Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    if_pppoe ping works but dns doesn't?

    Scheduled Pinned Locked Moved General pfSense Questions
    21 Posts 3 Posters 3.3k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      exomic
      last edited by exomic

      Since the release of if_pppoe I'm always getting the same issue, no dns resolving but ping works.

      Sep 5 09:17:58	ppp	48942	process 48942 terminated
      Sep 5 09:17:58	ppp	48942	[wan_link0] Link: Shutdown
      Sep 5 09:17:58	ppp	48942	[wan] Bundle: Shutdown
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: Close event
      Sep 5 09:17:56	ppp	48942	[wan_link0] Link: CLOSE event
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: state change Closing --> Initial
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: LayerFinish
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: Down event
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: state change Stopping --> Closing
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: Close event
      Sep 5 09:17:56	ppp	48942	[wan_link0] Link: giving up after 0 reconnection attempts
      Sep 5 09:17:56	ppp	48942	[wan_link0] Link: DOWN event
      Sep 5 09:17:56	ppp	48942	[wan_link0] PPPoE: connection closed
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: LayerDown
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: SendTerminateAck #4
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: state change Closed --> Initial
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: Down event
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: state change Closed --> Initial
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: Down event
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: Close event
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: Close event
      Sep 5 09:17:56	ppp	48942	[wan] Bundle: Status update: up 0 links, total bandwidth 9600 bps
      Sep 5 09:17:56	ppp	48942	[wan_link0] Link: Leave bundle "wan"
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: state change Opened --> Stopping
      Sep 5 09:17:56	ppp	48942	[wan_link0] LCP: rec'd Terminate Request #70 (Opened)
      Sep 5 09:17:56	ppp	48942	[wan] Bundle: closing link "wan_link0"...
      Sep 5 09:17:56	ppp	48942	[wan] Bundle: No NCPs left. Closing links...
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: LayerFinish
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: state change Closing --> Closed
      Sep 5 09:17:56	ppp	48942	[wan] IPV6CP: rec'd Terminate Ack #2 (Closing)
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: LayerFinish
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: state change Closing --> Closed
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: rec'd Terminate Ack #4 (Closing)
      Sep 5 09:17:56	ppp	48942	[wan] IPCP: SendTerminateReq #5
      Sep 5 09:17:56	ppp	48942	[wan] IFACE: Set description "WAN"
      Sep 5 09:17:56	ppp	48942	[wan] IFACE: Rename interface pppoe0 to pppoe0
      Sep 5 09:17:56	ppp	48942	[wan] IFACE: Down event
      Sep 5 09:17:55	ppp	48942	[wan] IPV6CP: LayerDown
      Sep 5 09:17:55	ppp	48942	[wan] IPV6CP: SendTerminateReq #2
      Sep 5 09:17:55	ppp	48942	[wan] IPV6CP: state change Opened --> Closing
      Sep 5 09:17:55	ppp	48942	[wan] IPV6CP: Close event
      Sep 5 09:17:55	ppp	48942	[wan] IFACE: Removing IPv4 address from pppoe0 failed(IGNORING for now. This should be only for PPPoE friendly!): Can't assign requested address
      Sep 5 09:17:54	ppp	48942	[wan] IPCP: LayerDown
      Sep 5 09:17:54	ppp	48942	[wan] IPCP: SendTerminateReq #4
      Sep 5 09:17:54	ppp	48942	[wan] IPCP: state change Opened --> Closing
      Sep 5 09:17:54	ppp	48942	[wan] IPCP: Close event
      Sep 5 09:17:54	ppp	48942	[wan] IFACE: Close event
      Sep 5 09:17:54	ppp	48942	caught fatal signal TERM
      Sep 4 18:00:34	ppp	48942	[wan] 020a:f7ff:fe49:8660 -> 0200:00ff:fe00:0000
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: LayerUp
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: state change Ack-Sent --> Opened
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: rec'd Configure Ack #1 (Ack-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IFACE: Add description "WAN"
      Sep 4 18:00:34	ppp	48942	[wan] IFACE: Rename interface ng0 to pppoe0
      Sep 4 18:00:34	ppp	48942	[wan] IFACE: Up event
      Sep 4 18:00:34	ppp	48942	[wan] 107.xxx.xxx.38 -> 198.xxx.xxx.33
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: LayerUp
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: state change Ack-Sent --> Opened
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 107.xxx.xxx.38
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: rec'd Configure Ack #3 (Ack-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: state change Req-Sent --> Ack-Sent
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: SendConfigAck #202
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: rec'd Configure Request #202 (Req-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 107.xxx.xxx.38
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: SendConfigReq #3
      Sep 4 18:00:34	ppp	48942	[wan] 107.xxx.xxx.38 is OK
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 107.xxx.xxx.38
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: rec'd Configure Nak #2 (Ack-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 0.0.0.0
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: SendConfigReq #2
      Sep 4 18:00:34	ppp	48942	[wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: rec'd Configure Reject #1 (Ack-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: state change Req-Sent --> Ack-Sent
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 198.xxx.xxx.33
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: SendConfigAck #167
      Sep 4 18:00:34	ppp	48942	[wan] 198.xxx.xxx.33 is OK
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 198.xxx.xxx.33
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: rec'd Configure Request #167 (Req-Sent)
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: SendConfigReq #1
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: state change Starting --> Req-Sent
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: Up event
      Sep 4 18:00:34	ppp	48942	[wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
      Sep 4 18:00:34	ppp	48942	[wan] IPADDR 0.0.0.0
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: SendConfigReq #1
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: state change Starting --> Req-Sent
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: Up event
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: LayerStart
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: state change Initial --> Starting
      Sep 4 18:00:34	ppp	48942	[wan] IPV6CP: Open event
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: LayerStart
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: state change Initial --> Starting
      Sep 4 18:00:34	ppp	48942	[wan] IPCP: Open event
      Sep 4 18:00:34	ppp	48942	[wan] Bundle: Status update: up 1 link, total bandwidth 64000 bps
      Sep 4 18:00:34	ppp	48942	[wan_link0] Link: Join bundle "wan"
      Sep 4 18:00:34	ppp	48942	[wan_link0] Link: Matched action 'bundle "wan" ""'
      Sep 4 18:00:34	ppp	48942	[wan_link0] LCP: authorization successful
      Sep 4 18:00:34	ppp	48942	[wan_link0] CHAP: rec'd SUCCESS #51 len: 4
      Sep 4 18:00:34	ppp	48942	[wan_link0] CHAP: sending RESPONSE #51 len: 40
      Sep 4 18:00:34	ppp	48942	[wan_link0] CHAP: Using authname "xxx@pppoe.ebox.net"
      Sep 4 18:00:34	ppp	48942	[wan_link0] Name: "JUNOS"
      
      Sep 5 09:29:45	nginx		2025/09/05 09:29:45 [error] 81461#100290: send() failed (54: Connection reset by peer) while logging to syslog, server: unix:/var/run/log
      Sep 5 09:29:45	php-fpm	79579	/index.php: Successful login for user 'admin' from: 10.10.0.11 (Local Database)
      Sep 5 09:20:26	login	64826	login on ttyv0 as root
      Sep 5 09:20:25	vnstatd	46318	Interface "bce1.40" disabled.
      Sep 5 09:20:25	vnstatd	46318	Interface "bxe0.30" disabled.
      Sep 5 09:20:25	vnstatd	46318	Monitoring (17): pppoe0 (1000 Mbit) pfsync0 (1000 Mbit) pflog0 (1000 Mbit) ovpns3 (1000 Mbit) ovpns2 (1000 Mbit) ovpns1 (1000 Mbit) enc0 (1000 Mbit) bxe1 (10000 Mbit) bxe0.69 (10000 Mbit) bxe0.6 (10000 Mbit) bxe0.5 (10000 Mbit) bxe0.4 (10000 Mbit) bxe0.30 (1000 Mbit) bxe0 (10000 Mbit) bce1.40 (1000 Mbit) bce1 (1000 Mbit) bce0 (1000 Mbit)
      Sep 5 09:20:25	vnstatd	46318	Data retention: 48 5MinuteHours, 4 HourlyDays, 62 DailyDays, 25 MonthlyMonths, -1 YearlyYears, 20 TopDayEntries
      Sep 5 09:20:25	vnstatd	46318	vnStat daemon 2.12 (pid:46318 uid:0 gid:0, SQLite 3.46.1)
      Sep 5 09:20:25	vnstatd	48885	Error: pidfile "/var/run/vnstat/vnstat.pid" lock failed (Resource temporarily unavailable), exiting.
      Sep 5 09:20:25	root	46259	Bootup complete
      Sep 5 09:20:25	vnstatd	85230	SIGTERM received, exiting.
      Sep 5 09:20:18	arpwatch	870	listening on bxe0.4
      Sep 5 09:20:18	arpwatch	529	listening on bxe0.5
      Sep 5 09:20:18	arpwatch	67	listening on bxe0
      Sep 5 09:20:15	vnstatd	85230	Interface "bce1.40" disabled.
      Sep 5 09:20:15	vnstatd	85230	Interface "bxe0.30" disabled.
      Sep 5 09:20:15	vnstatd	85230	Monitoring (17): pppoe0 (1000 Mbit) pfsync0 (1000 Mbit) pflog0 (1000 Mbit) ovpns3 (1000 Mbit) ovpns2 (1000 Mbit) ovpns1 (1000 Mbit) enc0 (1000 Mbit) bxe1 (10000 Mbit) bxe0.69 (10000 Mbit) bxe0.6 (10000 Mbit) bxe0.5 (10000 Mbit) bxe0.4 (10000 Mbit) bxe0.30 (1000 Mbit) bxe0 (10000 Mbit) bce1.40 (1000 Mbit) bce1 (1000 Mbit) bce0 (1000 Mbit)
      Sep 5 09:20:15	vnstatd	85230	Data retention: 48 5MinuteHours, 4 HourlyDays, 62 DailyDays, 25 MonthlyMonths, -1 YearlyYears, 20 TopDayEntries
      Sep 5 09:20:15	vnstatd	85230	vnStat daemon 2.12 (pid:85230 uid:0 gid:0, SQLite 3.46.1)
      Sep 5 09:20:15	kernel		pppoe0: promiscuous mode enabled
      Sep 5 09:20:15	kernel		bxe0.4: promiscuous mode enabled
      Sep 5 09:20:15	kernel		bxe0.6: promiscuous mode enabled
      Sep 5 09:20:15	kernel		bxe0.5: promiscuous mode enabled
      Sep 5 09:20:15	kernel		bxe0: promiscuous mode enabled
      Sep 5 09:20:15	php-cgi	21500	notify_monitor.php: Could not send the message to xxx@me.com -- Error: Failed to connect to smtp.gmail.com:587 [SMTP: Failed to connect socket: php_network_getaddresses: getaddrinfo for smtp.gmail.com failed: Name does not resolve (code: -1, response: )]
      Sep 5 09:20:15	php-fpm	79579	/rc.start_packages: Skipping STARTing packages process because previous/another instance is already running
      Sep 5 09:20:14	check_reload_status	495	Reloading filter
      Sep 5 09:20:14	check_reload_status	495	Starting packages
      Sep 5 09:20:14	php-fpm	436	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 107.xxx.xxx.38 -> 66.xxx.xxx.168 - Restarting packages.
      Sep 5 09:20:13	php-fpm	79579	/rc.newwanip: Interface is unassigned, nothing to do.
      Sep 5 09:20:13	php-fpm	79579	/rc.newwanip: rc.newwanip: Info: starting on ovpns3.
      Sep 5 09:20:12	php-fpm	79579	/rc.newwanip: Interface is unassigned, nothing to do.
      Sep 5 09:20:12	php-fpm	79579	/rc.newwanip: rc.newwanip: Info: starting on ovpns2.
      Sep 5 09:20:12	php-fpm	79579	/rc.newwanip: Interface is unassigned, nothing to do.
      Sep 5 09:20:12	php-fpm	79579	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
      Sep 5 09:20:12	kernel		ovpns3: link state changed to UP
      Sep 5 09:20:12	check_reload_status	495	rc.newwanip starting ovpns3
      Sep 5 09:20:12	php-fpm	436	/rc.newwanip: Creating rrd update script
      Sep 5 09:20:12	php-fpm	436	OpenVPN PID written: 3194
      Sep 5 09:20:11	kernel		ovpns3: link state changed to DOWN
      Sep 5 09:20:11	kernel		ovpns2: link state changed to UP
      Sep 5 09:20:11	php-fpm	436	OpenVPN terminate old pid: 75580
      Sep 5 09:20:11	check_reload_status	495	rc.newwanip starting ovpns2
      Sep 5 09:20:11	php-fpm	436	OpenVPN PID written: 93147
      Sep 5 09:20:11	kernel		ovpns2: link state changed to DOWN
      Sep 5 09:20:11	php-fpm	436	OpenVPN terminate old pid: 65921
      Sep 5 09:20:11	kernel		ovpns1: link state changed to UP
      Sep 5 09:20:11	check_reload_status	495	rc.newwanip starting ovpns1
      Sep 5 09:20:11	check_reload_status	495	Reloading filter
      Sep 5 09:20:11	php-fpm	436	OpenVPN PID written: 84119
      Sep 5 09:20:11	kernel		ovpns1: link state changed to DOWN
      Sep 5 09:20:11	check_reload_status	495	Reloading filter
      Sep 5 09:20:11	php-fpm	436	OpenVPN terminate old pid: 58145
      Sep 5 09:20:10	php-fpm	436	/rc.newwanip: Resyncing OpenVPN instances for interface WAN.
      Sep 5 09:20:09	php-fpm	58220	/rc.dyndns.update: Curl error occurred: Could not resolve host: api.cloudflare.com
      Sep 5 09:20:09	php-fpm	436	/rc.newwanip: Curl error occurred: Could not resolve host: api.cloudflare.com
      Sep 5 09:19:58	php-fpm	435	/rc.start_packages: Restarting/Starting all packages.
      Sep 5 09:19:57	sshguard	11504	Now monitoring attacks.
      Sep 5 09:19:57	syslogd		kernel boot file is /boot/kernel/kernel
      Sep 5 09:19:57	syslogd		exiting on signal 15
      Sep 5 09:19:57	sshguard	16030	Exiting on signal.
      Sep 5 09:19:57	sshguard	19169	Exiting on signal.
      Sep 5 09:19:57	kernel		done.
      Sep 5 09:19:57	php-cgi	542	rc.bootup: Creating rrd update script
      Sep 5 09:19:57	php-cgi	542	rc.bootup: The command '/usr/bin/nice -n20 /usr/local/bin/rrdtool update /var/db/rrd/system-sensors.rrd N:U:U:U:U:U' returned exit code '1', the output was 'ERROR: /var/db/rrd/system-sensors.rrd: found extra data on update argument: U:U:U:U'
      Sep 5 09:19:53	kernel		done.
      Sep 5 09:19:53	php-cgi	542	rc.bootup: The command '/usr/local/sbin/strongswanrc stop' returned exit code '1', the output was 'strongswan not running? (check /var/run/daemon-charon.pid).'
      Sep 5 09:19:53	check_reload_status	495	Updating all dyndns
      Sep 5 09:19:52	kernel		done.
      Sep 5 09:19:52	php-cgi	542	rc.bootup: NTPD is starting up.
      Sep 5 09:19:47	php-fpm	436	/rc.newwanip: sync unbound done.
      Sep 5 09:19:47	php-fpm	436	/rc.newwanip: dhcp6 init complete. Continuing
      Sep 5 09:19:47	rtsold	68251	RTSOLD Lock in place - sending SIGHUP to dhcp6c
      Sep 5 09:19:47	rtsold	67556	Received RA specifying route fe80::200:ff:fe00:0 for interface wan(pppoe0)
      Sep 5 09:19:47	php-fpm	435	/rc.newwanipv6: Gateway, NONE AVAILABLE
      Sep 5 09:19:47	php-fpm	435	/rc.newwanipv6: Gateway, NONE AVAILABLE
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: IP Address has changed, killing states on former IP Address 107.xxx.xxx.38.
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: Gateway, none 'available' for inet, use the first one configured. 'WAN_PPPOE'
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: dpinger: status socket /var/run/dpinger_WAN_PPPOE~66.xxx.xxx.168~198.xxx.xxx.33.sock not found
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: dpinger: status socket /var/run/dpinger_WAN_DHCP6~2606:xxx:xxx:xxx:xxx:xxx:xxx:8660~2606:4700:4700::1111.sock not found
      Sep 5 09:19:46	php-fpm	435	/rc.newwanipv6: Removing static route for monitor 2606:4700:4700::1111 and adding a new route through pppoe0
      Sep 5 09:19:46	php-fpm	435	/rc.newwanipv6: rc.newwanipv6: on (IP address: 2606:xxx:xxx:xxx:xxx:xxx:xxx:8660) (interface: wan) (real interface: pppoe0).
      Sep 5 09:19:46	php-fpm	435	/rc.newwanipv6: rc.newwanipv6: Info: starting on pppoe0.
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: Removing static route for monitor 2606:4700:4700::1111 and adding a new route through pppoe0
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: rc.newwanip: on (IP address: 66.xxx.xxx.168) (interface: WAN[wan]) (real interface: pppoe0).
      Sep 5 09:19:46	php-fpm	436	/rc.newwanip: rc.newwanip: Info: starting on pppoe0.
      Sep 5 09:19:45	check_reload_status	495	rc.newwanipv6 starting pppoe0
      Sep 5 09:19:45	php-cgi	542	rc.bootup: sync unbound done.
      Sep 5 09:19:45	check_reload_status	495	rc.newwanip starting pppoe0
      Sep 5 09:19:45	php	94545	/usr/local/sbin/ppp-ipv6: Starting rtsold process on wan(pppoe0)
      Sep 5 09:19:45	php	94545	/usr/local/sbin/ppp-ipv6: Starting DHCP6 client for interfaces pppoe0
      Sep 5 09:19:45	php	94545	/usr/local/sbin/ppp-ipv6: Accept router advertisements on interface pppoe0
      Sep 5 09:19:44	kernel		pppoe0: link state changed to UP
      Sep 5 09:19:44	kernel		bce0: Gigabit link up!
      Sep 5 09:19:44	php-cgi	542	rc.bootup: Unbound start waiting on dhcp6c.
      Sep 5 09:19:43	php-cgi	542	rc.bootup: Unbound start waiting on dhcp6c.
      Sep 5 09:19:42	php-cgi	542	rc.bootup: Unbound start waiting on dhcp6c.
      Sep 5 09:19:41	php-fpm	436	/rc.linkup: Ignoring link event during boot sequence.
      Sep 5 09:19:41	php-fpm	435	/rc.linkup: Ignoring link event during boot sequence.
      
      1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        If you're seeing that output in the ppp log then you're not using the if_pppoe module.

        Did you enable it between those two log entries?

        How are you testing? What error(s) are you seeing?

        E 1 Reply Last reply Reply Quote 0
        • E Offline
          exomic @stephenw10
          last edited by exomic

          @stephenw10 Yes you're correct, I enabled it on sep 5 so the previous logs are using the older module. I'm not sure how to troubleshoot or test. The only thing is when I use if_pppoe the dns resolving stop (even on the host itself).

          1 Reply Last reply Reply Quote 0
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            That's using Unbound locally? Testing against something external like?:

            [2.8.1-RELEASE][admin@pfsense.fire.box]/root: dig @8.8.8.8 pfsense.org
            
            ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org
            ; (1 server found)
            ;; global options: +cmd
            ;; Got answer:
            ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48941
            ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
            
            ;; OPT PSEUDOSECTION:
            ; EDNS: version: 0, flags:; udp: 512
            ;; QUESTION SECTION:
            ;pfsense.org.			IN	A
            
            ;; ANSWER SECTION:
            pfsense.org.		300	IN	A	208.123.73.78
            
            ;; Query time: 129 msec
            ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
            ;; WHEN: Fri Sep 05 23:18:15 BST 2025
            ;; MSG SIZE  rcvd: 56
            
            

            It could an MTU issue. Can you send large pings?

            [2.8.1-RELEASE][admin@pfsense.fire.box]/root: ping -4 -s 1472 pfsense.org
            PING pfsense.org (208.123.73.78): 1472 data bytes
            1480 bytes from 208.123.73.78: icmp_seq=0 ttl=47 time=115.757 ms
            1480 bytes from 208.123.73.78: icmp_seq=1 ttl=47 time=112.487 ms
            1480 bytes from 208.123.73.78: icmp_seq=2 ttl=47 time=112.512 ms
            
            E 1 Reply Last reply Reply Quote 0
            • E Offline
              exomic @stephenw10
              last edited by

              @stephenw10 Yes Unbound locally,

              Seems large ping doesn't work:

              [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 pfsense.org
              ping: cannot resolve pfsense.org: Host name lookup failure
              
              [2.8.1-RELEASE][root@gw.*****..com]/root: ping -4 8.8.8.8
              PING 8.8.8.8 (8.8.8.8): 56 data bytes
              64 bytes from 8.8.8.8: icmp_seq=0 ttl=120 time=2.013 ms
              64 bytes from 8.8.8.8: icmp_seq=1 ttl=120 time=2.183 ms
              64 bytes from 8.8.8.8: icmp_seq=2 ttl=120 time=2.383 ms
              64 bytes from 8.8.8.8: icmp_seq=3 ttl=120 time=1.835 ms
              64 bytes from 8.8.8.8: icmp_seq=4 ttl=120 time=2.132 ms
              64 bytes from 8.8.8.8: icmp_seq=5 ttl=120 time=2.270 ms
              64 bytes from 8.8.8.8: icmp_seq=6 ttl=120 time=2.500 ms
              ^C
              --- 8.8.8.8 ping statistics ---
              7 packets transmitted, 7 packets received, 0.0% packet loss
              round-trip min/avg/max/stddev = 1.835/2.188/2.500/0.207 msà
              
              [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 8.8.8.8
              PING 8.8.8.8 (8.8.8.8): 1472 data bytes
              ^C
              --- 8.8.8.8 ping statistics ---
              4 packets transmitted, 0 packets received, 100.0% packet loss
              [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 208.123.73.78
              PING 208.123.73.78 (208.123.73.78): 1472 data bytes
              ^C
              --- 208.123.73.78 ping statistics ---
              9 packets transmitted, 0 packets received, 100.0% packet loss
              [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 208.123.73.78
              PING 208.123.73.78 (208.123.73.78): 56 data bytes
              64 bytes from 208.123.73.78: icmp_seq=0 ttl=50 time=45.105 ms
              64 bytes from 208.123.73.78: icmp_seq=1 ttl=50 time=45.264 ms
              64 bytes from 208.123.73.78: icmp_seq=2 ttl=50 time=45.400 ms
              ^C
              --- 208.123.73.78 ping statistics ---
              3 packets transmitted, 3 packets received, 0.0% packet loss
              round-trip min/avg/max/stddev = 45.105/45.256/45.400/0.121 ms
              
              [2.8.1-RELEASE][root@gw.*****.com]/root: dig @8.8.8.8 pfsense.org
              
              ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org
              ; (1 server found)
              ;; global options: +cmd
              ;; Got answer:
              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29501
              ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
              
              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 512
              ;; QUESTION SECTION:
              ;pfsense.org.                   IN      A
              
              ;; ANSWER SECTION:
              pfsense.org.            300     IN      A       208.123.73.78
              
              ;; Query time: 51 msec
              ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
              ;; WHEN: Fri Sep 05 18:51:10 EDT 2025
              ;; MSG SIZE  rcvd: 56
              
              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                1472 might be too large for your MTU but you should be able to ping at 1400 for example.

                Yup sorry 1472 is the largest packet I can send but that's after setting the parent NICs to use 1508 so I can pass full 1500B packets. Most PPPoE connections will top out with the 8B overhead at 1464.

                E 2 Replies Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Ok since digging an external server does work this seems more like an Unbound issue. Does it stop running? Any errors in the DNS Resolver log?

                  1 Reply Last reply Reply Quote 0
                  • E Offline
                    exomic @stephenw10
                    last edited by

                    @stephenw10 I just tried using 1400 and it’s giving the same problem.

                    1 Reply Last reply Reply Quote 0
                    • E Offline
                      exomic @stephenw10
                      last edited by

                      @stephenw10 So pinging in IPv4 i can go up to max of 132. In IPv6 I can do 112 as the size in the ping command. Seems the issue is not the dns resolver.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        Huh. 132 Bytes total?

                        What does the interface show the MTU as? ifconfig pppoe0

                        E 1 Reply Last reply Reply Quote 0
                        • E Offline
                          exomic @stephenw10
                          last edited by

                          @stephenw10 Exact 132 bytes

                          Here's the pppoe info:

                          [2.8.1-RELEASE][root@gw.*****.com]/root: ifconfig pppoe0
                          pppoe0: flags=1008951<UP,POINTOPOINT,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1492
                                  description: WAN
                                  options=0
                                  inet 66.xx.xx.50 --> 198.xx.xx.33 netmask 0xffffffff
                                  inet6 fe80::xx:xx:xx:8660%pppoe0 prefixlen 64 scopeid 0xd
                                  inet6 2606:xx:xx:xx:xx:xx:xx:8660 prefixlen 64 autoconf pltime 604800 vltime 2592000
                                  groups: pppoec
                                  nd6 options=123<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL,NO_DAD>
                          
                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm. Can you ping the gateway IP with large packets? Or something closer to you in the route?

                            I've not seen any other report of MTU issues with if_pppoe. I assume if you just disable it and go back to mpd5/netgraph it passes large pings OK?

                            E 1 Reply Last reply Reply Quote 0
                            • E Offline
                              exomic @stephenw10
                              last edited by exomic

                              @stephenw10 So to make sure I decided to do a clean install of pfSense 2.8.1. Same issues.

                              Using mpd5 I can ping with a size of 1464 (with overhead and pppoe I think it's really sends 1500 right?). I tried switching back to if_pppoe and I can ping the IPv4 gateway upto 132bytes + overhead. I also tried pinging the IPv6 gateway using both mpd5 and if_pppoe and it doesn't respond at all, strangely I can ping v6 external servers tho but in if_pppoe I'm limited to a size of 112bytes + overhead. I'm monitoring cloudflare ipv6 dns server instead of the ipv6 gateway since day one and everything seems ok so far.

                              Any ideas?

                              [2.8.1-RELEASE][root@gw.******.com]/root: traceroute6 2606:xxxx:xxxx::1111
                              traceroute6 to 2606:xxxx:xxxx::1111 (2606:xxxx:xxxx::1111) from 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660, 64 hops max, 28 byte packets
                               1  2606:xxxx:xxxx:xxxx::36 (2606:xxxx:xxxx:xxxx::36)  3.733 ms  1.933 ms  1.519 ms
                               2  2606:xxxx:xxxx:xxxx::3d (2606:xxxx:xxxx:xxxx::3d)  1.667 ms  2.358 ms  3.631 ms
                               3  *
                                  2400:xxxx:xxxx:xxxx::2 (2400:xxxx:xxxx:xxxx::2)  3.408 ms  2.403 ms
                               4  2400:xxxx:xxxx:xxxx::xxxx:7dab (2400:xxxx:xxxx:xxxx::xxxx:7dab)  1.939 ms
                                  2400:xxxx:xxxx:xxxx::xxxx:7d7e (2400:xxxx:xxxx:xxxx::xxxx:7d7e)  2.048 ms
                                  2400:xxxx:xxxx:xxxx::xxxx:7d9a (2400:xxxx:xxxx:xxxx::xxxx:7d9a)  2.051 ms
                              
                              [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 2606:xxxx:xxxx::1111
                              PING(160=40+8+112 bytes) 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 --> 2606:xxxx:xxxx::1111
                              120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=0 hlim=61 time=2.765 ms
                              120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=1 hlim=61 time=2.316 ms
                              120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=2 hlim=61 time=2.424 ms
                              120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=3 hlim=61 time=2.555 ms
                              120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=4 hlim=61 time=2.540 ms
                              ^C
                              --- 2606:xxxx:xxxx::1111 ping statistics ---
                              5 packets transmitted, 5 packets received, 0.0% packet loss
                              round-trip min/avg/max/stddev = 2.316/2.520/2.765/0.150 ms
                              
                              [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 fe80::xxxx:xxxx:fe00:0%pppoe0
                              PING(160=40+8+112 bytes) fe80::xxxx:xxxx:xxxx:8660%pppoe0 --> fe80::xxxx:xxxx:fe00:0%pppoe0
                              ^C
                              --- fe80::xxxx:xxxx:fe00:0%pppoe0 ping statistics ---
                              10 packets transmitted, 0 packets received, 100.0% packet loss
                              
                              w0wW 1 Reply Last reply Reply Quote 0
                              • w0wW Away
                                w0w @exomic
                                last edited by

                                @exomic
                                The only thing I notice is that you’re using MLPPP with mpd5. I’m not sure whether that could be responsible for such large differences.

                                E 1 Reply Last reply Reply Quote 0
                                • E Offline
                                  exomic @w0w
                                  last edited by

                                  @w0w I’m using Ebox (a child company of Bell Canada). Not sure they support mlppp.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S Offline
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Hmm, well that would certainly be an issue, if_pppoe doesn't support mlppp. But I think what you might be seeing is mpd5 just reporting it does support it. It also shows there is only one link in the above log.

                                    But you seem to have proven an issue in your particular setup. I'll see what other tests might be pertinent here.

                                    One thing we discovered recently is that whilst if_pppoe negotiates the MTU/MRU during the connection it doesn't do anything with the result. mpd5 does this correctly. When you use mpd5 hat MTU does the interface end up with?

                                    It's possible your ISP is forcing some low packet size but 132B would be tiny!

                                    E 1 Reply Last reply Reply Quote 0
                                    • E Offline
                                      exomic @stephenw10
                                      last edited by exomic

                                      @stephenw10 By default the wan mtu is 1492 but my isp support baby jumbo frames so I like to set it to 1500 (in ifconfig I see the pppoe mtu at 1500, the vlan interface at 1508 and the raw interface at 1520). Pinging at 1472 (1500 with the overhead) works without any issues using MPD5

                                      1 Reply Last reply Reply Quote 1
                                      • stephenw10S Offline
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Are you running any traffic shaping on the WAN?

                                        Check the output of netstat -I pppoe0 -d for errors or drops.

                                        Lastly try to grab a pcap of the connection negotiation with the ISP in the parent NIC.

                                        E 1 Reply Last reply Reply Quote 0
                                        • E Offline
                                          exomic @stephenw10
                                          last edited by

                                          @stephenw10 I'm not running any traffic shaping at all.

                                          Here's the netstat result:

                                          [2.8.1-RELEASE][root@gw.********.com]/root: netstat -I pppoe0 -d
                                          Name     Mtu Network                 Address                                 Ipkts Ierrs Idrop    Opkts Oerrs  Coll  Drop
                                          pppoe0  1500 <Link#13>               pppoe0                                   3879  2258  2258     1722
                                          pppoe0     - fe80::%pppoe0/64        fe80::20a:xxxx:xxxx:8660%pppoe0             0     -     -        10     -     -     -
                                          pppoe0     - 173.xxx.xxx.29/32       173.xxx.xxx.29                            393     -     -       21     -     -     -
                                          pppoe0     - 2606:xxxx:xxxx:2f3a::/64  2606:xxxx:xxxx:2f3a:20a:xxxx:xxxx:8660      394     -     -       16     -   
                                          

                                          And the pcap of the pppoe negotiation

                                          16:38:47.347011 PPPoE PADI [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC]
                                          16:38:47.348431 PPPoE PADO [Service-Name] [AC-Name "VDRLPQ5502W"] [Host-Uniq 0x4680C6A1] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [PPP-Max-Payload 0x05DC]
                                          16:38:47.348434 PPPoE PADR [Service-Name] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC]
                                          16:38:47.350558 PPPoE PADS [ses 0x92a] [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC]
                                          16:38:47.350562 PPPoE  [ses 0x92a] LCP, Conf-Request (0x01), id 1, length 12
                                          16:38:47.351004 PPPoE  [ses 0x92a] LCP, Conf-Request (0x01), id 111, length 20
                                          16:38:47.351006 PPPoE  [ses 0x92a] LCP, Conf-Ack (0x02), id 111, length 20
                                          16:38:47.352703 PPPoE  [ses 0x92a] LCP, Conf-Ack (0x02), id 1, length 12
                                          16:38:47.352707 PPPoE  [ses 0x92a] PAP, Auth-Req (0x01), id 2, Peer REDACTED@pppoe.ebox.net, Name REDACTED
                                          16:38:47.739573 PPPoE  [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 17
                                          16:38:47.739582 PPPoE  [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 17
                                          16:38:47.739588 PPPoE  [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 12
                                          16:38:47.741720 PPPoE  [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 12
                                          16:38:47.741745 PPPoE  [ses 0x92a] CHAP, Challenge (0x01), id 185, Value REDACTED, Name JUNOS
                                          16:38:47.741749 PPPoE  [ses 0x92a] CHAP, Response (0x02), id 185, Value REDACTED, Name REDACTED@pppoe.ebox.net
                                          16:38:47.961651 PPPoE  [ses 0x92a] CHAP, Success (0x03), id 185, Msg 
                                          16:38:47.961663 PPPoE  [ses 0x92a] IPCP, Conf-Request (0x01), id 4, length 24
                                          16:38:47.961666 PPPoE  [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          16:38:47.961667 PPPoE  [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          16:38:47.961669 PPPoE  [ses 0x92a] IP6CP, Conf-Request (0x01), id 5, length 16
                                          16:38:47.964889 PPPoE  [ses 0x92a] IPCP, Conf-Request (0x01), id 120, length 12
                                          16:38:47.964893 PPPoE  [ses 0x92a] IPCP, Conf-Ack (0x02), id 120, length 12
                                          16:38:47.965091 PPPoE  [ses 0x92a] IPCP, Conf-Nack (0x03), id 4, length 24
                                          16:38:47.965092 PPPoE  [ses 0x92a] IPCP, Conf-Request (0x01), id 6, length 24
                                          16:38:48.112866 PPPoE  [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 2 group record(s), length 48
                                          16:38:48.121018 PPPoE  [ses 0x92a] IPCP, Conf-Ack (0x02), id 6, length 24
                                          16:38:48.121041 PPPoE  [ses 0x92a] IP6CP, Conf-Request (0x01), id 10, length 16
                                          16:38:48.121045 PPPoE  [ses 0x92a] IP6CP, Conf-Ack (0x02), id 10, length 16
                                          16:38:48.121216 PPPoE  [ses 0x92a] IP6CP, Conf-Ack (0x02), id 5, length 16
                                          16:38:48.210937 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0
                                          16:38:48.211237 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:48.212934 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0
                                          16:38:48.212957 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0
                                          16:38:48.213396 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 324
                                          16:38:48.215935 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0
                                          16:38:48.216404 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448
                                          16:38:48.216406 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448
                                          16:38:48.216407 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268
                                          16:38:48.223016 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268
                                          16:38:48.257783 PPPoE  [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88
                                          16:38:48.351853 PPPoE  [ses 0x92a] PAP, Auth-Req (0x01), id 7, Peer REDACTED@pppoe.ebox.net, Name REDACTED
                                          16:38:48.392359 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0
                                          16:38:48.431076 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448
                                          16:38:48.480197 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0
                                          16:38:48.480263 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:48.482181 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0
                                          16:38:48.482201 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0
                                          16:38:48.482532 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 324
                                          16:38:48.484929 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0
                                          16:38:48.485288 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448
                                          16:38:48.485290 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448
                                          16:38:48.485320 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267
                                          16:38:48.494859 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267
                                          16:38:48.512954 PPPoE  [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0
                                          16:38:48.517870 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0
                                          16:38:48.520057 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0
                                          16:38:48.520079 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0
                                          16:38:48.520401 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 324
                                          16:38:48.523181 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0
                                          16:38:48.524074 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448
                                          16:38:48.524076 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448
                                          16:38:48.524077 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268
                                          16:38:48.533299 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268
                                          16:38:48.700950 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448
                                          16:38:48.707667 PPPoE  [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0
                                          16:38:48.742329 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448
                                          16:38:48.839075 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448
                                          16:38:48.882533 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64561 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0
                                          16:38:49.108952 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448
                                          16:38:49.140987 PPPoE  [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81
                                          16:38:49.159327 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448
                                          16:38:49.210866 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:49.275807 PPPoE  [ses 0x92a] IP 207.xx.xx.10.1702 > 173.xxx.xxx.246.9051: tcp 0
                                          16:38:49.349232 PPPoE  [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133
                                          16:38:49.383193 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0
                                          16:38:49.386172 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0
                                          16:38:49.389088 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0
                                          16:38:49.389247 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0
                                          16:38:49.427059 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0
                                          16:38:49.429306 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0
                                          16:38:49.432933 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0
                                          16:38:49.455807 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.455875 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.455944 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0
                                          16:38:49.457987 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0
                                          16:38:49.458009 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0
                                          16:38:49.458017 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0
                                          16:38:49.458041 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.458057 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0
                                          16:38:49.458078 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.458265 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 324
                                          16:38:49.458269 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 324
                                          16:38:49.458313 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 324
                                          16:38:49.460936 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0
                                          16:38:49.460938 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0
                                          16:38:49.460976 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0
                                          16:38:49.461374 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448
                                          16:38:49.461376 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448
                                          16:38:49.461377 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267
                                          16:38:49.461496 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348
                                          16:38:49.461498 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348
                                          16:38:49.461501 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348
                                          16:38:49.461560 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119
                                          16:38:49.462323 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348
                                          16:38:49.462352 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348
                                          16:38:49.462355 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348
                                          16:38:49.462356 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120
                                          16:38:49.469059 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267
                                          16:38:49.470454 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119
                                          16:38:49.471142 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120
                                          16:38:49.481293 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:49.481295 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0
                                          16:38:49.483338 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0
                                          16:38:49.483371 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0
                                          16:38:49.483433 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0
                                          16:38:49.483461 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:49.483671 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 324
                                          16:38:49.483735 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 324
                                          16:38:49.485985 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0
                                          16:38:49.486057 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0
                                          16:38:49.486435 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348
                                          16:38:49.486439 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348
                                          16:38:49.486440 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348
                                          16:38:49.486442 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119
                                          16:38:49.486520 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448
                                          16:38:49.486523 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448
                                          16:38:49.486525 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267
                                          16:38:49.495439 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267
                                          16:38:49.496070 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355: tcp 0
                                          16:38:49.496311 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119
                                          16:38:49.498368 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 31466, seq 0, length 9
                                          16:38:49.499896 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 31707, seq 0, length 9
                                          16:38:49.501408 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 31466, seq 0, length 9
                                          16:38:49.501916 PPPoE  [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 31707, seq 0, length 9
                                          16:38:49.505611 PPPoE  [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0
                                          16:38:49.654859 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64562 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0
                                          16:38:49.676201 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448
                                          16:38:49.680324 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348
                                          16:38:49.681823 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348
                                          16:38:49.705451 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348
                                          16:38:49.707574 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448
                                          16:38:49.712731 PPPoE  [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0
                                          16:38:49.831178 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0
                                          16:38:49.834091 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0
                                          16:38:49.837630 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 517
                                          16:38:49.974266 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0
                                          16:38:49.975822 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 0, length 9
                                          16:38:49.977522 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 0, length 9
                                          16:38:49.977944 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 0, length 9
                                          16:38:49.986604 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0
                                          16:38:49.986685 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.987213 PPPoE  [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 0, length 9
                                          16:38:49.989261 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:49.991877 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:49.994465 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0
                                          16:38:50.024857 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51832: tcp 1208
                                          16:38:50.027071 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208
                                          16:38:50.027075 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208
                                          16:38:50.027077 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208
                                          16:38:50.027079 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507
                                          16:38:50.029432 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0
                                          16:38:50.030441 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0
                                          16:38:50.032318 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0
                                          16:38:50.034213 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0
                                          16:38:50.038057 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0
                                          16:38:50.084076 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448
                                          16:38:50.088323 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348
                                          16:38:50.090573 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348
                                          16:38:50.113449 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348
                                          16:38:50.114453 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448
                                          16:38:50.239779 PPPoE  [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81
                                          16:38:50.243990 PPPoE  [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133
                                          16:38:50.311065 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507
                                          16:38:50.333518 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0
                                          16:38:50.336556 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0
                                          16:38:50.336817 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0
                                          16:38:50.337103 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 286
                                          16:38:50.340056 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0
                                          16:38:50.341915 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360
                                          16:38:50.341917 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360
                                          16:38:50.341944 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508
                                          16:38:50.349749 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508
                                          16:38:50.475866 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 1, length 9
                                          16:38:50.477926 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 1, length 9
                                          16:38:50.480860 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 1, length 9
                                          16:38:50.482607 PPPoE  [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 1, length 9
                                          16:38:50.559827 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360
                                          16:38:50.734051 PPPoE  [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208
                                          16:38:50.891003 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.21016 > 2606:xxxx:xxxx::1001.853: tcp 0
                                          16:38:50.891014 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.60724 > 2606:xxxx:xxxx::1111.853: tcp 0
                                          16:38:50.966822 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360
                                          16:38:50.977862 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 2, length 9
                                          16:38:50.979901 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 2, length 9
                                          16:38:50.981856 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 2, length 9
                                          16:38:50.983782 PPPoE  [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 2, length 9
                                          16:38:51.027530 PPPoE  [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660 > ff02::2: ICMP6, router solicitation, length 8
                                          16:38:51.029905 PPPoE  [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88
                                          16:38:51.156471 PPPoE  [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81
                                          16:38:51.159187 PPPoE  [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133
                                          16:38:51.307098 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64567 > 2001:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:af43.7680: tcp 0
                                          16:38:51.478866 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 3, length 9
                                          16:38:51.480905 PPPoE  [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 3, length 9
                                          16:38:51.487127 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 3, length 9
                                          16:38:51.487837 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0
                                          16:38:51.487837 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0
                                          16:38:51.489979 PPPoE  [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 3, length 9
                                          16:38:51.490281 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0
                                          16:38:51.490282 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0
                                          16:38:51.490298 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0
                                          16:38:51.490298 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0
                                          16:38:51.490747 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 324
                                          16:38:51.490748 PPPoE  [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 324
                                          16:38:51.492931 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0
                                          16:38:51.493057 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0
                                          16:38:51.493594 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448
                                          16:38:51.493597 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448
                                          16:38:51.493599 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269
                                          16:38:51.493885 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448
                                          16:38:51.493886 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448
                                          16:38:51.493887 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268
                                          16:38:51.502386 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269
                                          16:38:51.502811 PPPoE  [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268
                                          
                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S Offline
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Hmm, nothing obvious there. It sure looks to be trying to use 1500B.

                                            I see plenty on incoming large size packets too but also the Idrop counter being huge.....

                                            Are you able to upload the pcap itself to us for analysis?

                                            Do you see any large outgoing packets at all? Maybe outside the PPPoE stream?

                                            E 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.