Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CanYouSeeMe reports errors for my port forward, can't figure out why.

    Scheduled Pinned Locked Moved
    NAT
    2
    27
    5.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nicolaj
      last edited by

      Aren't those the once i attached in the OP ?

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Ugh yeah. Sorry.

        What does a packet capture on WAN show filtered on one of those ports when you test to that port?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • N
          nicolaj
          last edited by

          You want me to post the whole thing. Should i blank out ips ?
          I started it entering 49998 in the port and let it run for 5 secs while i used CanYouSeeMe. The majority is tcp, but there's some udp in there as well.

          Edit: So i just did i with 49999 instead as that is used a lot less. I got 4 of these "tcp 0" from the same ip:port to my wan ip:49999 and i used CanYouSeeMe meanwhile testing port 49999.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Capture and post with detail full. Whether or not you edit out your WAN address is up to you. If you don't want to just send a PM. If you do obfuscate please make it clear where the WAN address was. like use WAN_ADDRESS or something.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • N
              nicolaj
              last edited by 

              
02:56:34.878134 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50153, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2d18 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412048 ecr 0,nop,wscale 7], length 0
02:56:35.874878 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50154, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2c1e (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412298 ecr 0,nop,wscale 7], length 0
02:56:37.879009 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50155, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2a29 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412799 ecr 0,nop,wscale 7], length 0
02:56:41.882870 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50156, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2640 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461413800 ecr 0,nop,wscale 7], length 0

[/s][/s][/s][/s]
              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                OK do the same thing filtering on the same port but on the inside interface with the target host on it - such as LAN.

                You should see traffic sourced from the same 52.202.215.126 address (or maybe a different one in the canuseeme pool) but the destination will be 192.168.1.100.49999

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • N
                  nicolaj
                  last edited by 

                  03:03:16.899181 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24425, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x880c (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461512555 ecr 0,nop,wscale 7], length 0
03:03:17.898866 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24426, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x8712 (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461512805 ecr 0,nop,wscale 7], length 0
03:03:19.902765 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24427, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x851d (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461513306 ecr 0,nop,wscale 7], length 0
03:03:23.910745 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24428, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x8133 (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461514308 ecr 0,nop,wscale 7], length 0

Like that?[/s][/s][/s][/s]
                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Yeah. So pfsense is doing everything right. It is translating the destination address and sending out the local interface.

                    There is no response from the target host.

                    The short list is:

                    1. Firewall (think windows firewall) on 192.168.1.100 blocking the connection sourced from the "foreign address"
                    2. default gateway on 192.168.1.100 pointing somewhere other than pfSense.

                    Long list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • N
                      nicolaj
                      last edited by

                      These are the network details, which rules out #2. So in theory it's windows firewall or we're certain it's windows firewall?
                      But i have 0 errors or anything in windows firewall, would you happen to know how to view denied requests?
                      I don't have any network modifying apps installed, and it's just default windows firewall setting. On my desktop i got stuff like steam, dropbox, afterburner etc. installed. Nothing out of the ordinary.

                      Udklip.PNG
                      Udklip.PNG_thumb

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        No theory. Look at the PCAPs. They don't lie. SYN, SYN, SYN, SYN (represented there by [ S ]) and no SYN/ACK from the target.

                        There is a standard surrounding how TCP connections are established. https://en.wikipedia.org/wiki/Transmission_Control_Protocol

                        The next step in the handshake is a SYN,ACK from the server, which will be represented looking something like this there:

                        
192.168.1.100.49999 > 52.202.215.126.37581: Flags [S.]

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • N
                          nicolaj
                          last edited by

                          Allright. You have any idea how to find that in windows firewall, i've looked everywhere in advanced settings and it's just all green. No errors anywhere.
                          Oh, and now we're talking windows firewall. Is there actually a point in having it running at the same time as pfsense firewall?
                          Sure it's stopping a canyouseeme request, but i was literally punching in the port number on the website, nothing i'd normally be doing.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            idk man. that is a call you will have to make.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • N
                              nicolaj
                              last edited by

                              Event viewer shows nothing as well. I have zero idea how those requests are getting rejected.
                              Edit: Even tried manually adding the ports to a rule in win firewall, no change.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                Disable the firewall and test again. PCAP on the host itself. www.wireshark.org

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • N
                                  nicolaj
                                  last edited by

                                  Disabling firewall did nothing, so it must be deeper than that. But thanks for the help.

                                  Edit: With firewall on i get "Reason: Connection timed out". With firewall off i get "Reason: Connection refused" from canyouseeme.
                                  Edit2: it's 4.06, i'm tired. Might explain it. But i kinda forgot that you have to have a program running that accepts that connection on that port while doing the canyouseeme test. With firewall off i now have a successful test. Firewall on still fails even tho the firewall has a costume rule for that port.

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Then look at the application itself to see why it might be refusing connections from the canyouseeme address.

                                    But I saw nothing in the pcaps you showed to indicate you would have been receiving connection refused there. It should have been receiving connection timed out with no response going back.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      nicolaj
                                      last edited by

                                      And just to verify, it's the same thing with the other machine that is receiving port 49998 ?

                                      16:13:57.888817 IP (tos 0x0, ttl 116, id 18689, offset 0, flags [DF], proto TCP (6), length 52)
    193.71.160.101.52852 > WANIP.49998: Flags [s], cksum 0xe8b8 (correct), seq 3913277230, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:57.889282 IP (tos 0x0, ttl 127, id 26655, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 193.71.160.101.52852: Flags [R.], cksum 0x4978 (correct), seq 0, ack 3913277231, win 0, length 0
16:13:57.968713 IP (tos 0x0, ttl 119, id 6600, offset 0, flags [DF], proto TCP (6), length 52)
    91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xaf86 (correct), seq 3232571740, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:57.969367 IP (tos 0x0, ttl 127, id 11143, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 3232571741, win 0, length 0
16:13:58.046194 IP (tos 0x0, ttl 56, id 42970, offset 0, flags [DF], proto TCP (6), length 60)
    85.204.137.21.52719 > WANIP.49998: Flags [s], cksum 0x4780 (correct), seq 1034805388, win 29200, options [mss 1460,sackOK,TS val 239552342 ecr 0,nop,wscale 7], length 0
16:13:58.046653 IP (tos 0x0, ttl 127, id 12534, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 85.204.137.21.52719: Flags [R.], cksum 0x76fd (correct), seq 0, ack 1034805389, win 0, length 0
16:13:58.152066 IP (tos 0x0, ttl 123, id 6235, offset 0, flags [none], proto UDP (17), length 95)
    212.92.116.246.39702 > WANIP.49998: [udp sum ok] UDP, length 67
16:13:58.413002 IP (tos 0x0, ttl 56, id 5469, offset 0, flags [DF], proto TCP (6), length 60)
    83.90.149.136.36088 > WANIP.49998: Flags [s], cksum 0xe82c (correct), seq 707492687, win 14600, options [mss 1460,sackOK,TS val 798780946 ecr 0,nop,wscale 7], length 0
16:13:58.413229 IP (tos 0x0, ttl 127, id 12535, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 83.90.149.136.36088: Flags [R.], cksum 0x26b3 (correct), seq 0, ack 707492688, win 0, length 0
16:13:58.418072 IP (tos 0x0, ttl 116, id 18690, offset 0, flags [DF], proto TCP (6), length 48)
    193.71.160.101.52852 > WANIP.49998: Flags [s], cksum 0xfcc7 (correct), seq 3913277230, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:13:58.418640 IP (tos 0x0, ttl 127, id 26656, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 193.71.160.101.52852: Flags [R.], cksum 0x4978 (correct), seq 0, ack 1, win 0, length 0
16:13:58.499535 IP (tos 0x0, ttl 119, id 6601, offset 0, flags [DF], proto TCP (6), length 52)
    91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xaf86 (correct), seq 3232571740, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:58.499812 IP (tos 0x0, ttl 127, id 11144, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 1, win 0, length 0
16:13:58.656943 IP (tos 0x0, ttl 120, id 20663, offset 0, flags [none], proto UDP (17), length 48)
    93.164.229.42.27570 > WANIP.49998: [udp sum ok] UDP, length 20
16:13:58.658106 IP (tos 0x0, ttl 120, id 20664, offset 0, flags [DF], proto TCP (6), length 52)
    93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:58.658331 IP (tos 0x0, ttl 127, id 12536, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 4055112097, win 0, length 0
16:13:59.030976 IP (tos 0x0, ttl 119, id 6602, offset 0, flags [DF], proto TCP (6), length 48)
    91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xc395 (correct), seq 3232571740, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:13:59.031372 IP (tos 0x0, ttl 127, id 11145, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 1, win 0, length 0
16:13:59.180081 IP (tos 0x0, ttl 120, id 20665, offset 0, flags [DF], proto TCP (6), length 52)
    93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:59.180466 IP (tos 0x0, ttl 127, id 12537, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 1, win 0, length 0
16:13:59.199359 IP (tos 0x0, ttl 120, id 28323, offset 0, flags [none], proto UDP (17), length 48)
    83.89.35.146.19636 > WANIP.49998: [udp sum ok] UDP, length 20
16:13:59.263849 IP (tos 0x0, ttl 116, id 30157, offset 0, flags [none], proto UDP (17), length 48)
    91.101.202.99.25562 > WANIP.49998: [udp sum ok] UDP, length 20
16:13:59.358058 IP (tos 0x0, ttl 111, id 20443, offset 0, flags [DF], proto TCP (6), length 52)
    178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:59.358284 IP (tos 0x0, ttl 127, id 22757, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 412370079, win 0, length 0
16:13:59.360204 IP (tos 0x0, ttl 111, id 20442, offset 0, flags [none], proto UDP (17), length 48)
    178.155.229.89.54102 > WANIP.49998: [udp sum ok] UDP, length 20
16:13:59.506751 IP (tos 0x8, ttl 119, id 14918, offset 0, flags [none], proto UDP (17), length 48)
    185.107.12.132.26072 > WANIP.49998: [udp sum ok] UDP, length 20
16:13:59.605451 IP (tos 0x0, ttl 119, id 698, offset 0, flags [none], proto UDP (17), length 58)
    91.101.37.243.17746 > WANIP.49998: [udp sum ok] UDP, length 30
16:13:59.646463 IP (tos 0x0, ttl 120, id 15158, offset 0, flags [DF], proto TCP (6), length 52)
    87.56.246.137.52590 > WANIP.49998: Flags [s], cksum 0xff61 (correct), seq 847746103, win 8192, options [mss 1460,nop,wscale 0,nop,nop,sackOK], length 0
16:13:59.646660 IP (tos 0x0, ttl 127, id 12538, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 87.56.246.137.52590: Flags [R.], cksum 0x6019 (correct), seq 0, ack 847746104, win 0, length 0
16:13:59.754375 IP (tos 0x0, ttl 120, id 20666, offset 0, flags [DF], proto TCP (6), length 52)
    93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:59.754590 IP (tos 0x0, ttl 127, id 12539, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 1, win 0, length 0
16:13:59.884185 IP (tos 0x0, ttl 111, id 20445, offset 0, flags [DF], proto TCP (6), length 52)
    178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:13:59.884562 IP (tos 0x0, ttl 127, id 22761, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 1, win 0, length 0
16:14:00.061335 IP (tos 0x8, ttl 59, id 8067, offset 0, flags [DF], proto TCP (6), length 60)
    81.171.17.59.39167 > WANIP.49998: Flags [s], cksum 0x7c0c (correct), seq 531929245, win 29200, options [mss 1460,sackOK,TS val 2965735198 ecr 0,nop,wscale 8], length 0
16:14:00.061381 IP (tos 0x0, ttl 112, id 7328, offset 0, flags [DF], proto TCP (6), length 52)
    62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:00.061580 IP (tos 0x0, ttl 127, id 29348, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 81.171.17.59.39167: Flags [R.], cksum 0x8dd1 (correct), seq 0, ack 531929246, win 0, length 0
16:14:00.061713 IP (tos 0x0, ttl 127, id 28972, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1077860707, win 0, length 0
16:14:00.089813 IP (tos 0x8, ttl 58, id 43723, offset 0, flags [DF], proto TCP (6), length 60)
    185.149.90.64.24629 > WANIP.49998: Flags [s], cksum 0x6d18 (correct), seq 1256757224, win 29200, options [mss 1460,sackOK,TS val 3510620916 ecr 0,nop,wscale 7], length 0
16:14:00.090122 IP (tos 0x0, ttl 127, id 13730, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 185.149.90.64.24629: Flags [R.], cksum 0xeb2c (correct), seq 0, ack 1256757225, win 0, length 0
16:14:00.163629 IP (tos 0x0, ttl 120, id 1914, offset 0, flags [none], proto UDP (17), length 48)
    93.160.23.44.45852 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:00.373971 IP (tos 0x0, ttl 108, id 30473, offset 0, flags [none], proto UDP (17), length 48)
    120.153.12.217.32697 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:00.412860 IP (tos 0x0, ttl 111, id 20446, offset 0, flags [DF], proto TCP (6), length 52)
    178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:00.413150 IP (tos 0x0, ttl 127, id 22762, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 1, win 0, length 0
16:14:00.582186 IP (tos 0x0, ttl 112, id 7332, offset 0, flags [DF], proto TCP (6), length 52)
    62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:00.582393 IP (tos 0x0, ttl 127, id 28978, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1, win 0, length 0
16:14:00.630664 IP (tos 0x0, ttl 116, id 18691, offset 0, flags [none], proto UDP (17), length 48)
    193.71.160.101.3039 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:00.632794 IP (tos 0x0, ttl 119, id 11944, offset 0, flags [none], proto UDP (17), length 48)
    85.202.24.192.55935 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:00.766189 IP (tos 0x0, ttl 47, id 35519, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37521 > WANIP.49998: Flags [s], cksum 0x4059 (correct), seq 3372978479, win 26883, options [mss 1460,sackOK,TS val 473373584 ecr 0,nop,wscale 7], length 0
16:14:00.766422 IP (tos 0x0, ttl 127, id 13450, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 52.202.215.126.37521: Flags [R.], cksum 0x48f3 (correct), seq 0, ack 3372978480, win 0, length 0
16:14:00.861979 IP (tos 0x0, ttl 120, id 1112, offset 0, flags [DF], proto TCP (6), length 52)
    87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:00.862212 IP (tos 0x0, ttl 127, id 23015, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1728421197, win 0, length 0
16:14:00.897877 IP (tos 0x0, ttl 56, id 5471, offset 0, flags [none], proto UDP (17), length 48)
    80.167.114.174.36035 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:01.003320 IP (tos 0x0, ttl 49, id 47131, offset 0, flags [DF], proto TCP (6), length 60)
    5.103.138.235.45392 > WANIP.49998: Flags [s], cksum 0x1d50 (correct), seq 1955707341, win 7300, options [mss 1460,sackOK,TS val 781451734 ecr 0,nop,wscale 0], length 0
16:14:01.003507 IP (tos 0x0, ttl 127, id 12540, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 5.103.138.235.45392: Flags [R.], cksum 0xd206 (correct), seq 0, ack 1955707342, win 0, length 0
16:14:01.103543 IP (tos 0x0, ttl 112, id 7333, offset 0, flags [DF], proto TCP (6), length 52)
    62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:01.103732 IP (tos 0x0, ttl 127, id 28979, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1, win 0, length 0
16:14:01.394873 IP (tos 0x0, ttl 120, id 1113, offset 0, flags [DF], proto TCP (6), length 52)
    87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:01.395117 IP (tos 0x0, ttl 127, id 23016, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1, win 0, length 0
16:14:01.859333 IP (tos 0x0, ttl 120, id 20667, offset 0, flags [none], proto UDP (17), length 48)
    93.164.229.42.27570 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:01.952667 IP (tos 0x0, ttl 60, id 38104, offset 0, flags [DF], proto TCP (6), length 60)
    109.201.154.244.61730 > WANIP.49998: Flags [s], cksum 0x8d1a (correct), seq 3528760594, win 42340, options [mss 1460,sackOK,TS val 883165642 ecr 0,nop,wscale 11], length 0
16:14:01.952932 IP (tos 0x0, ttl 127, id 3269, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 109.201.154.244.61730: Flags [R.], cksum 0xd8c0 (correct), seq 0, ack 3528760595, win 0, length 0
16:14:01.995160 IP (tos 0x0, ttl 120, id 1114, offset 0, flags [DF], proto TCP (6), length 52)
    87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:01.995294 IP (tos 0x0, ttl 127, id 23017, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1, win 0, length 0
16:14:02.054696 IP (tos 0x0, ttl 48, id 4263, offset 0, flags [none], proto UDP (17), length 48)
    36.37.247.185.37148 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:02.111860 IP (tos 0x0, ttl 117, id 2131, offset 0, flags [none], proto UDP (17), length 131)
    85.184.177.148.41672 > WANIP.49998: [udp sum ok] UDP, length 103
16:14:02.300427 IP (tos 0x0, ttl 111, id 19899, offset 0, flags [DF], proto TCP (6), length 52)
    212.112.155.34.60830 > WANIP.49998: Flags [s], cksum 0xc16b (correct), seq 2505134697, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:02.300997 IP (tos 0x0, ttl 127, id 12541, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 212.112.155.34.60830: Flags [R.], cksum 0xfd1b (correct), seq 0, ack 2505134698, win 0, length 0
16:14:02.379101 IP (tos 0x0, ttl 111, id 20448, offset 0, flags [none], proto UDP (17), length 48)
    178.155.229.89.54102 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:02.597301 IP (tos 0x0, ttl 119, id 699, offset 0, flags [none], proto UDP (17), length 58)
    91.101.37.243.17746 > WANIP.49998: [udp sum ok] UDP, length 30
16:14:02.816210 IP (tos 0x0, ttl 111, id 19900, offset 0, flags [none], proto UDP (17), length 48)
    212.112.155.34.23408 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:03.017121 IP (tos 0x8, ttl 60, id 53631, offset 0, flags [DF], proto TCP (6), length 52)
    185.45.195.194.47820 > WANIP.49998: Flags [s], cksum 0x19fd (correct), seq 1833816119, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
16:14:03.017545 IP (tos 0x0, ttl 127, id 28219, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 185.45.195.194.47820: Flags [R.], cksum 0xccc6 (correct), seq 0, ack 1833816120, win 0, length 0
16:14:03.168710 IP (tos 0x0, ttl 117, id 23805, offset 0, flags [none], proto UDP (17), length 48)
    85.184.191.90.21013 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:03.581009 IP (tos 0x0, ttl 117, id 5778, offset 0, flags [none], proto UDP (17), length 48)
    5.157.7.59.21134 > WANIP.49998: [udp sum ok] UDP, length 20
16:14:03.746862 IP (tos 0x0, ttl 119, id 17516, offset 0, flags [DF], proto TCP (6), length 52)
    90.184.191.103.52140 > WANIP.49998: Flags [s], cksum 0x4e50 (correct), seq 2293694469, win 17520, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:14:03.747345 IP (tos 0x0, ttl 127, id 24127, offset 0, flags [DF], proto TCP (6), length 40)
    WANIP.49998 > 90.184.191.103.52140: Flags [R.], cksum 0xd37f (correct), seq 0, ack 2293694470, win 0, length 0
16:14:03.751470 IP (tos 0x0, ttl 119, id 17517, offset 0, flags [none], proto UDP (17), length 48)
    90.184.191.103.15103 > WANIP.49998: [udp sum ok] UDP, length 20

[code]16:12:13.957509 IP (tos 0x0, ttl 120, id 25709, offset 0, flags [none], proto UDP (17), length 48)
    176.22.161.72.50123 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:14.061821 IP (tos 0x0, ttl 47, id 19910, offset 0, flags [DF], proto TCP (6), length 60)
    212.112.153.224.58011 > 192.168.1.101.49998: Flags [s], cksum 0x574b (correct), seq 2264030189, win 7300, options [mss 1460,sackOK,TS val 82056747 ecr 0,nop,wscale 0], length 0
16:12:14.062054 IP (tos 0x0, ttl 128, id 6374, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.224.58011: Flags [R.], cksum 0xf6a6 (correct), seq 0, ack 2264030190, win 0, length 0
16:12:14.220844 IP (tos 0x0, ttl 116, id 23161, offset 0, flags [none], proto UDP (17), length 48)
    85.184.191.90.21013 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:14.470626 IP (tos 0x0, ttl 116, id 21857, offset 0, flags [none], proto UDP (17), length 48)
    46.32.147.117.55036 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:14.527348 IP (tos 0x0, ttl 110, id 13332, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:14.615988 IP (tos 0x0, ttl 48, id 6209, offset 0, flags [DF], proto TCP (6), length 60)
    62.107.178.33.59663 > 192.168.1.101.49998: Flags [s], cksum 0x2560 (correct), seq 515353938, win 8960, options [mss 8960,sackOK,TS val 37795091 ecr 0,nop,wscale 5], length 0
16:12:14.616404 IP (tos 0x0, ttl 128, id 4899, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 62.107.178.33.59663: Flags [R.], cksum 0x84cd (correct), seq 0, ack 515353939, win 0, length 0
16:12:14.680419 IP (tos 0x0, ttl 48, id 50427, offset 0, flags [DF], proto TCP (6), length 60)
    62.107.178.33.60131 > 192.168.1.101.49998: Flags [s], cksum 0x5f4a (correct), seq 509833698, win 8960, options [mss 8960,sackOK,TS val 37795097 ecr 0,nop,wscale 5], length 0
16:12:14.680630 IP (tos 0x0, ttl 128, id 4900, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 62.107.178.33.60131: Flags [R.], cksum 0xbebd (correct), seq 0, ack 509833699, win 0, length 0
16:12:14.892028 IP (tos 0x0, ttl 112, id 15150, offset 0, flags [none], proto UDP (17), length 48)
    86.52.28.93.16331 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:14.934336 IP (tos 0x0, ttl 53, id 32713, offset 0, flags [DF], proto TCP (6), length 52)
    196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
16:12:14.934667 IP (tos 0x0, ttl 128, id 31851, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1433857550, win 0, length 0
16:12:14.935316 IP (tos 0x0, ttl 53, id 32712, offset 0, flags [none], proto UDP (17), length 48)
    196.196.241.69.23984 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.203470 IP (tos 0x0, ttl 119, id 24538, offset 0, flags [DF], proto TCP (6), length 52)
    193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.203699 IP (tos 0x0, ttl 128, id 7391, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 3166283982, win 0, length 0
16:12:15.464576 IP (tos 0x0, ttl 53, id 32714, offset 0, flags [DF], proto TCP (6), length 52)
    196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.464804 IP (tos 0x0, ttl 128, id 31852, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1, win 0, length 0
16:12:15.531983 IP (tos 0x0, ttl 117, id 7206, offset 0, flags [DF], proto TCP (6), length 52)
    185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0x8c12 (correct), seq 1111119922, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:15.532399 IP (tos 0x0, ttl 128, id 22192, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1111119923, win 0, length 0
16:12:15.532773 IP (tos 0x0, ttl 117, id 7205, offset 0, flags [none], proto UDP (17), length 48)
    185.56.101.173.52759 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.544615 IP (tos 0x0, ttl 110, id 13333, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.634713 IP (tos 0x0, ttl 119, id 29786, offset 0, flags [DF], proto TCP (6), length 52)
    93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x4044 (correct), seq 4225259473, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:15.635009 IP (tos 0x0, ttl 128, id 12425, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 4225259474, win 0, length 0
16:12:15.639525 IP (tos 0x0, ttl 119, id 29785, offset 0, flags [none], proto UDP (17), length 48)
    93.160.23.44.45852 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.647653 IP (tos 0x0, ttl 54, id 2624, offset 0, flags [DF], proto TCP (6), length 52)
    51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.647894 IP (tos 0x0, ttl 128, id 12426, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 3007167327, win 0, length 0
16:12:15.688145 IP (tos 0x0, ttl 111, id 5533, offset 0, flags [none], proto UDP (17), length 48)
    85.218.165.196.12617 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.783347 IP (tos 0x0, ttl 119, id 24539, offset 0, flags [DF], proto TCP (6), length 52)
    193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.783526 IP (tos 0x0, ttl 128, id 7392, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 1, win 0, length 0
16:12:15.907463 IP (tos 0x0, ttl 119, id 3646, offset 0, flags [none], proto UDP (17), length 58)
    82.103.134.122.14787 > 192.168.1.101.49998: [udp sum ok] UDP, length 30
16:12:15.911922 IP (tos 0x0, ttl 55, id 5438, offset 0, flags [DF], proto TCP (6), length 52)
    80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.912022 IP (tos 0x0, ttl 55, id 5437, offset 0, flags [none], proto UDP (17), length 48)
    80.167.114.174.36035 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:15.912206 IP (tos 0x0, ttl 128, id 7096, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1329582037, win 0, length 0
16:12:15.995847 IP (tos 0x0, ttl 53, id 32715, offset 0, flags [DF], proto TCP (6), length 52)
    196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
16:12:15.996081 IP (tos 0x0, ttl 128, id 31853, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1, win 0, length 0
16:12:16.010255 IP (tos 0x0, ttl 107, id 30460, offset 0, flags [none], proto UDP (17), length 48)
    120.153.12.217.32697 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.023894 IP (tos 0x0, ttl 119, id 372, offset 0, flags [none], proto UDP (17), length 48)
    87.52.42.144.46183 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.043912 IP (tos 0x0, ttl 117, id 7233, offset 0, flags [DF], proto TCP (6), length 52)
    185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0x8c12 (correct), seq 1111119922, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:16.044201 IP (tos 0x0, ttl 128, id 22193, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1, win 0, length 0
16:12:16.097163 IP (tos 0x0, ttl 45, id 4849, offset 0, flags [DF], proto TCP (6), length 60)
    52.202.215.126.37331 > 192.168.1.101.49998: Flags [s], cksum 0x9e6b (correct), seq 2749409192, win 26883, options [mss 1460,sackOK,TS val 473347417 ecr 0,nop,wscale 7], length 0
16:12:16.097473 IP (tos 0x0, ttl 128, id 13449, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 52.202.215.126.37331: Flags [R.], cksum 0x40ce (correct), seq 0, ack 2749409193, win 0, length 0
16:12:16.097966 IP (tos 0x0, ttl 119, id 4458, offset 0, flags [none], proto UDP (17), length 48)
    83.89.52.195.45743 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.168931 IP (tos 0x0, ttl 54, id 2625, offset 0, flags [DF], proto TCP (6), length 52)
    51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.169262 IP (tos 0x0, ttl 128, id 12427, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 1, win 0, length 0
16:12:16.170652 IP (tos 0x0, ttl 119, id 29839, offset 0, flags [DF], proto TCP (6), length 52)
    93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x4044 (correct), seq 4225259473, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:16.171061 IP (tos 0x0, ttl 128, id 12428, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 1, win 0, length 0
16:12:16.345350 IP (tos 0x0, ttl 120, id 20830, offset 0, flags [none], proto UDP (17), length 48)
    2.111.246.156.26146 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.354861 IP (tos 0x0, ttl 119, id 24540, offset 0, flags [DF], proto TCP (6), length 52)
    193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.355149 IP (tos 0x0, ttl 128, id 7393, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 1, win 0, length 0
16:12:16.363138 IP (tos 0x0, ttl 53, id 35344, offset 0, flags [DF], proto TCP (6), length 60)
    213.32.242.233.25866 > 192.168.1.101.49998: Flags [s], cksum 0xcce1 (correct), seq 4144960395, win 7300, options [mss 1460,sackOK,TS val 133863835 ecr 0,nop,wscale 0], length 0
16:12:16.363493 IP (tos 0x0, ttl 128, id 27828, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 213.32.242.233.25866: Flags [R.], cksum 0xf2c3 (correct), seq 0, ack 4144960396, win 0, length 0
16:12:16.456495 IP (tos 0x0, ttl 55, id 5439, offset 0, flags [DF], proto TCP (6), length 52)
    80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.456708 IP (tos 0x0, ttl 128, id 7097, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1, win 0, length 0
16:12:16.549043 IP (tos 0x0, ttl 110, id 13335, offset 0, flags [DF], proto TCP (6), length 52)
    212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.549373 IP (tos 0x0, ttl 128, id 29523, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1496138827, win 0, length 0
16:12:16.550039 IP (tos 0x0, ttl 110, id 13334, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.550047 IP (tos 0x0, ttl 110, id 13336, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.553862 IP (tos 0x0, ttl 117, id 7252, offset 0, flags [DF], proto TCP (6), length 48)
    185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0xa01b (correct), seq 1111119922, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:12:16.554173 IP (tos 0x0, ttl 128, id 22194, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1, win 0, length 0
16:12:16.654879 IP (tos 0x0, ttl 59, id 10313, offset 0, flags [DF], proto TCP (6), length 60)
    109.201.152.23.57328 > 192.168.1.101.49998: Flags [s], cksum 0x2917 (correct), seq 773611922, win 42340, options [mss 1460,sackOK,TS val 885606875 ecr 0,nop,wscale 11], length 0
16:12:16.655100 IP (tos 0x0, ttl 128, id 22125, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 109.201.152.23.57328: Flags [R.], cksum 0xb4f3 (correct), seq 0, ack 773611923, win 0, length 0
16:12:16.687307 IP (tos 0x0, ttl 54, id 2626, offset 0, flags [DF], proto TCP (6), length 52)
    51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.687581 IP (tos 0x0, ttl 128, id 12429, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 1, win 0, length 0
16:12:16.688419 IP (tos 0x0, ttl 119, id 29893, offset 0, flags [DF], proto TCP (6), length 48)
    93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x544d (correct), seq 4225259473, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:12:16.688753 IP (tos 0x0, ttl 128, id 12430, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 1, win 0, length 0
16:12:16.820516 IP (tos 0x0, ttl 48, id 57233, offset 0, flags [none], proto UDP (17), length 95)
    77.68.153.7.62348 > 192.168.1.101.49998: [udp sum ok] UDP, length 67
16:12:16.897710 IP (tos 0x0, ttl 116, id 23166, offset 0, flags [DF], proto TCP (6), length 52)
    85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.898027 IP (tos 0x0, ttl 128, id 17966, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1037803759, win 0, length 0
16:12:16.898839 IP (tos 0x0, ttl 116, id 23165, offset 0, flags [none], proto UDP (17), length 48)
    85.184.191.90.21013 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:16.983922 IP (tos 0x0, ttl 55, id 5440, offset 0, flags [DF], proto TCP (6), length 52)
    80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:16.984285 IP (tos 0x0, ttl 128, id 7098, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1, win 0, length 0
16:12:17.044730 IP (tos 0x0, ttl 110, id 13337, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:17.073172 IP (tos 0x8, ttl 59, id 435, offset 0, flags [DF], proto TCP (6), length 52)
    185.45.195.194.48706 > 192.168.1.101.49998: Flags [s], cksum 0xd763 (correct), seq 38625990, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
16:12:17.073384 IP (tos 0x0, ttl 128, id 28109, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 185.45.195.194.48706: Flags [R.], cksum 0x8a2d (correct), seq 0, ack 38625991, win 0, length 0
16:12:17.080351 IP (tos 0x0, ttl 110, id 13338, offset 0, flags [DF], proto TCP (6), length 52)
    212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:17.080544 IP (tos 0x0, ttl 128, id 29524, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1, win 0, length 0
16:12:17.155120 IP (tos 0x0, ttl 120, id 25710, offset 0, flags [none], proto UDP (17), length 48)
    176.22.161.72.50123 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:17.166558 IP (tos 0x0, ttl 114, id 30078, offset 0, flags [DF], proto TCP (6), length 52)
    109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x7d7f (correct), seq 3325711003, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:17.166894 IP (tos 0x0, ttl 128, id 22650, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 3325711004, win 0, length 0
16:12:17.409831 IP (tos 0x0, ttl 116, id 23167, offset 0, flags [DF], proto TCP (6), length 52)
    85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:17.410180 IP (tos 0x0, ttl 128, id 17967, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1, win 0, length 0
16:12:17.607172 IP (tos 0x0, ttl 110, id 13339, offset 0, flags [DF], proto TCP (6), length 52)
    212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:17.607336 IP (tos 0x0, ttl 128, id 29525, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1, win 0, length 0
16:12:17.845427 IP (tos 0x0, ttl 114, id 31285, offset 0, flags [DF], proto TCP (6), length 52)
    109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x7d7f (correct), seq 3325711003, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
16:12:17.845768 IP (tos 0x0, ttl 128, id 22651, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 1, win 0, length 0
16:12:17.919710 IP (tos 0x0, ttl 116, id 23168, offset 0, flags [DF], proto TCP (6), length 52)
    85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:17.920054 IP (tos 0x0, ttl 128, id 17968, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1, win 0, length 0
16:12:17.972196 IP (tos 0x0, ttl 53, id 32716, offset 0, flags [none], proto UDP (17), length 48)
    196.196.241.69.23984 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:18.538622 IP (tos 0x0, ttl 110, id 13341, offset 0, flags [DF], proto TCP (6), length 52)
    212.112.153.136.54885 > 192.168.1.101.49998: Flags [s], cksum 0xd96c (correct), seq 799514960, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:12:18.538633 IP (tos 0x0, ttl 110, id 13340, offset 0, flags [none], proto UDP (17), length 48)
    212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:18.538855 IP (tos 0x0, ttl 128, id 29526, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.136.54885: Flags [R.], cksum 0x151d (correct), seq 0, ack 799514961, win 0, length 0
16:12:18.600225 IP (tos 0x0, ttl 114, id 32636, offset 0, flags [DF], proto TCP (6), length 48)
    109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x9188 (correct), seq 3325711003, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:12:18.600628 IP (tos 0x0, ttl 128, id 22652, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 1, win 0, length 0
16:12:18.795096 IP (tos 0x0, ttl 118, id 7340, offset 0, flags [none], proto UDP (17), length 48)
    185.56.101.173.52759 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
16:12:18.884217 IP (tos 0x0, ttl 56, id 3475, offset 0, flags [none], proto UDP (17), length 58)
    62.198.180.153.36061 > 192.168.1.101.49998: [udp sum ok] UDP, length 30
16:12:18.929269 IP (tos 0x0, ttl 55, id 5441, offset 0, flags [none], proto UDP (17), length 48)
    80.167.114.174.36035 > 192.168.1.101.49998: [udp sum ok] UDP, length 20

And just for shits and giggles i thought "let me just try and change the port" and so i changed it to 49997 and now i'm getting a success message from canyouseeme, but only for a few min.

Edit: I think i've found the problem. It might be related to this https://stackoverflow.com/questions/1339142/wcf-system-net-socketexception-only-one-usage-of-each-socket-address-protoco[/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/code][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s]
                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by 

                                        
16:12:14.061821 IP (tos 0x0, ttl 47, id 19910, offset 0, flags [DF], proto TCP (6), length 60)
    212.112.153.224.58011 > 192.168.1.101.49998: Flags [s], cksum 0x574b (correct), seq 2264030189, win 7300, options [mss 1460,sackOK,TS val 82056747 ecr 0,nop,wscale 0], length 0
16:12:14.062054 IP (tos 0x0, ttl 128, id 6374, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.101.49998 > 212.112.153.224.58011: Flags [R.], cksum 0xf6a6 (correct), seq 0, ack 2264030190, win 0, length 0

For that you should be seeing connection refused. See the [R.] being returned? That is RST,ACK that will be interpreted as the server saying "I received your connection but I am not listening on that port (or a firewall is rejecting the connection or some other reason for it).

There is also UDP traffic there. Is that a UDP port or a TCP port on the target system? You cannot test UDP connections with tools like CanYouSeeMe. Only TCP.[/s]

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          nicolaj
                                          last edited by

                                          It's both TCP and UDP.
                                          After reading that link, i restarted the server which fixed the problem, it's now responsive on port 49998. And i changed the TIME_WAIT delay in regedit to 100 secs over the default 240 secs. Hopefully that will permanently fix it. But at least i've found out that this is probably a 2012 server problem, so i got that going for me.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.