Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall rule schedule problem

    Scheduled Pinned Locked Moved Firewalling
    23 Posts 4 Posters 5.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gbreadman
      last edited by

      Sorry, the way I enumerated them was wrong but I'm pretty sure the rule hierarchy is correct. It goes like this:

      • Anti lockout rule
      • Allow port 9339 on schedule 'Testsched'
      • Block port 9339

      Also, I have almost same configuration for Facebook but I'm blocking the IPs instead of port.
      You can connect to FB if schedule is open but once it's up, you get disconnected as you're supposed to.
      Unfortunately, this doesn't happen for blocking the games.

      Thanks for your replies :)

      1 Reply Last reply Reply Quote 0
      • M
        mer
        last edited by

        If you can grab and post screenshots of the rules, it helps, because when you say "port" do you mean destination port or source port?  Make a lot of difference in a rule.

        You've verified that the game traffic is truly using port 9339 as either source or destination port?

        1 Reply Last reply Reply Quote 0
        • G
          gbreadman
          last edited by

          I'm only using 9339 on both blocking and passing the destination ports.
          Also, I've already mentioned that the rules are actually working, except for the part that existing sessions should stop should the schedule take effect.

          Untitled.png_thumb
          Untitled.png

          1 Reply Last reply Reply Quote 0
          • M
            mer
            last edited by

            Ok, but you also say that trying to create new sessions  "fail correctly" during the block period, yes?

            That goes to the second part of what I asked, about verifying the game traffic is actually using the ports in the rules.  A simple packet capture would let you figure out if 9339 is really only used for control channels/initial setup and the actual game traffic is on a different set of ports.

            1 Reply Last reply Reply Quote 0
            • G
              gbreadman
              last edited by

              Ah I see.. that might be causing the prob. Now, to avoid further probs I might encounter for misled researching, can I just ask you how to do the packet capturing you're suggesting? Many thanks :3

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Diagnostics > Packet Capture

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • G
                  gbreadman
                  last edited by

                  Will look into it once our supervisor puts the WAN interface back up lol. thanks :)

                  1 Reply Last reply Reply Quote 0
                  • G
                    gbreadman
                    last edited by

                    Interface: LAN
                    Address Family: IPv4 only
                    Protocol: TCP
                    Host: 192.168.1.199 *device's IP
                    Port: –-

                    Capture started while port 9339 is blocked and device is trying to connect to game
                    For about a minute, I disabled the block rule.
                    Device was able to connect to the game and play.
                    After about a minute, I enabled the rule again..

                    This was the log:

                    09:25:16.993856 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 128
                    09:25:20.403165 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:20.667080 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:20.731803 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:20.732145 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
                    09:25:21.543655 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:21.828517 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:21.828755 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:21.860160 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:21.860746 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
                    09:25:21.860757 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:22.166328 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:22.268155 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:22.268353 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 6
                    09:25:23.033505 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
                    09:25:23.179947 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:23.181569 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:23.379497 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:23.381409 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
                    09:25:23.382581 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 6
                    09:25:23.672232 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:23.672462 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:23.701759 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:23.711626 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:25.883305 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
                    09:25:26.131864 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:26.132089 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:26.160957 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:27.247733 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:27.285708 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:29.075628 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:29.128908 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:30.893281 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
                    09:25:31.573455 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
                    09:25:32.731701 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:32.815361 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:32.883947 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
                    09:25:35.583508 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
                    09:25:35.871593 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
                    09:25:35.887271 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:35.887708 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:36.533207 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:36.635159 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 94
                    09:25:36.682637 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:36.827553 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:36.829435 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:36.829817 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:37.453322 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:38.561181 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 94
                    09:25:38.652198 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:38.652727 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:38.947430 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:38.949011 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:38.949436 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:39.563316 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:40.016269 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 144
                    09:25:40.085760 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
                    09:25:40.763443 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:41.050306 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:41.109918 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:41.110295 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:41.394743 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:41.422426 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:41.423006 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:41.423018 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:42.033298 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:42.276564 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:42.338977 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:42.339393 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
                    09:25:42.943384 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:43.188928 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
                    09:25:43.260037 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
                    09:25:43.260397 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28

                    1 Reply Last reply Reply Quote 0
                    • M
                      mer
                      last edited by

                      This part of the log looks like it covers about 30 seconds.  What part of the test does it correspond to?  During the minute when the rule was disabled?
                      Regardless, this is showing that the dest port is 9339, traffic is TCP. 
                      Hmm.
                      Just to make sure, the screenshot of the rules you posted earlier, they were on the LAN or FLOATING tab, yes?

                      When the traffic should be stopped (created when the rule allows it, the block rule comes into play at the scheduled time), have you done a "clear states" (should be under the Diagnostics tab)?  That would  tell us that in general the rules are "working" but the states are not getting flushed for the established session which is why the traffic still passes.  I know this is covered by the first reply to your original post, but want to cover all the bases.  You could also see what happens if you go back to that reply and just change the state of that option (if it's checked, clear it, if it's unchecked, check it).

                      I'm running out of ideas.

                      1 Reply Last reply Reply Quote 0
                      • G
                        gbreadman
                        last edited by

                        Oops, sorry bout the info, but that's the whole disable-enable process (my time estimation is bad lol).
                        So we tested it again and tried to check or uncheck the state killing option but still the same, like it's on the non-default option.
                        We used two devices this time; one connected before block applies and is still connected when block took place, while the other connected after the block but was unable to. (so rules are working)

                        .the rules are on the LAN tab ONLY and not on FLOATING. Idk what floating tab is for and haven't configured anything there. Does that matter?

                        Thanks

                        1 Reply Last reply Reply Quote 0
                        • G
                          gbreadman
                          last edited by

                          So we tested it AGAIN, after i re-read mer's reply about the state reset…
                          Allow port 9339 from 9:00-9:15, device was able to connect..

                          I went to the reset states tab at about 9:14+ and before I even get to click reset, the device lost connection at 9:15; so it's working properly now..

                          BUT I DIDN'T CHANGE A THING. I'm losing my mind. xD

                          Anyway maybe we'll just let it like this since it's not really a big flaw...

                          THANKS for helping! ^^

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Capture started while port 9339 is blocked and device is trying to connect to game
                            For about a minute, I disabled the block rule.
                            Device was able to connect to the game and play.
                            After about a minute, I enabled the rule again..

                            That looks like a flawed test.

                            Enabling a block rule will not kill existing states.

                            You need to test by letting the scheduled pass rule actually expire which will walk through the states created by the scheduled rule and kill them.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • G
                              gbreadman
                              last edited by

                              Haha sorry.. Altho the only thing it'll change is that we get to see what happens to the states on schedule timeout, but it won't change the fact that the problem is there.

                              But I will try it later. Might give us some good clues.. thanks.

                              1 Reply Last reply Reply Quote 0
                              • G
                                gbreadman
                                last edited by

                                So here it is:

                                Interface: LAN
                                Address Family: any
                                Protocol: any
                                Host address: 192.168.1.109
                                Port: –-
                                Count: 0

                                The device got disconnected only when the internet went unstable.
                                It should've been disconnected by 13:31  (Rule allows from 13:00-13:30)
                                Later, (still connected to game) we switched to a different same port game; Clash Royale, but were unable to connect.
                                We tried to go back to CoC but we can't. (Means blocking is working)

                                13:26:43.179683 IP 192.168.1.109.6422 > 192.168.1.1.53: UDP, length 36
                                13:26:43.870029 IP 192.168.1.109.1145 > 192.168.1.1.53: UDP, length 39
                                13:26:45.420404 IP 192.168.1.109.29953 > 192.168.1.1.53: UDP, length 40
                                13:26:47.569525 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
                                13:26:48.179779 IP 192.168.1.109.22284 > 192.168.1.1.53: UDP, length 48
                                13:26:48.869570 IP 192.168.1.109.36500 > 192.168.1.1.53: UDP, length 51
                                13:26:48.869974 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
                                13:26:48.869981 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
                                13:26:49.339988 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 31
                                13:26:50.429466 IP 192.168.1.109.37798 > 192.168.1.1.53: UDP, length 52
                                13:26:53.189657 IP 192.168.1.109.22284 > 192.168.1.1.53: UDP, length 48
                                13:26:53.879517 IP 192.168.1.109.36500 > 192.168.1.1.53: UDP, length 51
                                13:26:55.439420 IP 192.168.1.109.37798 > 192.168.1.1.53: UDP, length 52
                                13:26:56.609403 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 31
                                13:26:56.620798 IP 192.168.1.109.1402 > 192.168.1.1.53: UDP, length 40
                                13:26:56.621987 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:26:57.639433 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:26:59.388479 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
                                13:26:59.388640 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 0
                                13:26:59.429814 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
                                13:26:59.430999 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:26:59.431432 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:26:59.618889 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:26:59.983428 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 0
                                13:27:00.095947 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:27:00.440254 IP 192.168.1.109.52525 > 192.168.1.1.53: UDP, length 52
                                13:27:00.695441 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
                                13:27:00.712425 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:27:00.712908 IP 122.52.230.73 > 192.168.1.109: ICMP net 173.252.88.78 unreachable, length 48
                                13:27:01.630014 IP 192.168.1.109.1402 > 192.168.1.1.53: UDP, length 40
                                13:27:02.121271 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
                                13:27:02.144149 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:27:03.650202 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:27:04.909571 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
                                13:27:04.973689 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
                                13:27:04.975380 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:27:05.309911 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
                                13:27:05.429461 IP 192.168.1.109.52525 > 192.168.1.1.53: UDP, length 52
                                13:27:05.711443 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
                                13:27:05.889050 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
                                13:27:05.900797 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
                                13:27:06.119721 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
                                13:27:06.234127 IP 192.168.1.1.53 > 192.168.1.109.36500: UDP, length 126
                                13:27:06.235514 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 36500 unreachable, length 162
                                13:27:06.289578 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
                                13:27:06.303036 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
                                13:27:06.506892 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
                                13:27:06.632150 IP 192.168.1.109.57885 > 192.168.1.1.53: UDP, length 52
                                13:27:06.709889 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
                                13:27:06.710592 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
                                13:27:06.889030 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
                                13:27:06.898921 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
                                13:27:06.932628 IP 192.168.1.1.53 > 192.168.1.109.57885: UDP, length 127
                                13:27:07.099067 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
                                13:27:07.310486 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
                                13:27:07.310984 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
                                13:27:07.501463 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
                                13:27:07.583254 IP 192.168.1.1.53 > 192.168.1.109.37798: UDP, length 127
                                13:27:07.585120 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 37798 unreachable, length 163
                                13:27:07.689296 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
                                13:27:07.698784 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
                                13:27:07.921374 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
                                13:27:08.099251 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
                                13:27:08.329468 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
                                13:27:08.377281 IP 192.168.1.1.53 > 192.168.1.109.1402: UDP, length 203
                                13:27:08.386277 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1402 unreachable, length 239
                                13:27:08.502359 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
                                13:27:08.719626 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
                                13:27:09.549993 IP 192.168.1.109.36393 > 54.223.95.195.443: tcp 31
                                13:27:09.550010 IP 192.168.1.109.36393 > 54.223.95.195.443: tcp 0
                                13:27:09.885701 IP 192.168.1.1.53 > 192.168.1.109.1145: UDP, length 167
                                13:27:09.887697 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1145 unreachable, length 203
                                13:27:09.991491 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
                                13:27:09.991499 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
                                13:27:10.436895 IP 192.168.1.109.58230 > 192.168.1.1.53: UDP, length 40
                                13:27:10.669835 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
                                13:27:10.746094 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
                                13:27:10.776154 IP 192.168.1.1.53 > 192.168.1.109.1402: UDP, length 203
                                13:27:10.777728 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1402 unreachable, length 239
                                13:27:11.450983 IP 192.168.1.1.53 > 192.168.1.109.58230: UDP, length 306
                                13:27:11.451000 IP 192.168.1.1.53 > 192.168.1.109.29953: UDP, length 306
                                13:27:11.565083 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 29953 unreachable, length 342
                                13:27:11.568718 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:11.649047 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:27:11.686645 IP 192.168.1.1.53 > 192.168.1.109.6422: UDP, length 217
                                13:27:11.688808 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 6422 unreachable, length 253
                                13:27:12.579441 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:13.344531 IP 192.168.1.1.53 > 192.168.1.109.6422: UDP, length 217
                                13:27:13.409288 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 6422 unreachable, length 253
                                13:27:13.593701 IP 192.168.1.1.53 > 192.168.1.109.1145: UDP, length 167
                                13:27:13.595279 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1145 unreachable, length 203
                                13:27:14.579413 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:14.795745 IP 192.168.1.1.53 > 192.168.1.109.29953: UDP, length 306
                                13:27:14.841740 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 29953 unreachable, length 342
                                13:27:14.854959 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:14.856512 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:14.885043 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
                                13:27:15.765848 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
                                13:27:15.920074 IP 192.168.1.1.53 > 192.168.1.109.22284: UDP, length 123
                                13:27:15.923962 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 22284 unreachable, length 159
                                13:27:16.191173 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:16.275256 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:17.499489 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
                                13:27:17.765378 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:17.765481 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 35
                                13:27:17.812568 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:17.872259 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 368
                                13:27:18.769490 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 368
                                13:27:19.061633 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 286
                                13:27:19.075574 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.076130 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.077506 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.077949 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.080131 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.080252 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.086680 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.087135 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.087201 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 692
                                13:27:19.096635 IP 192.168.1.1.53 > 192.168.1.109.52525: UDP, length 127
                                13:27:19.143457 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144207 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144218 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144228 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144564 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144575 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.144987 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.145453 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.145464 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.145741 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.145921 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 52525 unreachable, length 163
                                13:27:19.193781 IP 192.168.1.109.20455 > 192.168.1.1.53: UDP, length 39
                                13:27:19.193880 IP 192.168.1.1.53 > 192.168.1.109.20455: UDP, length 167
                                13:27:19.198721 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:19.266178 IP 192.168.1.109.19159 > 192.168.1.1.53: UDP, length 44
                                13:27:19.426108 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.426295 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.426428 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.428493 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.428661 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.430981 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 847
                                13:27:19.437613 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.437733 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.437856 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.437980 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.439827 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.439947 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.445729 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.446284 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.446428 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.448233 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.448353 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.450803 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.451443 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.451828 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.454932 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.454944 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.454953 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.454963 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455802 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455813 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455823 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455832 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455842 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455851 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.455861 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456009 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456246 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456257 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456267 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456519 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.456610 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.456632 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.457109 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.458493 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.459080 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:19.461005 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:19.464620 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 228
                                13:27:19.521022 IP 192.168.1.1.53 > 192.168.1.109.19159: UDP, length 84
                                13:27:19.524707 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:19.712308 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.714357 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.726517 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.727089 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.727211 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.727333 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.727456 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.729081 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.729178 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.729500 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.730811 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.731251 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.731262 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.731422 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.731596 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.733315 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.738340 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.738460 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.738837 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.738988 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.740658 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.740912 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.741064 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.741142 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.742064 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.742076 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.742690 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.743280 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.747894 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.748754 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.748926 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.749049 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.750798 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.750918 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.751764 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.752656 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.752667 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.754854 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.755752 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.755770 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.757229 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.757670 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
                                13:27:19.757911 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1215
                                13:27:19.760164 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.760632 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:19.760943 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:20.289259 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 228
                                13:27:20.540716 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:20.554539 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:20.557370 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 1440
                                13:27:20.559114 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 1440
                                13:27:20.559186 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 63
                                13:27:20.559275 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:20.560992 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:20.561422 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:20.612911 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 126
                                13:27:20.900040 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 242
                                13:27:20.986025 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:20.989487 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
                                13:27:20.990450 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1448
                                13:27:20.991560 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1448
                                13:27:21.000459 IP 122.52.230.73 > 192.168.1.109: ICMP 54.235.110.82 unreachable - need to frag (mtu 1492), length 556
                                13:27:21.000704 IP 122.52.230.73 > 192.168.1.109: ICMP 54.235.110.82 unreachable - need to frag (mtu 1492), length 556
                                13:27:21.002604 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:21.002821 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:21.137163 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1215
                                13:27:21.139053 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:21.281919 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:21.285328 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:21.534092 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:21.601827 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:21.778989 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
                                13:27:21.867366 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:22.519690 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:22.694142 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
                                13:27:22.696979 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:22.698313 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 517
                                13:27:22.885729 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
                                13:27:22.885912 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 158
                                13:27:22.887638 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:22.891890 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 51
                                13:27:22.917976 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 1418
                                13:27:22.999958 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 117
                                13:27:23.001574 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:23.068504 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 57
                                13:27:23.068732 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 45
                                13:27:23.070360 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 796
                                13:27:23.108649 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:23.153251 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
                                13:27:23.168562 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
                                13:27:23.241857 IP 74.125.23.188.5228 > 192.168.1.109.33542: tcp 33
                                13:27:23.243288 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 0
                                13:27:23.255976 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
                                13:27:23.310008 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 263
                                13:27:23.310575 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 523
                                13:27:23.311711 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:23.312313 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:23.312392 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 37
                                13:27:23.312421 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 41
                                13:27:23.313599 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:23.313868 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
                                13:27:23.368943 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
                                13:27:23.375743 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 41
                                13:27:23.617441 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
                                13:27:23.617959 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:23.650650 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:23.650837 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:23.889689 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:23.892135 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:23.956715 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:23.957087 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:23.957528 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:23.957540 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:24.212922 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.215616 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.235821 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.236072 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.264930 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:24.265145 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:24.266096 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:24.505860 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.505878 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.526477 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.569698 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:24.570537 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:24.570838 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:24.800785 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.821245 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.821473 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:24.878315 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:24.878556 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:24.879629 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
                                13:27:24.879641 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
                                13:27:25.149920 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.152125 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.173066 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.173082 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.173541 IP 192.168.1.1.53 > 192.168.1.109.36500: UDP, length 126
                                13:27:25.184704 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1155
                                13:27:25.184844 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 36500 unreachable, length 162
                                13:27:25.370756 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
                                13:27:25.470694 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.472460 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 211
                                13:27:25.472670 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 31
                                13:27:25.493270 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 31
                                13:27:25.493763 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:25.638988 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:27:25.640702 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:25.758756 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:25.760372 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:26.239179 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
                                13:27:26.481844 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
                                13:27:26.514979 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
                                13:27:26.569967 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:26.571310 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
                                13:27:26.575886 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 517
                                13:27:26.622525 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:27:26.624229 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:26.660742 IP 192.168.1.1.53 > 192.168.1.109.37798: UDP, length 127
                                13:27:26.662460 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 37798 unreachable, length 163
                                13:27:26.813553 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:26.813696 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 137
                                13:27:26.815068 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
                                13:27:26.815914 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 51
                                13:27:26.817658 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:26.818254 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:26.818833 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:26.822941 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:27.082761 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:27.084559 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 944
                                13:27:27.142147 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:27.372769 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:27.729628 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
                                13:27:28.089236 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:28.129190 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:28.390550 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:28.402127 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:28.439839 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 171
                                13:27:28.442134 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
                                13:27:28.705946 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:28.728342 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
                                13:27:28.730127 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 211
                                13:27:28.730138 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 31
                                13:27:28.770736 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 31
                                13:27:28.771120 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
                                13:27:28.810542 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:29.073440 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:29.314981 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:29.689185 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
                                13:27:29.808762 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:30.249246 IP 192.168.1.1.53 > 192.168.1.109.22284: UDP, length 123
                                13:27:30.303439 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 22284 unreachable, length 159
                                13:27:30.438906 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
                                13:27:30.445851 IP 192.168.1.1.53 > 192.168.1.109.52525: UDP, length 127
                                13:27:30.447242 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 52525 unreachable, length 163
                                13:27:30.710973 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:27:30.711003 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:27:30.713008 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:30.713465 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:31.428820 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:31.829416 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:32.104026 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:27:32.149419 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:32.152287 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
                                13:27:32.889349 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:33.169540 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
                                13:27:35.229301 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
                                13:27:35.508493 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:27:35.509717 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
                                13:27:35.511187 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:35.512284 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:27:35.514042 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 1440
                                13:27:35.779347 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:36.404856 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
                                13:27:36.448395 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:36.518694 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:27:37.180430 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
                                13:27:37.267670 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:37.274609 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
                                13:27:37.276291 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:38.569297 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:27:39.850744 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
                                13:27:39.929909 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:40.528476 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
                                13:27:40.544463 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:41.549236 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:42.619110 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:27:44.341312 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 105
                                13:27:44.435231 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:45.186632 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 105
                                13:27:45.253764 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:47.216178 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
                                13:27:47.303684 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
                                13:27:48.571188 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 116
                                13:27:48.633941 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:50.561474 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 100
                                13:27:50.579687 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:50.688785 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:27:53.109212 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:27:53.398794 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
                                13:27:53.446772 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:57.426656 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
                                13:27:57.542827 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:27:58.119079 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
                                13:27:58.119086 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
                                13:28:05.490713 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
                                13:28:05.530094 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:05.798182 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
                                13:28:05.837290 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:06.594729 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
                                13:28:06.656164 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:06.909109 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
                                13:28:07.231473 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:07.270181 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:07.270538 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:07.568795 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:07.679611 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:07.680126 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:07.680139 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:07.962023 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:07.987464 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:08.386460 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
                                13:28:08.501007 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:08.648504 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
                                13:28:10.443210 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
                                13:28:10.547611 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:10.589701 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
                                13:28:10.869151 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:10.957112 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
                                13:28:10.957438 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
                                13:28:11.234337 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
                                13:28:11.264170 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:11.939880 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
                                13:28:12.822247 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
                                13:28:12.902842 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:13.878898 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:16.005242 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
                                13:28:16.077105 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:16.208522 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
                                13:28:16.510312 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:16.589725 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:16.590131 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:16.810457 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 108
                                13:28:16.861408 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:16.861437 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:16.896852 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:16.897514 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:16.897527 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 40
                                13:28:16.902079 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:16.903532 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:17.161768 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:17.238629 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:17.568887 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:17.748733 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:17.926033 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:18.022670 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:18.025070 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.026590 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.027000 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.315084 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.330265 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:28:18.330802 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.330812 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.608033 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.610714 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.637379 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.637777 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:28:18.848592 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
                                13:28:18.910803 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.913532 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:18.944341 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:18.944773 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:19.229397 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:19.252693 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:19.608841 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:19.886470 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:19.968997 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:19.969342 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.240543 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.242257 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.242756 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.242767 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:28:20.243017 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.515489 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.520430 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.584064 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.584399 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.872005 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.872245 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:20.889839 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:20.890628 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:21.187880 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:21.299270 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:21.458450 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:21.569177 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:28:23.489116 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:28:23.767470 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:23.859597 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:23.859894 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:24.849081 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.125523 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:25.190925 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.191241 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.469741 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:25.498114 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.499489 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.499917 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:25.588511 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 107
                                13:28:25.590063 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:26.481666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:26.669921 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:27.899338 IP 192.168.1.109.47898 > 192.168.1.1.53: UDP, length 51
                                13:28:28.419415 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:28.695877 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:28.776325 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:28.776753 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:29.052620 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:29.081965 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:29.082368 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:29.082380 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.020158 IP 192.168.1.1.53 > 192.168.1.109.47898: UDP, length 316
                                13:28:30.079041 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.083592 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.216034 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:30.217560 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.221092 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 240
                                13:28:30.359423 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:30.361094 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.361519 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.629115 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 240
                                13:28:30.644498 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:30.646107 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.646598 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.646612 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:30.770086 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:30.771424 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1428
                                13:28:30.772901 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1428
                                13:28:30.773555 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.774339 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1240
                                13:28:30.775023 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.775548 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1126
                                13:28:30.776634 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.777336 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.816362 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 126
                                13:28:30.860560 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 102
                                13:28:30.862103 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:30.953976 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 258
                                13:28:30.957713 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:30.962653 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1448
                                13:28:30.963015 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 629
                                13:28:30.963653 IP 122.52.230.73 > 192.168.1.109: ICMP 54.199.191.47 unreachable - need to frag (mtu 1492), length 556
                                13:28:30.966136 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1440
                                13:28:30.966262 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 8
                                13:28:31.094111 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:31.104223 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:31.360655 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1440
                                13:28:31.497198 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:31.499704 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 299
                                13:28:31.608579 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:31.610078 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 102
                                13:28:31.611483 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:31.630516 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
                                13:28:31.637495 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 553
                                13:28:31.679696 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:31.884259 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:31.950101 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:31.950391 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.250887 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.253365 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.358783 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.359272 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.359283 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.633997 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.641185 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.665884 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.666513 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.941501 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.941741 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:32.973037 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:32.973355 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:33.249492 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:33.280067 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:33.561831 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:33.587469 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:33.618371 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:33.658878 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 553
                                13:28:33.660560 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
                                13:28:33.896487 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:33.997244 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:33.997587 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:34.273689 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:34.276155 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:34.304408 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:34.304861 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:34.305051 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:34.581674 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:34.611712 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:34.889643 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:34.918624 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:35.589116 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:35.901327 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:35.943161 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:35.943600 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:36.928878 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:37.088761 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:37.205149 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:37.274094 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:37.274450 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:37.357636 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:37.358114 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:37.359796 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:37.360241 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
                                13:28:37.360763 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:37.640262 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:37.642434 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:37.684281 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
                                13:28:37.684707 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:37.685182 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
                                13:28:38.268930 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:38.298432 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
                                13:28:38.556772 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:38.605291 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:38.605942 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:39.238912 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:40.208892 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:40.478658 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:41.244345 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 96
                                13:28:41.268767 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:42.162569 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 96
                                13:28:42.188986 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:42.958835 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:43.238569 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:43.238590 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:43.315588 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:43.316153 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
                                13:28:43.316165 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:43.959071 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
                                13:28:44.078252 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:45.219502 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
                                13:28:45.484541 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:45.569937 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:45.570326 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
                                13:28:45.846963 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:45.876260 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:45.876835 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
                                13:28:45.876847 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:46.141869 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:46.182844 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:46.449854 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:46.490178 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:46.498126 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:46.754872 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:47.778972 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:48.049090 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:48.049345 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
                                13:28:48.128599 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:48.128982 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:48.129395 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:48.405626 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:48.405845 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:48.435635 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:48.436197 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
                                13:28:48.436208 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:49.058798 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:50.309029 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:51.868944 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:52.139517 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:52.225871 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:52.226294 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:52.788860 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:53.055079 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:53.055633 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
                                13:28:53.145067 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:53.145897 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:53.145907 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:53.188217 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.497325 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:53.556516 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.556810 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.758607 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
                                13:28:53.830693 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:53.832505 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.832979 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.832989 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:53.833402 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:54.022366 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:54.022394 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:28:54.023896 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:54.024438 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:54.024449 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:54.648929 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:54.808305 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:54.910339 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:54.910573 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
                                13:28:54.990567 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:54.991026 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:54.991037 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:55.081067 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:55.082666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:55.083051 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:55.598983 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:56.068835 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:56.306320 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
                                13:28:56.308216 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:56.349433 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:56.351762 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:56.352132 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:56.809006 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:57.328666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:57.604273 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:57.651505 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:57.651933 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 12
                                13:28:57.841030 IP 192.168.1.109.20783 > 192.168.1.1.53: UDP, length 40
                                13:28:57.859455 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:57.951072 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
                                13:28:58.061030 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:58.063826 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 226
                                13:28:58.079333 IP 192.168.1.1.53 > 192.168.1.109.20783: UDP, length 203
                                13:28:58.136495 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 124
                                13:28:58.138293 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:28:58.628854 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:58.659173 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 226
                                13:28:58.777044 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
                                13:28:58.779739 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 1440
                                13:28:58.781398 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 1440
                                13:28:58.781744 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:58.783152 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:58.783358 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 309
                                13:28:58.785155 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:58.821389 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 126
                                13:28:58.928574 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:58.930339 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:58.930674 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:59.208751 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:59.232346 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:28:59.233964 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:59.234561 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:28:59.234572 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:28:59.253827 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 309
                                13:28:59.258198 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:59.408326 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 126
                                13:28:59.493421 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 51
                                13:28:59.518153 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:28:59.597327 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:28:59.598025 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:59.598357 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:28:59.605404 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 524
                                13:29:00.146459 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 66
                                13:29:00.189166 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 524
                                13:29:00.189626 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:00.190038 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:29:00.199901 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:00.300675 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
                                13:29:00.422681 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:00.456141 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:00.457604 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:00.457901 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:00.458822 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:00.461191 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 65
                                13:29:00.465482 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
                                13:29:00.465722 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
                                13:29:00.467195 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:00.467525 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:00.498463 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
                                13:29:00.626026 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 189
                                13:29:00.986225 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:01.019028 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
                                13:29:01.020111 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:01.058309 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:01.418750 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:01.724013 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:01.747738 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:01.747873 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:02.032731 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:02.054763 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:02.055220 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:02.055664 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:02.078680 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
                                13:29:02.118402 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:02.119759 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:02.258585 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:02.329881 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:02.361885 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:29:02.958843 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:04.258757 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
                                13:29:04.346240 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
                                13:29:04.348084 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 189
                                13:29:04.433692 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
                                13:29:04.500254 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:04.500483 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:04.501851 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:04.502130 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:04.658433 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:04.740379 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:05.016900 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:05.126682 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:05.126991 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:05.412834 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:05.414558 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:05.415156 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:29:05.415168 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:05.489215 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
                                13:29:05.490638 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
                                13:29:05.695173 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:05.696910 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:06.608855 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
                                13:29:06.903954 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:06.970574 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:06.970895 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:07.250838 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:07.277433 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:07.277895 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:07.277906 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:07.574452 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:07.686807 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:08.609059 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:08.878190 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:08.915011 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:08.915619 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:09.191111 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:09.222748 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:09.223279 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:09.223291 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:09.489915 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
                                13:29:09.519500 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:09.520940 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
                                13:29:10.449556 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
                                13:29:10.724067 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
                                13:29:10.758983 IP 192.168.1.109.55194

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  I don't see any 9339 states. What is that supposed to show?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • G
                                    gbreadman
                                    last edited by

                                    @Derelict:

                                    I don't see any 9339 states. What is that supposed to show?

                                    Oh sorry. Turns out it was WAY TOO LONG so the post was cut. Guess I'll just attach the txt file. :/

                                    [New Text Document.txt](/public/imported_attachments/1/New Text Document.txt)

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Every time I look at this, it works for me.

                                      I just set up a scheduled rule to pass from my workstation to an ssh host ending at 01:59.

                                      Established two ssh sessions to that host and started a top in each.

                                      Went about my business…

                                      Session 1:

                                      top - 01:59:58 up 53 days,  5:10,  5 users,  load average: 0.03, 0.06, 0.07
                                      Tasks: 151 total,  1 running, 150 sleeping,  0 stopped,  0 zombie
                                      Cpu(s):  0.2%us,  0.2%sy,  0.0%ni, 99.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
                                      Mem:  3875144k total,  3191288k used,  683856k free,  247136k buffers
                                      Swap:  4194300k total,        4k used,  4194296k free,  2473136k cached
                                      packet_write_wait: Connection to 172.22.81.8: Broken pipe

                                      Note the time, and the state cleared, connection closed.

                                      Session 2:

                                      top - 01:59:58 up 53 days,  5:10,  5 users,  load average: 0.03, 0.06, 0.07
                                      Tasks: 151 total,  1 running, 150 sleeping,  0 stopped,  0 zombie
                                      Cpu(s):  0.3%us,  0.2%sy,  0.0%ni, 99.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
                                      Mem:  3875144k total,  3191288k used,  683856k free,  247136k buffers
                                      Swap:  4194300k total,        4k used,  4194296k free,  2473136k cached
                                      packet_write_wait: Connection to 172.22.81.8: Broken pipe

                                      Note the time, and the state cleared. Connection closed.

                                      Every time someone says it doesn't work and I try it, it works. More details needed.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        gbreadman
                                        last edited by

                                        Hmmm I would like to apologize for having a hard time interpreting that output.
                                        I'm a newbie and I don't really understand what part I'm supposed to notice.
                                        But anyway, I think I've mentioned that IP blocking and pass rules work perfectly for Facebook, but not port blocking for the game/s.

                                        If it's not too much to ask, could anyone at least try the same config and test it on their device/s to see if it would work flawlessly? That would be a big help.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mer
                                          last edited by

                                          @gbreadman:

                                          Hmmm I would like to apologize for having a hard time interpreting that output.
                                          I'm a newbie and I don't really understand what part I'm supposed to notice.
                                          But anyway, I think I've mentioned that IP blocking and pass rules work perfectly for Facebook, but not port blocking for the game/s.

                                          If it's not too much to ask, could anyone at least try the same config and test it on their device/s to see if it would work flawlessly? That would be a big help.

                                          Derelict did a similar config, simply to another port (ssh).  What you need to notice in his output is the timestamps.  He says his pass rule end time is 01:59, the timestamp is 01:59:58 and the Broken Pipe message.  He had the pass rule running then ssh'd into a remote machine (equivalent of you starting a game session), then ran top (equivalent of you playing the game).  When the pass rule timed out at 01:59, his ssh connections were dropped, there is typically a little bit of a lag between the socket closing and the Broken Pipe message (the broken pipe is showing up as an error on the write to the socket).

                                          So he did exactly what you did, just used a different "game" (ssh) and different dest port.

                                          It would be difficult for anyone to try the same config since a proper test would require use of the same game;  google around for something like "ports used by CoC…" may give more information about what needs to be blocked.  I keep going back to your statement about "existing connections are not dropped but new connections are not allowed".  To me that starts to feel like different ports getting used.  It's possible that the game traffic may actually be on a different stream, say a multicast stream instead of unicast.

                                          Raw packet captures on the LAN side of the pfSense box (tcpdump or through the pfSense Web interface) tells you what is actually going through the interface, pull them off pfSense and look at them with wireshark on a different box.  It may be a little tedious, but you'll be guaranteed to "know" what traffic is there.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.