Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NetGear(s) in AP Mode will not communicate on different LANs (Resolved)

    Scheduled Pinned Locked Moved Firewalling
    34 Posts 6 Posters 3.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Then it could be issue with the netgear just not wanting to allow remote access to its gui... Look to see if you can enable remote admin.

      If not since you say it works when you access it from device on that network.. Source nat it so traffic from your remote IP looks like its on that vlan... This is done in the outbound nat tab picking the interface the AP is on, vs the WAN interface.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • Z
        z71prix
        last edited by

        Hello John,

        Remote on the routers are unavailable.
        0_1548526688344_4.JPG

        I went to NAT Outbound and changed below to LAN1 and LAN2 is this what you were referring too? If so still no communication to the router APs?

        0_1548526759057_5.JPG

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          Dude your natting everything your VPN.. That is most likely where your problem is!!

          Why would you not be in hybrid mode if your using a vpn?

          And you would want to setup destination on when to source nat the traffic.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • Z
            z71prix
            last edited by

            John,

            I followed instructions from someone that setup NordVPN, based on that are where these settings came from. LOL

            I want every device on LAN1 to go through VPN. LAN2 I want every device to go though WAN

            Does this look correct now based on what I described above? If so still not working.

            0_1548527746072_6.JPG

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by Derelict

              You would probably want to NAT source any or source from an alias with RFC1918. At a minimum you want to NAT from LAN1 sources outbound on LAN2 and LAN2 sources out of LAN1. You also probably want to limit the NAT to just the destination of the APs.

              And, yes, you probably want to use Hybrid NAT mode and let it do the heavy lifting with you only adding the LAN1 and LAN2 rules. (Yeah, that's better in Hybrid mode.)

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • Z
                z71prix
                last edited by z71prix

                I cleaned up NAT and using Hybrid
                0_1548531473621_13.PNG

                No VPN internet now on LAN1?

                LAN2 internet from WAN is ok.

                LAN1 Rules
                0_1548531228530_12.PNG

                I'm not sure how to setup an alisas for RFC1918, can you provide guidance? I'm so confused now.

                1 Reply Last reply Reply Quote 0
                • RicoR
                  Rico LAYER 8 Rebel Alliance
                  last edited by Rico

                  Navigate to Firewall > Aliases:
                  Create an alias for the RFC1918 network ranges. Call it private_networks and include the following ranges:

                  • 10.0.0.0/8
                  • 172.16.0.0/12
                  • 192.168.0.0/16

                  -Rico

                  1 Reply Last reply Reply Quote 0
                  • Z
                    z71prix
                    last edited by

                    Hello Rico,

                    Thank you for the instructions, I did make a small change due to my LANs IP addresses. correct?

                    Internet works on LAN2 however still not working on LAN1 VPN internet?

                    0_1548532288248_14.PNG

                    0_1548532296483_15.PNG

                    1 Reply Last reply Reply Quote 0
                    • Z
                      z71prix
                      last edited by

                      Got the VPN internet back on LAN1 by adding to NAT? Does this look correct?

                      0_1548533196121_16.PNG

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Why did you check static port on the LAN1 and LAN2 NAT rules. Nobody told you to do that.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • Z
                          z71prix
                          last edited by

                          Hello Derelict,

                          pfsense defaulted to static. LOL now it's corrected.

                          0_1548533881573_17.PNG

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            And does it work? Sniff on lan2 interface when trying to talk to lan2 AP from lan 1... Is the source IP your Lan2 interface IP.. Does the AP answer?

                            If works really no reason to sniff - but if not working they validate that pfsense is sending with source IP changed..

                            And NO pfsense does not default to static
                            0_1548534150058_notdefaultstatic.png

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by Derelict

                              The only way I can see it behaving like you thought static port was the default is if you used the copy icon on one of the existing static port NAT rules for ISAKMP. Which looks to be the case baseed on the rule description. :)

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • Z
                                z71prix
                                last edited by

                                John,

                                Still not working? What do you mean to sniff?

                                Correct, I copied the rule and it was checked. Sorry for the false information, thanks for the correction.

                                0_1548535356296_9.JPG

                                DerelictD 1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate @z71prix
                                  last edited by

                                  @z71prix So you are trying to connect from a host on LAN2 to an AP on LAN1 (10.1.10.104).

                                  What are the firewall rules on the LAN2 interface?

                                  Can you ping the AP instead of trying to connect to it?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • Z
                                    z71prix
                                    last edited by

                                    Derelict,

                                    I'm on LAN1 now and pinged router AP on LAN2 ok, however cannot connect on web interface still.
                                    0_1548535880050_10.JPG

                                    Rules on LAN2
                                    0_1548535897658_11.JPG
                                    Rules on LAN1
                                    0_1548535904209_12.JPG
                                    thank you

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Don't ping from the firewall, ping from the same host you are trying to connect from.

                                      Please stick with ONE and ONLY ONE test scenario. Bouncing between connecting to 10.1.10.104 then 10.1.20.115 only confuses the troubleshooting steps. Fix the first and you'll probably fix both.

                                      Diagnostics > Packet Capture

                                      Interface: LAN2
                                      Host: 10.1.10.104
                                      Packets: 10000
                                      Level of Detail: Full
                                      Start
                                      ping from the host you are trying to connect from. Windows default of a 4 count should be fine.
                                      Try to connect to the web interface. Let if fail.
                                      Stop the Capture
                                      Copy/paste what is there here.

                                      Then:

                                      Diagnostics > Packet Capture

                                      Interface: LAN1
                                      Host: 10.1.10.104
                                      Packets: 10000
                                      Level of Detail: Full
                                      Start
                                      ping from the host you are trying to connect from. Windows default of a 4 count should be fine.
                                      Try to connect to the web interface Let it fail.
                                      Stop the Capture
                                      Copy/paste what is there here.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • Z
                                        z71prix
                                        last edited by

                                        Ok, I'm currently on LAN1 trying to connect to AP on LAN2 IP 10.1.20.115

                                        Here's the results:

                                        0_1548537030232_14.JPG

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          I didn't ask for you to post wireshark screen shots. I asked that you copy paste what is in the packet capture on the Diagnostics > Packet Capture screen.

                                          If you want to upload the pcaps so we can bring them into wireshark, you can do that too. Need BOTH pcaps on BOTH interfaces.

                                          What I see there, however, is the AP rejecting the HTTP/1.1 GET for / - it returns nothing and disconnects the browser session. The FIN is sourced from the AP at 10.1.20.115.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • Z
                                            z71prix
                                            last edited by

                                            Derelict,

                                            Sorry about that I downloaded the file. Here's exactly what you wanted following your instructions. (I'm going to take a break and get dinner) Look forward to troubleshooting further in a couple of hours. Thank you so much for helping.

                                            Diagnostics > Packet Capture Interface: LAN2
                                            Nothing Captured

                                            Diagnostics > Packet Capture Interface: LAN1

                                            16:21:26.109729 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 32744, offset 0, flags [DF], proto UDP (17), length 576)
                                            10.1.10.104.68 > 10.1.10.1.67: [udp sum ok] BOOTP/DHCP, Request from 2c:30:33:51:a0:5e, length 548, xid 0xc2e4a653, Flags [none] (0x0000)
                                            Client-IP 10.1.10.104
                                            Client-Ethernet-Address 2c:30:33:51:a0:5e
                                            Vendor-rfc1048 Extensions
                                            Magic Cookie 0x63825363
                                            DHCP-Message Option 53, length 1: Request
                                            Client-ID Option 61, length 7: ether 2c:30:33:51:a0:5e
                                            Hostname Option 12, length 5: "R8500"
                                            Vendor-Class Option 60, length 11: "udhcp 0.9.8"
                                            Parameter-Request Option 55, length 11:
                                            Subnet-Mask, Default-Gateway, Domain-Name-Server, Hostname
                                            Domain-Name, BR, Static-Route, Netbios-Name-Server
                                            Classless-Static-Route, Classless-Static-Route-Microsoft, Option 212
                                            16:21:26.110790 00:0e:c4:d3:a4:f2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.104 tell 10.1.10.1, length 28
                                            16:21:26.110957 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Reply 10.1.10.104 is-at 2c:30:33:51:a0:5e, length 46
                                            16:21:26.110973 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 18032, offset 0, flags [none], proto UDP (17), length 328)
                                            10.1.10.1.67 > 10.1.10.104.68: [bad udp cksum 0x29b0 -> 0xf76c!] BOOTP/DHCP, Reply, length 300, xid 0xc2e4a653, Flags [none] (0x0000)
                                            Client-IP 10.1.10.104
                                            Your-IP 10.1.10.104
                                            Client-Ethernet-Address 2c:30:33:51:a0:5e
                                            Vendor-rfc1048 Extensions
                                            Magic Cookie 0x63825363
                                            DHCP-Message Option 53, length 1: ACK
                                            Server-ID Option 54, length 4: 10.1.10.1
                                            Lease-Time Option 51, length 4: 7200
                                            Subnet-Mask Option 1, length 4: 255.255.255.0
                                            Default-Gateway Option 3, length 4: 10.1.10.1
                                            Domain-Name-Server Option 6, length 4: 10.1.10.1
                                            Domain-Name Option 15, length 11: "localdomain"
                                            16:21:26.111165 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.104 tell 10.1.10.104, length 46
                                            16:21:28.102311 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 78: (tos 0x0, ttl 64, id 32943, offset 0, flags [DF], proto UDP (17), length 64)
                                            10.1.10.104.35443 > 10.1.10.1.53: [udp sum ok] 2+ A? time-a.netgear.com. (36)
                                            16:21:30.719628 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 94: (tos 0x0, ttl 64, id 50436, offset 0, flags [none], proto UDP (17), length 80)
                                            10.1.10.1.53 > 10.1.10.104.35443: [bad udp cksum 0x28b8 -> 0x5013!] 2 q: A? time-a.netgear.com. 1/0/0 time-a.netgear.com. A 206.16.42.194 (52)
                                            16:21:30.764214 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 78: (tos 0x0, ttl 64, id 33209, offset 0, flags [DF], proto UDP (17), length 64)
                                            10.1.10.104.50204 > 10.1.10.1.53: [udp sum ok] 2+ A? time-a.netgear.com. (36)
                                            16:21:30.764413 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 94: (tos 0x0, ttl 64, id 33976, offset 0, flags [none], proto UDP (17), length 80)
                                            10.1.10.1.53 > 10.1.10.104.50204: [bad udp cksum 0x28b8 -> 0x166a!] 2 q: A? time-a.netgear.com. 1/0/0 time-a.netgear.com. A 206.16.42.194 (52)
                                            16:21:30.764668 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 90: (tos 0x0, ttl 64, id 33209, offset 0, flags [DF], proto UDP (17), length 76)
                                            10.1.10.104.123 > 206.16.42.194.123: [udp sum ok] NTPv3, length 48
                                            Client, Leap indicator: (0), Stratum 0 (unspecified), poll 4 (16s), precision -6
                                            Root Delay: 1.000000, Root dispersion: 1.000000, Reference-ID: (unspec)
                                            Reference Timestamp: 0.000000000
                                            Originator Timestamp: 0.000000000
                                            Receive Timestamp: 0.000000000
                                            Transmit Timestamp: 3757526490.642349998 (2019/01/26 16:21:30)
                                            Originator - Receive Timestamp: 0.000000000
                                            Originator - Transmit Timestamp: 3757526490.642349998 (2019/01/26 16:21:30)
                                            16:21:30.836666 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 90: (tos 0x48, ttl 46, id 0, offset 0, flags [DF], proto UDP (17), length 76)
                                            206.16.42.194.123 > 10.1.10.104.123: [udp sum ok] NTPv3, length 48
                                            Server, Leap indicator: (0), Stratum 1 (primary reference), poll 4 (16s), precision -18
                                            Root Delay: 0.000000, Root dispersion: 0.000991, Reference-ID: GPS^@
                                            Reference Timestamp: 3757526490.402142892 (2019/01/26 16:21:30)
                                            Originator Timestamp: 3757526490.642349998 (2019/01/26 16:21:30)
                                            Receive Timestamp: 3757526490.795658616 (2019/01/26 16:21:30)
                                            Transmit Timestamp: 3757526490.795771112 (2019/01/26 16:21:30)
                                            Originator - Receive Timestamp: +0.153308618
                                            Originator - Transmit Timestamp: +0.153421114
                                            16:21:33.107942 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.1 tell 10.1.10.104, length 46
                                            16:21:33.107974 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.1.10.1 is-at 00:0e:c4:d3:a4:f2, length 28
                                            16:21:47.854289 e4:6f:13:33:ca:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.104 tell 1.1.1.1, length 46
                                            16:21:53.992774 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 208: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 194)
                                            10.1.10.104.2190 > 10.1.10.255.2190: [udp sum ok] UDP, length 166
                                            16:21:59.858631 2c:30:33:51:a0:5e > 01:00:5e:7f:ff:fa, ethertype IPv4 (0x0800), length 60: (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 32, options (RA))
                                            10.1.10.104 > 239.255.255.250: igmp v2 report 239.255.255.250
                                            16:22:03.281186 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 75: (tos 0x0, ttl 64, id 36461, offset 0, flags [DF], proto UDP (17), length 61)
                                            10.1.10.104.58974 > 10.1.10.1.53: [udp sum ok] 2+ A? www.netgear.com. (33)
                                            16:22:03.342427 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 182: (tos 0x0, ttl 64, id 32580, offset 0, flags [none], proto UDP (17), length 168)
                                            10.1.10.1.53 > 10.1.10.104.58974: [bad udp cksum 0x2910 -> 0x674e!] 2 q: A? www.netgear.com. 5/0/0 www.netgear.com. CNAME d3jdtixm7cvu7y.cloudfront.net., d3jdtixm7cvu7y.cloudfront.net. A 13.249.142.61, d3jdtixm7cvu7y.cloudfront.net. A 13.249.142.101, d3jdtixm7cvu7y.cloudfront.net. A 13.249.142.6, d3jdtixm7cvu7y.cloudfront.net. A 13.249.142.27 (140)
                                            16:22:03.342909 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
                                            10.1.10.104 > 13.249.142.61: ICMP echo request, id 5157, seq 0, length 64
                                            16:22:03.360447 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype IPv4 (0x0800), length 98: (tos 0x28, ttl 243, id 12428, offset 0, flags [none], proto ICMP (1), length 84)
                                            13.249.142.61 > 10.1.10.104: ICMP echo reply, id 5157, seq 0, length 64
                                            16:22:03.592472 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.103 tell 10.1.10.104, length 46
                                            16:22:03.592654 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.200 tell 10.1.10.104, length 46
                                            16:22:03.592660 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.1 tell 10.1.10.104, length 46
                                            16:22:03.592667 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.1.10.1 is-at 00:0e:c4:d3:a4:f2, length 28
                                            16:22:03.592670 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.196 tell 10.1.10.104, length 46
                                            16:22:03.592674 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.139 tell 10.1.10.104, length 46
                                            16:22:03.592713 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.109 tell 10.1.10.104, length 46
                                            16:22:03.592734 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.105 tell 10.1.10.104, length 46
                                            16:22:03.592793 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.150 tell 10.1.10.104, length 46
                                            16:22:03.592826 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.106 tell 10.1.10.104, length 46
                                            16:22:03.592856 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.152 tell 10.1.10.104, length 46
                                            16:22:03.592887 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.198 tell 10.1.10.104, length 46
                                            16:22:04.148790 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.103 tell 10.1.10.104, length 46
                                            16:22:04.148818 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.200 tell 10.1.10.104, length 46
                                            16:22:04.148858 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.1 tell 10.1.10.104, length 46
                                            16:22:04.148869 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.1.10.1 is-at 00:0e:c4:d3:a4:f2, length 28
                                            16:22:04.148885 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.196 tell 10.1.10.104, length 46
                                            16:22:04.148915 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.139 tell 10.1.10.104, length 46
                                            16:22:04.149008 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.109 tell 10.1.10.104, length 46
                                            16:22:04.149042 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.105 tell 10.1.10.104, length 46
                                            16:22:04.149083 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.150 tell 10.1.10.104, length 46
                                            16:22:04.149134 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.106 tell 10.1.10.104, length 46
                                            16:22:04.149165 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.152 tell 10.1.10.104, length 46
                                            16:22:04.149196 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.198 tell 10.1.10.104, length 46
                                            16:22:04.678788 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.103 tell 10.1.10.104, length 46
                                            16:22:04.678831 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.200 tell 10.1.10.104, length 46
                                            16:22:04.678854 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.1 tell 10.1.10.104, length 46
                                            16:22:04.678860 00:0e:c4:d3:a4:f2 > 2c:30:33:51:a0:5e, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.1.10.1 is-at 00:0e:c4:d3:a4:f2, length 28
                                            16:22:04.678887 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.196 tell 10.1.10.104, length 46
                                            16:22:04.678941 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.139 tell 10.1.10.104, length 46
                                            16:22:04.679035 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.109 tell 10.1.10.104, length 46
                                            16:22:04.679068 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.105 tell 10.1.10.104, length 46
                                            16:22:04.679098 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.150 tell 10.1.10.104, length 46
                                            16:22:04.679125 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.106 tell 10.1.10.104, length 46
                                            16:22:04.679155 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.152 tell 10.1.10.104, length 46
                                            16:22:04.679186 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.198 tell 10.1.10.104, length 46
                                            16:22:05.236287 2c:30:33:51:a0:5e > 00:0e:c4:d3:a4:f2, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 78)
                                            10.1.10.104.40394 > 10.1.10.1.137: [udp sum ok]

                                            NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
                                            TrnID=0x1
                                            OpCode=0
                                            NmFlags=0x1
                                            Rcode=0
                                            QueryCount=1
                                            AnswerCount=0
                                            AuthorityCount=0
                                            AddressRecCount=0
                                            QuestionRecords:
                                            Name=* NameType=0x00 (Workstation)
                                            QuestionType=0x21
                                            QuestionClass=0x1

                                            16:22:05.238774 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.109 tell 10.1.10.104, length 46
                                            16:22:05.238784 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.105 tell 10.1.10.104, length 46
                                            16:22:05.238789 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.106 tell 10.1.10.104, length 46
                                            16:22:05.238809 2c:30:33:51:a0:5e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.1.10.198 tell 10.1.10.104, length 46

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.