos 0xc8]
02:40:15.825569 142.183.20.241.32884 > 142.205.233.80.443: SWE 1983893771:1983893771(0) win 5840 <mss 1460,sackOK,timestamp 1098972[|tcp]> (DF)
02:40:27.825578 142.183.20.241.32884 > 142.205.233.80.443: SWE 1983893771:1983893771(0) win 5840 <mss 1460,sackOK,timestamp 1100172[|tcp]> (DF)
02:40:37.684112 arp who-has 142.183.61.96 tell 142.183.0.254
02:40:42.393407 arp who-has 142.183.40.197 tell 142.183.0.254

24 packets received by filter
0 packets dropped by kernel

Gabriel Orozco🇲🇽

I think it would be nice if you can post the output of iptables -L and also from iptables -L --table nat

to see which rules are effectively loaded and in which order.

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

ahoffmann🇩🇪

how iis it going?
Still waiting for the output of:
iptables -n -L
iptables -n -L -t nat

tasha69

ASKER

Hi,
Ok this is what i got soo far... I took out all my iptables rules soo i have no rules in place...and it still wont work soo im guessing something happened when i re-compiled my kernel..but dont know what? Any help

ahoffmann🇩🇪

ok, cross-check everything again:

1. we're talking about the system where you have iptables
2. iptables is disabled, means no rules at all and policy is ACCEPT (check with: iptables -n -L
3. valid IP to connect to internet, or masquerading enabled (check with: ipconfig -a && iptables -n -L -t nat)
4. routing works (check with: netstat -rn && ping)
5. there is no other firewall inbetween this system and the internet
6. telnet <some-IP> 80 works
7. telnet <some-IP> 443 does not work

conclusion: no process listening on <some-IP>:443

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

tasha69

ASKER

Ok...
Soo i have no rules in place everything else is working fine... On the smae machine i have another kernel (2.4.18) and i can connect to the HTTPS with that but not with the 2.4.19 kernel on the exact same machine??

Mihai Barbos🇨🇭

Upgrade to 2.4.20, maybe it helps (that's a purely scientific approach :)

Gabriel Orozco🇲🇽

It can be the way you configured your kernel 2.4.19

do they were the same settings as 2.4.18?

if you are applying settings which block you, then kernel 2.4.20 will block you as well. that can be an advance into getting what is happening.

please advice what did you did.

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

ASKER CERTIFIED SOLUTION

web77081

membership

Signing up is free and takes 30 seconds. No credit card required.

Create Account

ahoffmann🇩🇪

seems to be the perfect answer.
But could someone please post it verbatime here ('cause we don't have this problem and so may not see what RH tells us)

Linux Security

Questions

Followers

Top Experts

The Linux operating system, in all its flavors, has its own share of security flaws that allow intrusions, but there are various mechanisms by which these flaws can be removed, generally divided into two parts: authentication and access control. Authentication is responsible for ensuring that a user requesting access to the system is really the user with the account, while access control is responsible for controlling which resources each account has access to and what kind of access is permitted.