Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    802.1q issue on LAN - certain traffic arrives untagged on FW interface

    Scheduled Pinned Locked Moved
    General pfSense Questions
    5
    27
    2.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Where is the tcpdump showing that traffic was correctly tagged?

      I do not see that in you dumps… So your sniffs prove nothing...  I searched for those ports and the service names stun, hart-it and do not see any traffic in that dump showing its tagged.

      Again please show the traffic hitting pfsense interface tagged but showing up in the firewall hitting the wrong interface.. Ie your native untagged..

      Think about it for 2 seconds... What makes more sense the traffic is getting to pfsense untagged you believe it should be tagged, or that pfsense ignores the tagged on traffic on specific ports?  Come on... Isn't it just more likely that say your AP is not tagging this traffic correctly..  Since you mention whatsapp call I would guess this is coming from a wireless device..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • E
        elias28
        last edited by

        I did so far nothing else, than showing that traffic in general is tagged (as you did)
        I did not show here, that traffic for UDP Ports 3478 and TCP 5094 are hitting the interface.

        @johnpoz:

        Come on… Isn't it just more likely that say your AP is not tagging this traffic correctly..  Since you mention whatsapp call I would guess this is coming from a wireless device..

        Yes, was also thinking about this possibility. But I do not believe that the AP is tagging 99% of the traffic correctly, whereas 1% is not tagged. Either it is tagged or it isn't. Period.
        This is what I simply do not comprehend.
        Further please note, that the captured traffic includes Wireless Traffic…

        So my initial thought was, that this must be some sort of a bug. Now that I have tested it with a SG-8860, I can say, that pfSense is very likely not the
        root cause here.

        I will try to find some time to nail this down, but as I already indicated - I do not have the passion anymore, as I can work with my temporary workaround and will very likely switch to a physical solution in the near future.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Yes, was also thinking about this possibility. But I do not believe that the AP is tagging 99% of the traffic correct, whereas 1% is not tagged. Either it is tagged or it isn't. Period.

          Exactly the same thing could be said for the pfSense interface. It is either received tagged or it isn't. Period.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Here you go… I just fired up my phone..  You can see both tagged and untagged traffic for stun.. Unifi uses stun which would be untagged on the 192.168.2 network and my phone on tagged wifi vlan 200 that is tagged.

            So when you show us it as tagged but pfsense process it on the wrong interface - then we can talk..  Until then its pfsense doing what it is suppose to be doing.. It saw untagged traffic and processed it as untagged.  Why it got to pfsense as untagged when you feel it should be tagged would be on your network and not pfsense.

            What makes more sense the traffic is there untagged, or pfsense says oh screw this its port 3478 and tagged - let me process that port as untagged ;)

            stun.png
            stun.png_thumb

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • E
              elias28
              last edited by

              @Derelict:

              Exactly the same thing could be said for the pfSense interface. It is either received tagged or it isn't. Period.

              Absolutely agree on that! You can also put it this way!

              @johnpoz:

              Here you go… I just fired up my phone..  You can see both tagged and untagged traffic for stun.. Unifi uses stun which would be untagged on the 192.168.2 network and my phone on tagged wifi vlan 200 that is tagged.

              So when you show us it as tagged but pfsense process it on the wrong interface - then we can talk..  Until then its pfsense doing what it is suppose to be doing.. It saw untagged traffic and processed it as untagged.  Why it got to pfsense as untagged when you feel it should be tagged would be on your network and not pfsense.

              Ok thanks for this confirmation. So this proves (once again), that it is not pfsense and something in my infrastructure, causing this behaviour….

              1 Reply Last reply Reply Quote 0
              • E
                elias28
                last edited by

                Ok, here it is:

                This is a phone, connected to an AP, trying to establish WA call. Traffic for UDP Port3478 arrives indeed untagged on the pfsense interface.

                [2.4.1-RELEASE][root@pfSense.xxx-yyy.local]/root: tcpdump -e -i em1 | grep 172.20.15.213    
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 262144 bytes
08:35:53.122768 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 64: vlan 261, p 0, ethertype IPv4, 172.20.15.213.51217 > 72.3a.559e.ip4.static.sl-reverse.com.https: Flags [.], ack 1416400460, win 2048, length 0
08:35:53.310425 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 82: vlan 261, p 0, ethertype IPv4, 172.20.15.213.51218 > 10.8.15.254.8080: Flags [s], seq 1005764424, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 738923910 ecr 0,sackOK,eol], length 0
08:35:53.367252 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 70: vlan 261, p 0, ethertype IPv4, 72.3a.559e.ip4.static.sl-reverse.com.https > 172.20.15.213.51217: Flags [.], ack 1, win 514, options [nop,nop,TS val 4097996799 ecr 738898319], length 0
08:35:55.228579 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-cdt1.facebook.com.3478: UDP, length 94
08:35:55.228584 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-cdt1.facebook.com.3478: UDP, length 94
08:35:55.228588 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > 185.60.216.51.3478: UDP, length 94
08:35:55.228591 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > 185.60.216.51.3478: UDP, length 94
08:35:55.228595 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-mxp1.facebook.com.3478: UDP, length 94
08:35:55.228599 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-mxp1.facebook.com.3478: UDP, length 94
08:35:55.228603 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-amt2.facebook.com.3478: UDP, length 94
08:35:55.228621 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-amt2.facebook.com.3478: UDP, length 94
08:35:55.228632 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-cdg2.facebook.com.3478: UDP, length 94
08:35:55.228644 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype IPv4 (0x0800), length 136: 172.20.15.213.52462 > edgeray-shv-01-cdg2.facebook.com.3478: UDP, length 94
08:36:03.380521 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 64: vlan 261, p 0, ethertype IPv4, 172.20.15.213.51217 > 72.3a.559e.ip4.static.sl-reverse.com.https: Flags [.], ack 1, win 2048, length 0
511654 packets captured
836545 packets received by filter
324245 packets dropped by kernel

Now did the following: 
Same phone, same IP, same AP, same route.
Making connection via UDP to Youtube:

[code][2.4.1-RELEASE][root@pfSense.xxx-yyy.local]/root: tcpdump -e -i em1 | grep 172.20.15.213
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 262144 bytes
08:49:23.246411 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.61.28.https > 172.20.15.213.53061: UDP, length 1350
08:49:23.246892 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 77: vlan 261, p 0, ethertype IPv4, 173.194.61.28.https > 172.20.15.213.53061: UDP, length 31
08:49:23.246997 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 76: vlan 261, p 0, ethertype IPv4, 173.194.61.28.https > 172.20.15.213.53061: UDP, length 30
08:49:23.247067 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 255: vlan 261, p 0, ethertype IPv4, 173.194.61.28.https > 172.20.15.213.53061: UDP, length 209
08:49:23.252796 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 87: vlan 261, p 0, ethertype IPv4, 172.20.15.213.53061 > 173.194.61.28.https: UDP, length 41
08:49:23.256809 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.53061 > 173.194.61.28.https: UDP, length 38
08:49:23.283324 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.53061 > 173.194.61.28.https: UDP, length 38
08:49:25.214040 e4:e4:ab:01:fa:26 (oui Unknown) > 01:00:5e:00:00:fb (oui Unknown), ethertype 802.1Q (0x8100), length 107: vlan 261, p 0, ethertype IPv4, 172.20.15.213.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _googlecast._tcp.local. PTR (QM)? _233637DE._sub._googlecast._tcp.local. (61)
08:49:25.394036 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.394583 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 77: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 31
08:49:25.394666 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 76: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 30
08:49:25.395023 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.395877 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.395914 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.397159 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.397189 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.398564 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.399290 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.400085 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.400109 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.672459 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.676935 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.679548 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.683358 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 97: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 51
08:49:25.684370 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.686135 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.690269 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.690670 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.692746 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.857275 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.862425 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.862587 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.865429 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.869700 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.872303 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.875216 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.878231 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.880478 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.882186 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.883640 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.884316 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.884358 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.885795 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.889048 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 84: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 38
08:49:25.889636 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.890360 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.892587 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.900684 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.905954 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.909782 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.913556 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.915390 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 99: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 53
08:49:25.920547 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.924351 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.925116 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.925864 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.927314 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.929930 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.931316 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.932831 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.934302 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.938913 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.942802 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 56
08:49:25.946301 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.949779 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.952681 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.956279 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.959995 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.961438 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:25.961450 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 775: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 729
08:49:25.965398 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.066932 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 123: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 77
08:49:26.827234 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.827968 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.829356 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.831506 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.832271 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.833115 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.834119 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.836238 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.836907 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.837708 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.839981 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.840681 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.842119 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.842807 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.844243 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.844921 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.846504 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.847288 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.848500 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.850545 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.851327 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.852682 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.853310 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.854451 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.856547 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.857273 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.858073 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.860232 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.860890 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.862551 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.863074 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.866305 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.866987 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.866995 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.867751 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 111: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 65
08:49:26.868356 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.869119 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.870877 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.871607 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.872494 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.874663 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.875300 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.876560 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.877261 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.878638 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.878655 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.878662 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.878963 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.879133 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.879143 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.879647 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.881083 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.881098 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.881750 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.881773 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.882338 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.883193 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.885301 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.885843 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.886024 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.887505 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.888152 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.890066 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.890749 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.892293 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.892998 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.894635 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.895386 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.896747 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.897024 e4:e4:ab:01:fa:26 (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 108: vlan 261, p 0, ethertype IPv4, 172.20.15.213.61130 > 173.194.31.91.https: UDP, length 62
08:49:26.897478 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.899299 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.900020 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.901463 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.902234 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.903589 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 1396: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 1350
08:49:26.905653 00:50:56:9f:49:4f (oui Unknown) > e4:e4:ab:01:fa:26 (oui Unknown), ethertype 802.1Q (0x8100), length 828: vlan 261, p 0, ethertype IPv4, 173.194.31.91.https > 172.20.15.213.61130: UDP, length 782
104930 packets captured
287971 packets received by filter
181143 packets dropped by kernel[/code]

This time the traffic is tagged!
Anyone, who can explain this to me, or has an idea wins the price?
I know that this has very likely nothing to do anymore with pfSense and probably belongs into a different forum, but yeah, here it is now....   :-X

[/s]
                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Well what is the AP?  I would suggest you get on their forums..

                  If its unifi, I use them and not seeing this.. So what AP and firmware?  I am running current beta firmware 3.9.10 on AC Pro, Lite and LR…

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    I would walk the pcap closer to 172.20.15.213 and see where the VLAN tags start doing the wrong thing and talk to those people.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Yup great idea.. Can you sniff right on the AP and validate it good/bad coming off the AP… And then sniff at the switch as it enters your esxi host, etc.

                      What is the full physical path of the traffic before it gets to pfsense interface.. How many devices.  From the AP is wired or wireless uplink, etc.  Go through any funky dumb switches where your hoping for the tags to just pass through (aka the jknott method of networking - [sorry bad joke sure derelict will get from previous threads]).  Or crappy switches like tp-link that don't allow you to remove vlan 1, etc. etc.. ;)

                      Here just did sniff right on the unifi AP, so can see its good there..

                      
BZ.v3.9.10# tcpdump -i eth0 -e -n port 3478
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:19:58.602747 d0:c5:f3:1f:eb:ff > 78:8a:20:43:30:ab, ethertype 802.1Q (0x8100), length 140: vlan 200, p 0, ethertype IPv4, 192.168.4.208.55286 > 157.240.2.51.3478: UDP, length 94
05:19:58.602859 d0:c5:f3:1f:eb:ff > 78:8a:20:43:30:ab, ethertype 802.1Q (0x8100), length 140: vlan 200, p 0, ethertype IPv4, 192.168.4.208.55286 > 157.240.2.51.3478: UDP, length 94
05:19:58.602934 d0:c5:f3:1f:eb:ff > 78:8a:20:43:30:ab, ethertype 802.1Q (0x8100), length 140: vlan 200, p 0, ethertype IPv4, 192.168.4.208.55286 > 157.240.18.51.3478: UDP, length 94
05:19:58.603059 d0:c5:f3:1f:eb:ff > 78:8a:20:43:30:ab, ethertype 802.1Q (0x8100), length 140: vlan 200, p 0, ethertype IPv4, 192.168.4.208.55286 > 157.240.18.51.3478: UDP, length 94
05:19:58.603178 d0:c5:f3:1f:eb:ff > 78:8a:20:43:30:ab, ethertype 802.1Q (0x8100), length 140: vlan 200, p 0, ethertype IPv4, 192.168.4.208.55286 > 31.13.65.48.3478: UDP, length 94

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • E
                        elias28
                        last edited by

                        I am running a Wireless Lancom Systems enviroment. All AP's are managed through a Lancom WLC-4100 controller, running on firmware 10.12.0082

                        The AP the phone was connected to, during the test, is a:
                        Lancom IAP-322 on Firmware 10.12.0084SU1 (latest)

                        In between the AP and the Controller there are two Cisco 650X Core switches, which are connected via a 20GB etherchannel.

                        Will check the AP and it's traffic

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          "Lancom"

                          You in DE?  Only time had to deal with that lancom stuff was in Germany or on projects ran out of DE where they called out the hardware to use…  Not a fan of any of their stuff..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • E
                            elias28
                            last edited by

                            Yes, DE  ;)

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Wish could be more help with that hardware - but only experience with some of their routers - none of the wifi stuff, sorry.. Let us know what you find out though.

                              Clearly an odd issue..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              • E
                                elias28
                                last edited by

                                A new day on troubleshooting.

                                Was thinking once again about all this and wasn't that confident about the AP beeing the suspect, as the SG-8860 connected to dot1q interfaces didn't show this behaviour.
                                So what I did now:

                                I generated some UDP Traffic on 3478, sending it via a Laptop on Wireless Infrastructre (again same AP and same network path as yesterday)
                                to the pfSense LAN interface:

                                [2.4.1-RELEASE][root@pfSense.xxx-yyy.local]/root: tcpdump -e -i em1 | grep 172.20.15.207
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 262144 bytes
05:03:28.563979 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.579501 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.598758 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.611473 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.626427 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.645555 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.657543 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.673992 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.688656 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.704722 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.720499 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.751349 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.751357 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.768746 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.782968 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.798949 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.814007 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.829939 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.845044 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:28.953940 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.251603 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.265871 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.281893 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.297066 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.564097 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.577450 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.593537 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.609229 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.624664 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.640942 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.677893 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.677898 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.687207 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.702818 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.720670 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.733877 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.749569 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.772567 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.780762 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.796422 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.811951 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.827891 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.843462 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.859179 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.874823 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.889879 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.905867 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.921108 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.937077 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.952324 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.975798 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.983823 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.51798 > pfSense.xxx-yyy.local.3478: UDP, length 1250
05:03:29.998690 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, 172.20.15.207 > google-public-dns-a.google.com: ICMP echo request, id 2, seq 6197,

                                Et voilà !
                                The traffic arrives tagged on the interface.

                                Now the same, sending the traffic through the firewall to a WA Server on 185.60.216.51:

                                [2.4.1-RELEASE][root@pfSense.xxx-yyy.local]/root: tcpdump -e -i em1 | grep 172.20.15.207
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 262144 bytes
04:49:09.713814 00:50:56:9f:49:4f (oui Unknown) > e4:a7:a0:fc:90:ef (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, google-public-dns-a.google.com > 172.20.15.207: ICMP echo reply, id 2, seq 5338, length 40
04:49:10.710749 00:50:56:9f:49:4f (oui Unknown) > e4:a7:a0:fc:90:ef (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, google-public-dns-a.google.com > 172.20.15.207: ICMP echo reply, id 2, seq 5339, length 40
04:49:11.592546 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, 172.20.15.207 > google-public-dns-a.google.com: ICMP echo request, id 2, seq 5340, length 40
04:49:11.726086 00:50:56:9f:49:4f (oui Unknown) > e4:a7:a0:fc:90:ef (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, google-public-dns-a.google.com > 172.20.15.207: ICMP echo reply, id 2, seq 5340, length 40
04:49:12.357421 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.372121 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.386868 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.402545 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.527992 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.555624 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.565226 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.574253 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.589018 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, 172.20.15.207 > google-public-dns-a.google.com: ICMP echo request, id 2, seq 5341, length 40
04:49:12.589039 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.605741 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.620922 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.636303 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.652078 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.679929 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 106: vlan 261, p 0, ethertype IPv4, 172.20.15.207.58556 > 10.0.20.7.snmp:  F=r U="" E= C="" GetRequest(12) 
04:49:12.679947 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.684158 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.698811 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.714603 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.722646 00:50:56:9f:49:4f (oui Unknown) > e4:a7:a0:fc:90:ef (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, google-public-dns-a.google.com > 172.20.15.207: ICMP echo reply, id 2, seq 5341, length 40
04:49:12.730186 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.745501 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.761256 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.780077 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.793362 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.808559 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.823461 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.851176 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.854944 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.887933 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.887946 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.901512 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.917167 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.933304 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.948870 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.963855 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.979498 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:12.997369 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.010872 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.025950 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.167040 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.184090 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.201545 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.213504 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.229342 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.245433 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.260308 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.276461 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.291969 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.312554 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.322345 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.338347 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.354520 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.369740 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.391056 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.400627 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.416524 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.431857 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.447515 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.463088 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.478629 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.500021 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.510613 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.525543 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.547702 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.557105 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.574007 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.587688 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, 172.20.15.207 > google-public-dns-a.google.com: ICMP echo request, id 2, seq 5342, length 40
04:49:13.587710 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.608022 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.619573 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.635375 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.650358 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.665972 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.681502 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.704094 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.712819 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.721255 00:50:56:9f:49:4f (oui Unknown) > e4:a7:a0:fc:90:ef (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, google-public-dns-a.google.com > 172.20.15.207: ICMP echo reply, id 2, seq 5342, length 40
04:49:13.729775 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.743872 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.759499 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.776781 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.978760 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:13.993039 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.010217 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.274250 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.431000 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.446012 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.461851 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.477345 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.495398 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.508265 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.523902 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.540695 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.555594 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.570915 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.585851 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 78: vlan 261, p 0, ethertype IPv4, 172.20.15.207 > google-public-dns-a.google.com: ICMP echo request, id 2, seq 5343, length 40
04:49:14.585894 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.605829 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.620239 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.633080 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.648784 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.664277 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.674502 e4:a7:a0:fc:90:ef (oui Unknown) > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 261, p 0, ethertype IPv4, 172.20.15.207.netbios-ns > 172.20.15.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
04:49:14.679839 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.897778 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.912439 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.931645 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.957916 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.961614 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:14.972495 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:15.010491 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:15.013704 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:15.016831 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:15.127701 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250
04:49:15.164114 e4:a7:a0:fc:90:ef (oui Unknown) > 00:50:56:9f:49:4f (oui Unknown), ethertype 802.1Q (0x8100), length 1296: vlan 261, p 0, ethertype IPv4, 172.20.15.207.49329 > 185.60.216.51.3478: UDP, length 1250

                                So:
                                This is not a tagging issue in the network, neither on the AP.
                                Nobody can tell me, that there is an instance inside the network, which destinguishes between applications and their ports and then chooses to untagg a certain packet, like UDP 3478??!!

                                The only three possbile answers to this:
                                a) ?
                                b) ?
                                c) a smurf

                                I think it's ©  ;D

                                1 Reply Last reply Reply Quote 0
                                • E
                                  elias28
                                  last edited by

                                  Got him!

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    If you feel like kindly doing the needful, please edit the title of the first post to:

                                    "802.1q issue on LAN - NOT a pfSense Bug"

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • JeGrJ
                                      JeGr LAYER 8 Moderator
                                      last edited by

                                      @elias: so with a laptop everything seems fine. The phone instead does strange things when using the WA app. Right?

                                      Have you checked another phone? Android perhaps so it's not an iOS issue? Would be strange indeed but hey… smurfs and stuff...

                                      Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                                      If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post