CanYouSeeMe reports errors for my port forward, can't figure out why.



  • My setup is "isp > pfsense > N56U switch > lan"
    I'm forwarding 2 ports from wan to lan, port 49999 goes to my desktop, 49998 goes to my file server. When i test the ports on CanYouSeeMe they both return "Error: I could not see your service on x.x.x.x on port (49998) Reason: Connection refused"
    Running 2.4.0-RC.

    Any suggestions?






  • LAYER 8 Netgate

    Connection refused means the test server received a RST,ACK instead of a SYN,ACK when it tried to connect.

    This probably means the ports are being forwarded to something that is refusing the connection for some reason. This is often a local firewall on the target device rejecting connections from outside its local subnet. It could also mean the target server is not listening on the port that is forwarded to it.

    You will probably have to post more details about exactly what you have forwarded, on what interface, to where.



  • The entire network map looks like this. ISP > igb0 > pfsense > igb1(192.168.1.1) > n56u switch(192.168.1.2) > 192.168.1.101 win2012 & 192.168.1.100 win8.1.

    49998 is forwarded from 192.168.1.1 to 192.168.1.101
    49999 is forwarded from 192.168.1.1 to 192.168.1.100

    win8 and win2012 both have local firewall on, but no errors on anything refused.


  • LAYER 8 Netgate

    You can't have 192.168.1.0/24 on both sides of the firewall (or any router). You will have to change one of them.



  • What do you mean "both sides" ?


  • LAYER 8 Netgate

    49998 is forwarded from 192.168.1.1 to 192.168.1.101
    49999 is forwarded from 192.168.1.1 to 192.168.1.100

    Sorry. Your diagram is lame.

    That looks to indicate your WAN is also 192.168.1.1.

    How about screen shots instead.



  • ISP is wan. How would you type it? I suppose i could move the ip to igb1.
    Which page you want me to screenshot ?


  • LAYER 8 Netgate

    The port forwards and the corresponding firewall rules.



  • Aren't those the once i attached in the OP ?


  • LAYER 8 Netgate

    Ugh yeah. Sorry.

    What does a packet capture on WAN show filtered on one of those ports when you test to that port?



  • You want me to post the whole thing. Should i blank out ips ?
    I started it entering 49998 in the port and let it run for 5 secs while i used CanYouSeeMe. The majority is tcp, but there's some udp in there as well.

    Edit: So i just did i with 49999 instead as that is used a lot less. I got 4 of these "tcp 0" from the same ip:port to my wan ip:49999 and i used CanYouSeeMe meanwhile testing port 49999.


  • LAYER 8 Netgate

    Capture and post with detail full. Whether or not you edit out your WAN address is up to you. If you don't want to just send a PM. If you do obfuscate please make it clear where the WAN address was. like use WAN_ADDRESS or something.



  • 
    02:56:34.878134 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50153, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2d18 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412048 ecr 0,nop,wscale 7], length 0
    02:56:35.874878 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50154, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2c1e (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412298 ecr 0,nop,wscale 7], length 0
    02:56:37.879009 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50155, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2a29 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461412799 ecr 0,nop,wscale 7], length 0
    02:56:41.882870 08:81:f4:86:b7:98 > 00:0e:c4:d2:7e:3d, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 47, id 50156, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37066 > wanip.49999: Flags [s], cksum 0x2640 (correct), seq 2675922233, win 26883, options [mss 1460,sackOK,TS val 461413800 ecr 0,nop,wscale 7], length 0
    
    [/s][/s][/s][/s]
    

  • LAYER 8 Netgate

    OK do the same thing filtering on the same port but on the inside interface with the target host on it - such as LAN.

    You should see traffic sourced from the same 52.202.215.126 address (or maybe a different one in the canuseeme pool) but the destination will be 192.168.1.100.49999



  • 03:03:16.899181 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24425, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x880c (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461512555 ecr 0,nop,wscale 7], length 0
    03:03:17.898866 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24426, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x8712 (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461512805 ecr 0,nop,wscale 7], length 0
    03:03:19.902765 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24427, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x851d (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461513306 ecr 0,nop,wscale 7], length 0
    03:03:23.910745 00:0e:c4:d2:7e:3e > d8:cb:8a:9f:98:4c, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 45, id 24428, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37581 > 192.168.1.100.49999: Flags [s], cksum 0x8133 (correct), seq 3079553026, win 26883, options [mss 1460,sackOK,TS val 461514308 ecr 0,nop,wscale 7], length 0
    
    Like that?[/s][/s][/s][/s]
    

  • LAYER 8 Netgate

    Yeah. So pfsense is doing everything right. It is translating the destination address and sending out the local interface.

    There is no response from the target host.

    The short list is:

    1. Firewall (think windows firewall) on 192.168.1.100 blocking the connection sourced from the "foreign address"
    2. default gateway on 192.168.1.100 pointing somewhere other than pfSense.

    Long list: https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting



  • These are the network details, which rules out #2. So in theory it's windows firewall or we're certain it's windows firewall?
    But i have 0 errors or anything in windows firewall, would you happen to know how to view denied requests?
    I don't have any network modifying apps installed, and it's just default windows firewall setting. On my desktop i got stuff like steam, dropbox, afterburner etc. installed. Nothing out of the ordinary.



  • LAYER 8 Netgate

    No theory. Look at the PCAPs. They don't lie. SYN, SYN, SYN, SYN (represented there by [ S ]) and no SYN/ACK from the target.

    There is a standard surrounding how TCP connections are established. https://en.wikipedia.org/wiki/Transmission_Control_Protocol

    The next step in the handshake is a SYN,ACK from the server, which will be represented looking something like this there:

    
    192.168.1.100.49999 > 52.202.215.126.37581: Flags [S.]
    
    


  • Allright. You have any idea how to find that in windows firewall, i've looked everywhere in advanced settings and it's just all green. No errors anywhere.
    Oh, and now we're talking windows firewall. Is there actually a point in having it running at the same time as pfsense firewall?
    Sure it's stopping a canyouseeme request, but i was literally punching in the port number on the website, nothing i'd normally be doing.


  • LAYER 8 Netgate

    idk man. that is a call you will have to make.



  • Event viewer shows nothing as well. I have zero idea how those requests are getting rejected.
    Edit: Even tried manually adding the ports to a rule in win firewall, no change.


  • LAYER 8 Netgate

    Disable the firewall and test again. PCAP on the host itself. www.wireshark.org



  • Disabling firewall did nothing, so it must be deeper than that. But thanks for the help.

    Edit: With firewall on i get "Reason: Connection timed out". With firewall off i get "Reason: Connection refused" from canyouseeme.
    Edit2: it's 4.06, i'm tired. Might explain it. But i kinda forgot that you have to have a program running that accepts that connection on that port while doing the canyouseeme test. With firewall off i now have a successful test. Firewall on still fails even tho the firewall has a costume rule for that port.


  • LAYER 8 Netgate

    Then look at the application itself to see why it might be refusing connections from the canyouseeme address.

    But I saw nothing in the pcaps you showed to indicate you would have been receiving connection refused there. It should have been receiving connection timed out with no response going back.



  • And just to verify, it's the same thing with the other machine that is receiving port 49998 ?

    16:13:57.888817 IP (tos 0x0, ttl 116, id 18689, offset 0, flags [DF], proto TCP (6), length 52)
        193.71.160.101.52852 > WANIP.49998: Flags [s], cksum 0xe8b8 (correct), seq 3913277230, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:57.889282 IP (tos 0x0, ttl 127, id 26655, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 193.71.160.101.52852: Flags [R.], cksum 0x4978 (correct), seq 0, ack 3913277231, win 0, length 0
    16:13:57.968713 IP (tos 0x0, ttl 119, id 6600, offset 0, flags [DF], proto TCP (6), length 52)
        91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xaf86 (correct), seq 3232571740, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:57.969367 IP (tos 0x0, ttl 127, id 11143, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 3232571741, win 0, length 0
    16:13:58.046194 IP (tos 0x0, ttl 56, id 42970, offset 0, flags [DF], proto TCP (6), length 60)
        85.204.137.21.52719 > WANIP.49998: Flags [s], cksum 0x4780 (correct), seq 1034805388, win 29200, options [mss 1460,sackOK,TS val 239552342 ecr 0,nop,wscale 7], length 0
    16:13:58.046653 IP (tos 0x0, ttl 127, id 12534, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 85.204.137.21.52719: Flags [R.], cksum 0x76fd (correct), seq 0, ack 1034805389, win 0, length 0
    16:13:58.152066 IP (tos 0x0, ttl 123, id 6235, offset 0, flags [none], proto UDP (17), length 95)
        212.92.116.246.39702 > WANIP.49998: [udp sum ok] UDP, length 67
    16:13:58.413002 IP (tos 0x0, ttl 56, id 5469, offset 0, flags [DF], proto TCP (6), length 60)
        83.90.149.136.36088 > WANIP.49998: Flags [s], cksum 0xe82c (correct), seq 707492687, win 14600, options [mss 1460,sackOK,TS val 798780946 ecr 0,nop,wscale 7], length 0
    16:13:58.413229 IP (tos 0x0, ttl 127, id 12535, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 83.90.149.136.36088: Flags [R.], cksum 0x26b3 (correct), seq 0, ack 707492688, win 0, length 0
    16:13:58.418072 IP (tos 0x0, ttl 116, id 18690, offset 0, flags [DF], proto TCP (6), length 48)
        193.71.160.101.52852 > WANIP.49998: Flags [s], cksum 0xfcc7 (correct), seq 3913277230, win 8192, options [mss 1460,nop,nop,sackOK], length 0
    16:13:58.418640 IP (tos 0x0, ttl 127, id 26656, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 193.71.160.101.52852: Flags [R.], cksum 0x4978 (correct), seq 0, ack 1, win 0, length 0
    16:13:58.499535 IP (tos 0x0, ttl 119, id 6601, offset 0, flags [DF], proto TCP (6), length 52)
        91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xaf86 (correct), seq 3232571740, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:58.499812 IP (tos 0x0, ttl 127, id 11144, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 1, win 0, length 0
    16:13:58.656943 IP (tos 0x0, ttl 120, id 20663, offset 0, flags [none], proto UDP (17), length 48)
        93.164.229.42.27570 > WANIP.49998: [udp sum ok] UDP, length 20
    16:13:58.658106 IP (tos 0x0, ttl 120, id 20664, offset 0, flags [DF], proto TCP (6), length 52)
        93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:58.658331 IP (tos 0x0, ttl 127, id 12536, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 4055112097, win 0, length 0
    16:13:59.030976 IP (tos 0x0, ttl 119, id 6602, offset 0, flags [DF], proto TCP (6), length 48)
        91.100.255.143.62660 > WANIP.49998: Flags [s], cksum 0xc395 (correct), seq 3232571740, win 8192, options [mss 1460,nop,nop,sackOK], length 0
    16:13:59.031372 IP (tos 0x0, ttl 127, id 11145, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 91.100.255.143.62660: Flags [R.], cksum 0x1046 (correct), seq 0, ack 1, win 0, length 0
    16:13:59.180081 IP (tos 0x0, ttl 120, id 20665, offset 0, flags [DF], proto TCP (6), length 52)
        93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:59.180466 IP (tos 0x0, ttl 127, id 12537, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 1, win 0, length 0
    16:13:59.199359 IP (tos 0x0, ttl 120, id 28323, offset 0, flags [none], proto UDP (17), length 48)
        83.89.35.146.19636 > WANIP.49998: [udp sum ok] UDP, length 20
    16:13:59.263849 IP (tos 0x0, ttl 116, id 30157, offset 0, flags [none], proto UDP (17), length 48)
        91.101.202.99.25562 > WANIP.49998: [udp sum ok] UDP, length 20
    16:13:59.358058 IP (tos 0x0, ttl 111, id 20443, offset 0, flags [DF], proto TCP (6), length 52)
        178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:59.358284 IP (tos 0x0, ttl 127, id 22757, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 412370079, win 0, length 0
    16:13:59.360204 IP (tos 0x0, ttl 111, id 20442, offset 0, flags [none], proto UDP (17), length 48)
        178.155.229.89.54102 > WANIP.49998: [udp sum ok] UDP, length 20
    16:13:59.506751 IP (tos 0x8, ttl 119, id 14918, offset 0, flags [none], proto UDP (17), length 48)
        185.107.12.132.26072 > WANIP.49998: [udp sum ok] UDP, length 20
    16:13:59.605451 IP (tos 0x0, ttl 119, id 698, offset 0, flags [none], proto UDP (17), length 58)
        91.101.37.243.17746 > WANIP.49998: [udp sum ok] UDP, length 30
    16:13:59.646463 IP (tos 0x0, ttl 120, id 15158, offset 0, flags [DF], proto TCP (6), length 52)
        87.56.246.137.52590 > WANIP.49998: Flags [s], cksum 0xff61 (correct), seq 847746103, win 8192, options [mss 1460,nop,wscale 0,nop,nop,sackOK], length 0
    16:13:59.646660 IP (tos 0x0, ttl 127, id 12538, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 87.56.246.137.52590: Flags [R.], cksum 0x6019 (correct), seq 0, ack 847746104, win 0, length 0
    16:13:59.754375 IP (tos 0x0, ttl 120, id 20666, offset 0, flags [DF], proto TCP (6), length 52)
        93.164.229.42.53368 > WANIP.49998: Flags [s], cksum 0xe7bb (correct), seq 4055112096, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:59.754590 IP (tos 0x0, ttl 127, id 12539, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 93.164.229.42.53368: Flags [R.], cksum 0x236c (correct), seq 0, ack 1, win 0, length 0
    16:13:59.884185 IP (tos 0x0, ttl 111, id 20445, offset 0, flags [DF], proto TCP (6), length 52)
        178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:13:59.884562 IP (tos 0x0, ttl 127, id 22761, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 1, win 0, length 0
    16:14:00.061335 IP (tos 0x8, ttl 59, id 8067, offset 0, flags [DF], proto TCP (6), length 60)
        81.171.17.59.39167 > WANIP.49998: Flags [s], cksum 0x7c0c (correct), seq 531929245, win 29200, options [mss 1460,sackOK,TS val 2965735198 ecr 0,nop,wscale 8], length 0
    16:14:00.061381 IP (tos 0x0, ttl 112, id 7328, offset 0, flags [DF], proto TCP (6), length 52)
        62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:00.061580 IP (tos 0x0, ttl 127, id 29348, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 81.171.17.59.39167: Flags [R.], cksum 0x8dd1 (correct), seq 0, ack 531929246, win 0, length 0
    16:14:00.061713 IP (tos 0x0, ttl 127, id 28972, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1077860707, win 0, length 0
    16:14:00.089813 IP (tos 0x8, ttl 58, id 43723, offset 0, flags [DF], proto TCP (6), length 60)
        185.149.90.64.24629 > WANIP.49998: Flags [s], cksum 0x6d18 (correct), seq 1256757224, win 29200, options [mss 1460,sackOK,TS val 3510620916 ecr 0,nop,wscale 7], length 0
    16:14:00.090122 IP (tos 0x0, ttl 127, id 13730, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 185.149.90.64.24629: Flags [R.], cksum 0xeb2c (correct), seq 0, ack 1256757225, win 0, length 0
    16:14:00.163629 IP (tos 0x0, ttl 120, id 1914, offset 0, flags [none], proto UDP (17), length 48)
        93.160.23.44.45852 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:00.373971 IP (tos 0x0, ttl 108, id 30473, offset 0, flags [none], proto UDP (17), length 48)
        120.153.12.217.32697 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:00.412860 IP (tos 0x0, ttl 111, id 20446, offset 0, flags [DF], proto TCP (6), length 52)
        178.155.229.89.52041 > WANIP.49998: Flags [s], cksum 0x45e7 (correct), seq 412370078, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:00.413150 IP (tos 0x0, ttl 127, id 22762, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 178.155.229.89.52041: Flags [R.], cksum 0x8197 (correct), seq 0, ack 1, win 0, length 0
    16:14:00.582186 IP (tos 0x0, ttl 112, id 7332, offset 0, flags [DF], proto TCP (6), length 52)
        62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:00.582393 IP (tos 0x0, ttl 127, id 28978, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1, win 0, length 0
    16:14:00.630664 IP (tos 0x0, ttl 116, id 18691, offset 0, flags [none], proto UDP (17), length 48)
        193.71.160.101.3039 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:00.632794 IP (tos 0x0, ttl 119, id 11944, offset 0, flags [none], proto UDP (17), length 48)
        85.202.24.192.55935 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:00.766189 IP (tos 0x0, ttl 47, id 35519, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37521 > WANIP.49998: Flags [s], cksum 0x4059 (correct), seq 3372978479, win 26883, options [mss 1460,sackOK,TS val 473373584 ecr 0,nop,wscale 7], length 0
    16:14:00.766422 IP (tos 0x0, ttl 127, id 13450, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 52.202.215.126.37521: Flags [R.], cksum 0x48f3 (correct), seq 0, ack 3372978480, win 0, length 0
    16:14:00.861979 IP (tos 0x0, ttl 120, id 1112, offset 0, flags [DF], proto TCP (6), length 52)
        87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:00.862212 IP (tos 0x0, ttl 127, id 23015, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1728421197, win 0, length 0
    16:14:00.897877 IP (tos 0x0, ttl 56, id 5471, offset 0, flags [none], proto UDP (17), length 48)
        80.167.114.174.36035 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:01.003320 IP (tos 0x0, ttl 49, id 47131, offset 0, flags [DF], proto TCP (6), length 60)
        5.103.138.235.45392 > WANIP.49998: Flags [s], cksum 0x1d50 (correct), seq 1955707341, win 7300, options [mss 1460,sackOK,TS val 781451734 ecr 0,nop,wscale 0], length 0
    16:14:01.003507 IP (tos 0x0, ttl 127, id 12540, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 5.103.138.235.45392: Flags [R.], cksum 0xd206 (correct), seq 0, ack 1955707342, win 0, length 0
    16:14:01.103543 IP (tos 0x0, ttl 112, id 7333, offset 0, flags [DF], proto TCP (6), length 52)
        62.107.88.231.61276 > WANIP.49998: Flags [s], cksum 0x6608 (correct), seq 1077860706, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:01.103732 IP (tos 0x0, ttl 127, id 28979, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 62.107.88.231.61276: Flags [R.], cksum 0xa1b8 (correct), seq 0, ack 1, win 0, length 0
    16:14:01.394873 IP (tos 0x0, ttl 120, id 1113, offset 0, flags [DF], proto TCP (6), length 52)
        87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:01.395117 IP (tos 0x0, ttl 127, id 23016, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1, win 0, length 0
    16:14:01.859333 IP (tos 0x0, ttl 120, id 20667, offset 0, flags [none], proto UDP (17), length 48)
        93.164.229.42.27570 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:01.952667 IP (tos 0x0, ttl 60, id 38104, offset 0, flags [DF], proto TCP (6), length 60)
        109.201.154.244.61730 > WANIP.49998: Flags [s], cksum 0x8d1a (correct), seq 3528760594, win 42340, options [mss 1460,sackOK,TS val 883165642 ecr 0,nop,wscale 11], length 0
    16:14:01.952932 IP (tos 0x0, ttl 127, id 3269, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 109.201.154.244.61730: Flags [R.], cksum 0xd8c0 (correct), seq 0, ack 3528760595, win 0, length 0
    16:14:01.995160 IP (tos 0x0, ttl 120, id 1114, offset 0, flags [DF], proto TCP (6), length 52)
        87.48.1.106.49423 > WANIP.49998: Flags [s], cksum 0xe85c (correct), seq 1728421196, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:01.995294 IP (tos 0x0, ttl 127, id 23017, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 87.48.1.106.49423: Flags [R.], cksum 0x240d (correct), seq 0, ack 1, win 0, length 0
    16:14:02.054696 IP (tos 0x0, ttl 48, id 4263, offset 0, flags [none], proto UDP (17), length 48)
        36.37.247.185.37148 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:02.111860 IP (tos 0x0, ttl 117, id 2131, offset 0, flags [none], proto UDP (17), length 131)
        85.184.177.148.41672 > WANIP.49998: [udp sum ok] UDP, length 103
    16:14:02.300427 IP (tos 0x0, ttl 111, id 19899, offset 0, flags [DF], proto TCP (6), length 52)
        212.112.155.34.60830 > WANIP.49998: Flags [s], cksum 0xc16b (correct), seq 2505134697, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:02.300997 IP (tos 0x0, ttl 127, id 12541, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 212.112.155.34.60830: Flags [R.], cksum 0xfd1b (correct), seq 0, ack 2505134698, win 0, length 0
    16:14:02.379101 IP (tos 0x0, ttl 111, id 20448, offset 0, flags [none], proto UDP (17), length 48)
        178.155.229.89.54102 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:02.597301 IP (tos 0x0, ttl 119, id 699, offset 0, flags [none], proto UDP (17), length 58)
        91.101.37.243.17746 > WANIP.49998: [udp sum ok] UDP, length 30
    16:14:02.816210 IP (tos 0x0, ttl 111, id 19900, offset 0, flags [none], proto UDP (17), length 48)
        212.112.155.34.23408 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:03.017121 IP (tos 0x8, ttl 60, id 53631, offset 0, flags [DF], proto TCP (6), length 52)
        185.45.195.194.47820 > WANIP.49998: Flags [s], cksum 0x19fd (correct), seq 1833816119, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
    16:14:03.017545 IP (tos 0x0, ttl 127, id 28219, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 185.45.195.194.47820: Flags [R.], cksum 0xccc6 (correct), seq 0, ack 1833816120, win 0, length 0
    16:14:03.168710 IP (tos 0x0, ttl 117, id 23805, offset 0, flags [none], proto UDP (17), length 48)
        85.184.191.90.21013 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:03.581009 IP (tos 0x0, ttl 117, id 5778, offset 0, flags [none], proto UDP (17), length 48)
        5.157.7.59.21134 > WANIP.49998: [udp sum ok] UDP, length 20
    16:14:03.746862 IP (tos 0x0, ttl 119, id 17516, offset 0, flags [DF], proto TCP (6), length 52)
        90.184.191.103.52140 > WANIP.49998: Flags [s], cksum 0x4e50 (correct), seq 2293694469, win 17520, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:14:03.747345 IP (tos 0x0, ttl 127, id 24127, offset 0, flags [DF], proto TCP (6), length 40)
        WANIP.49998 > 90.184.191.103.52140: Flags [R.], cksum 0xd37f (correct), seq 0, ack 2293694470, win 0, length 0
    16:14:03.751470 IP (tos 0x0, ttl 119, id 17517, offset 0, flags [none], proto UDP (17), length 48)
        90.184.191.103.15103 > WANIP.49998: [udp sum ok] UDP, length 20
    
    [code]16:12:13.957509 IP (tos 0x0, ttl 120, id 25709, offset 0, flags [none], proto UDP (17), length 48)
        176.22.161.72.50123 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:14.061821 IP (tos 0x0, ttl 47, id 19910, offset 0, flags [DF], proto TCP (6), length 60)
        212.112.153.224.58011 > 192.168.1.101.49998: Flags [s], cksum 0x574b (correct), seq 2264030189, win 7300, options [mss 1460,sackOK,TS val 82056747 ecr 0,nop,wscale 0], length 0
    16:12:14.062054 IP (tos 0x0, ttl 128, id 6374, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.224.58011: Flags [R.], cksum 0xf6a6 (correct), seq 0, ack 2264030190, win 0, length 0
    16:12:14.220844 IP (tos 0x0, ttl 116, id 23161, offset 0, flags [none], proto UDP (17), length 48)
        85.184.191.90.21013 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:14.470626 IP (tos 0x0, ttl 116, id 21857, offset 0, flags [none], proto UDP (17), length 48)
        46.32.147.117.55036 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:14.527348 IP (tos 0x0, ttl 110, id 13332, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:14.615988 IP (tos 0x0, ttl 48, id 6209, offset 0, flags [DF], proto TCP (6), length 60)
        62.107.178.33.59663 > 192.168.1.101.49998: Flags [s], cksum 0x2560 (correct), seq 515353938, win 8960, options [mss 8960,sackOK,TS val 37795091 ecr 0,nop,wscale 5], length 0
    16:12:14.616404 IP (tos 0x0, ttl 128, id 4899, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 62.107.178.33.59663: Flags [R.], cksum 0x84cd (correct), seq 0, ack 515353939, win 0, length 0
    16:12:14.680419 IP (tos 0x0, ttl 48, id 50427, offset 0, flags [DF], proto TCP (6), length 60)
        62.107.178.33.60131 > 192.168.1.101.49998: Flags [s], cksum 0x5f4a (correct), seq 509833698, win 8960, options [mss 8960,sackOK,TS val 37795097 ecr 0,nop,wscale 5], length 0
    16:12:14.680630 IP (tos 0x0, ttl 128, id 4900, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 62.107.178.33.60131: Flags [R.], cksum 0xbebd (correct), seq 0, ack 509833699, win 0, length 0
    16:12:14.892028 IP (tos 0x0, ttl 112, id 15150, offset 0, flags [none], proto UDP (17), length 48)
        86.52.28.93.16331 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:14.934336 IP (tos 0x0, ttl 53, id 32713, offset 0, flags [DF], proto TCP (6), length 52)
        196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:14.934667 IP (tos 0x0, ttl 128, id 31851, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1433857550, win 0, length 0
    16:12:14.935316 IP (tos 0x0, ttl 53, id 32712, offset 0, flags [none], proto UDP (17), length 48)
        196.196.241.69.23984 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.203470 IP (tos 0x0, ttl 119, id 24538, offset 0, flags [DF], proto TCP (6), length 52)
        193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.203699 IP (tos 0x0, ttl 128, id 7391, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 3166283982, win 0, length 0
    16:12:15.464576 IP (tos 0x0, ttl 53, id 32714, offset 0, flags [DF], proto TCP (6), length 52)
        196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.464804 IP (tos 0x0, ttl 128, id 31852, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1, win 0, length 0
    16:12:15.531983 IP (tos 0x0, ttl 117, id 7206, offset 0, flags [DF], proto TCP (6), length 52)
        185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0x8c12 (correct), seq 1111119922, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:15.532399 IP (tos 0x0, ttl 128, id 22192, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1111119923, win 0, length 0
    16:12:15.532773 IP (tos 0x0, ttl 117, id 7205, offset 0, flags [none], proto UDP (17), length 48)
        185.56.101.173.52759 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.544615 IP (tos 0x0, ttl 110, id 13333, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.634713 IP (tos 0x0, ttl 119, id 29786, offset 0, flags [DF], proto TCP (6), length 52)
        93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x4044 (correct), seq 4225259473, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:15.635009 IP (tos 0x0, ttl 128, id 12425, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 4225259474, win 0, length 0
    16:12:15.639525 IP (tos 0x0, ttl 119, id 29785, offset 0, flags [none], proto UDP (17), length 48)
        93.160.23.44.45852 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.647653 IP (tos 0x0, ttl 54, id 2624, offset 0, flags [DF], proto TCP (6), length 52)
        51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.647894 IP (tos 0x0, ttl 128, id 12426, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 3007167327, win 0, length 0
    16:12:15.688145 IP (tos 0x0, ttl 111, id 5533, offset 0, flags [none], proto UDP (17), length 48)
        85.218.165.196.12617 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.783347 IP (tos 0x0, ttl 119, id 24539, offset 0, flags [DF], proto TCP (6), length 52)
        193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.783526 IP (tos 0x0, ttl 128, id 7392, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 1, win 0, length 0
    16:12:15.907463 IP (tos 0x0, ttl 119, id 3646, offset 0, flags [none], proto UDP (17), length 58)
        82.103.134.122.14787 > 192.168.1.101.49998: [udp sum ok] UDP, length 30
    16:12:15.911922 IP (tos 0x0, ttl 55, id 5438, offset 0, flags [DF], proto TCP (6), length 52)
        80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.912022 IP (tos 0x0, ttl 55, id 5437, offset 0, flags [none], proto UDP (17), length 48)
        80.167.114.174.36035 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:15.912206 IP (tos 0x0, ttl 128, id 7096, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1329582037, win 0, length 0
    16:12:15.995847 IP (tos 0x0, ttl 53, id 32715, offset 0, flags [DF], proto TCP (6), length 52)
        196.196.241.69.58851 > 192.168.1.101.49998: Flags [s], cksum 0x0fd8 (correct), seq 1433857549, win 64240, options [mss 1325,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:15.996081 IP (tos 0x0, ttl 128, id 31853, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 196.196.241.69.58851: Flags [R.], cksum 0x4b01 (correct), seq 0, ack 1, win 0, length 0
    16:12:16.010255 IP (tos 0x0, ttl 107, id 30460, offset 0, flags [none], proto UDP (17), length 48)
        120.153.12.217.32697 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.023894 IP (tos 0x0, ttl 119, id 372, offset 0, flags [none], proto UDP (17), length 48)
        87.52.42.144.46183 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.043912 IP (tos 0x0, ttl 117, id 7233, offset 0, flags [DF], proto TCP (6), length 52)
        185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0x8c12 (correct), seq 1111119922, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:16.044201 IP (tos 0x0, ttl 128, id 22193, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1, win 0, length 0
    16:12:16.097163 IP (tos 0x0, ttl 45, id 4849, offset 0, flags [DF], proto TCP (6), length 60)
        52.202.215.126.37331 > 192.168.1.101.49998: Flags [s], cksum 0x9e6b (correct), seq 2749409192, win 26883, options [mss 1460,sackOK,TS val 473347417 ecr 0,nop,wscale 7], length 0
    16:12:16.097473 IP (tos 0x0, ttl 128, id 13449, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 52.202.215.126.37331: Flags [R.], cksum 0x40ce (correct), seq 0, ack 2749409193, win 0, length 0
    16:12:16.097966 IP (tos 0x0, ttl 119, id 4458, offset 0, flags [none], proto UDP (17), length 48)
        83.89.52.195.45743 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.168931 IP (tos 0x0, ttl 54, id 2625, offset 0, flags [DF], proto TCP (6), length 52)
        51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.169262 IP (tos 0x0, ttl 128, id 12427, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 1, win 0, length 0
    16:12:16.170652 IP (tos 0x0, ttl 119, id 29839, offset 0, flags [DF], proto TCP (6), length 52)
        93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x4044 (correct), seq 4225259473, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:16.171061 IP (tos 0x0, ttl 128, id 12428, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 1, win 0, length 0
    16:12:16.345350 IP (tos 0x0, ttl 120, id 20830, offset 0, flags [none], proto UDP (17), length 48)
        2.111.246.156.26146 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.354861 IP (tos 0x0, ttl 119, id 24540, offset 0, flags [DF], proto TCP (6), length 52)
        193.150.209.17.60077 > 192.168.1.101.49998: Flags [s], cksum 0x0be6 (correct), seq 3166283981, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.355149 IP (tos 0x0, ttl 128, id 7393, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 193.150.209.17.60077: Flags [R.], cksum 0x4796 (correct), seq 0, ack 1, win 0, length 0
    16:12:16.363138 IP (tos 0x0, ttl 53, id 35344, offset 0, flags [DF], proto TCP (6), length 60)
        213.32.242.233.25866 > 192.168.1.101.49998: Flags [s], cksum 0xcce1 (correct), seq 4144960395, win 7300, options [mss 1460,sackOK,TS val 133863835 ecr 0,nop,wscale 0], length 0
    16:12:16.363493 IP (tos 0x0, ttl 128, id 27828, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 213.32.242.233.25866: Flags [R.], cksum 0xf2c3 (correct), seq 0, ack 4144960396, win 0, length 0
    16:12:16.456495 IP (tos 0x0, ttl 55, id 5439, offset 0, flags [DF], proto TCP (6), length 52)
        80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.456708 IP (tos 0x0, ttl 128, id 7097, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1, win 0, length 0
    16:12:16.549043 IP (tos 0x0, ttl 110, id 13335, offset 0, flags [DF], proto TCP (6), length 52)
        212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.549373 IP (tos 0x0, ttl 128, id 29523, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1496138827, win 0, length 0
    16:12:16.550039 IP (tos 0x0, ttl 110, id 13334, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.550047 IP (tos 0x0, ttl 110, id 13336, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.553862 IP (tos 0x0, ttl 117, id 7252, offset 0, flags [DF], proto TCP (6), length 48)
        185.56.101.173.33877 > 192.168.1.101.49998: Flags [s], cksum 0xa01b (correct), seq 1111119922, win 8192, options [mss 1460,nop,nop,sackOK], length 0
    16:12:16.554173 IP (tos 0x0, ttl 128, id 22194, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 185.56.101.173.33877: Flags [R.], cksum 0xeccb (correct), seq 0, ack 1, win 0, length 0
    16:12:16.654879 IP (tos 0x0, ttl 59, id 10313, offset 0, flags [DF], proto TCP (6), length 60)
        109.201.152.23.57328 > 192.168.1.101.49998: Flags [s], cksum 0x2917 (correct), seq 773611922, win 42340, options [mss 1460,sackOK,TS val 885606875 ecr 0,nop,wscale 11], length 0
    16:12:16.655100 IP (tos 0x0, ttl 128, id 22125, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 109.201.152.23.57328: Flags [R.], cksum 0xb4f3 (correct), seq 0, ack 773611923, win 0, length 0
    16:12:16.687307 IP (tos 0x0, ttl 54, id 2626, offset 0, flags [DF], proto TCP (6), length 52)
        51.175.114.67.3340 > 192.168.1.101.49998: Flags [s], cksum 0xcd28 (correct), seq 3007167326, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.687581 IP (tos 0x0, ttl 128, id 12429, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 51.175.114.67.3340: Flags [R.], cksum 0x08d9 (correct), seq 0, ack 1, win 0, length 0
    16:12:16.688419 IP (tos 0x0, ttl 119, id 29893, offset 0, flags [DF], proto TCP (6), length 48)
        93.160.23.44.49407 > 192.168.1.101.49998: Flags [s], cksum 0x544d (correct), seq 4225259473, win 8192, options [mss 1460,nop,nop,sackOK], length 0
    16:12:16.688753 IP (tos 0x0, ttl 128, id 12430, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 93.160.23.44.49407: Flags [R.], cksum 0xa0fd (correct), seq 0, ack 1, win 0, length 0
    16:12:16.820516 IP (tos 0x0, ttl 48, id 57233, offset 0, flags [none], proto UDP (17), length 95)
        77.68.153.7.62348 > 192.168.1.101.49998: [udp sum ok] UDP, length 67
    16:12:16.897710 IP (tos 0x0, ttl 116, id 23166, offset 0, flags [DF], proto TCP (6), length 52)
        85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.898027 IP (tos 0x0, ttl 128, id 17966, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1037803759, win 0, length 0
    16:12:16.898839 IP (tos 0x0, ttl 116, id 23165, offset 0, flags [none], proto UDP (17), length 48)
        85.184.191.90.21013 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:16.983922 IP (tos 0x0, ttl 55, id 5440, offset 0, flags [DF], proto TCP (6), length 52)
        80.167.114.174.60081 > 192.168.1.101.49998: Flags [s], cksum 0x21a8 (correct), seq 1329582036, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:16.984285 IP (tos 0x0, ttl 128, id 7098, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 80.167.114.174.60081: Flags [R.], cksum 0x5d58 (correct), seq 0, ack 1, win 0, length 0
    16:12:17.044730 IP (tos 0x0, ttl 110, id 13337, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:17.073172 IP (tos 0x8, ttl 59, id 435, offset 0, flags [DF], proto TCP (6), length 52)
        185.45.195.194.48706 > 192.168.1.101.49998: Flags [s], cksum 0xd763 (correct), seq 38625990, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
    16:12:17.073384 IP (tos 0x0, ttl 128, id 28109, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 185.45.195.194.48706: Flags [R.], cksum 0x8a2d (correct), seq 0, ack 38625991, win 0, length 0
    16:12:17.080351 IP (tos 0x0, ttl 110, id 13338, offset 0, flags [DF], proto TCP (6), length 52)
        212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:17.080544 IP (tos 0x0, ttl 128, id 29524, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1, win 0, length 0
    16:12:17.155120 IP (tos 0x0, ttl 120, id 25710, offset 0, flags [none], proto UDP (17), length 48)
        176.22.161.72.50123 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:17.166558 IP (tos 0x0, ttl 114, id 30078, offset 0, flags [DF], proto TCP (6), length 52)
        109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x7d7f (correct), seq 3325711003, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:17.166894 IP (tos 0x0, ttl 128, id 22650, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 3325711004, win 0, length 0
    16:12:17.409831 IP (tos 0x0, ttl 116, id 23167, offset 0, flags [DF], proto TCP (6), length 52)
        85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:17.410180 IP (tos 0x0, ttl 128, id 17967, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1, win 0, length 0
    16:12:17.607172 IP (tos 0x0, ttl 110, id 13339, offset 0, flags [DF], proto TCP (6), length 52)
        212.112.153.136.54860 > 192.168.1.101.49998: Flags [s], cksum 0x0d06 (correct), seq 1496138826, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:17.607336 IP (tos 0x0, ttl 128, id 29525, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.136.54860: Flags [R.], cksum 0x48b6 (correct), seq 0, ack 1, win 0, length 0
    16:12:17.845427 IP (tos 0x0, ttl 114, id 31285, offset 0, flags [DF], proto TCP (6), length 52)
        109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x7d7f (correct), seq 3325711003, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
    16:12:17.845768 IP (tos 0x0, ttl 128, id 22651, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 1, win 0, length 0
    16:12:17.919710 IP (tos 0x0, ttl 116, id 23168, offset 0, flags [DF], proto TCP (6), length 52)
        85.184.191.90.54951 > 192.168.1.101.49998: Flags [s], cksum 0x243f (correct), seq 1037803758, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:17.920054 IP (tos 0x0, ttl 128, id 17968, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 85.184.191.90.54951: Flags [R.], cksum 0x5fef (correct), seq 0, ack 1, win 0, length 0
    16:12:17.972196 IP (tos 0x0, ttl 53, id 32716, offset 0, flags [none], proto UDP (17), length 48)
        196.196.241.69.23984 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:18.538622 IP (tos 0x0, ttl 110, id 13341, offset 0, flags [DF], proto TCP (6), length 52)
        212.112.153.136.54885 > 192.168.1.101.49998: Flags [s], cksum 0xd96c (correct), seq 799514960, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    16:12:18.538633 IP (tos 0x0, ttl 110, id 13340, offset 0, flags [none], proto UDP (17), length 48)
        212.112.153.136.13708 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:18.538855 IP (tos 0x0, ttl 128, id 29526, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.136.54885: Flags [R.], cksum 0x151d (correct), seq 0, ack 799514961, win 0, length 0
    16:12:18.600225 IP (tos 0x0, ttl 114, id 32636, offset 0, flags [DF], proto TCP (6), length 48)
        109.108.217.206.60457 > 192.168.1.101.49998: Flags [s], cksum 0x9188 (correct), seq 3325711003, win 8192, options [mss 1460,nop,nop,sackOK], length 0
    16:12:18.600628 IP (tos 0x0, ttl 128, id 22652, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 109.108.217.206.60457: Flags [R.], cksum 0xde38 (correct), seq 0, ack 1, win 0, length 0
    16:12:18.795096 IP (tos 0x0, ttl 118, id 7340, offset 0, flags [none], proto UDP (17), length 48)
        185.56.101.173.52759 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    16:12:18.884217 IP (tos 0x0, ttl 56, id 3475, offset 0, flags [none], proto UDP (17), length 58)
        62.198.180.153.36061 > 192.168.1.101.49998: [udp sum ok] UDP, length 30
    16:12:18.929269 IP (tos 0x0, ttl 55, id 5441, offset 0, flags [none], proto UDP (17), length 48)
        80.167.114.174.36035 > 192.168.1.101.49998: [udp sum ok] UDP, length 20
    
    And just for shits and giggles i thought "let me just try and change the port" and so i changed it to 49997 and now i'm getting a success message from canyouseeme, but only for a few min.
    
    Edit: I think i've found the problem. It might be related to this https://stackoverflow.com/questions/1339142/wcf-system-net-socketexception-only-one-usage-of-each-socket-address-protoco[/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/code][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s][/s]
    

  • LAYER 8 Netgate

    
    16:12:14.061821 IP (tos 0x0, ttl 47, id 19910, offset 0, flags [DF], proto TCP (6), length 60)
        212.112.153.224.58011 > 192.168.1.101.49998: Flags [s], cksum 0x574b (correct), seq 2264030189, win 7300, options [mss 1460,sackOK,TS val 82056747 ecr 0,nop,wscale 0], length 0
    16:12:14.062054 IP (tos 0x0, ttl 128, id 6374, offset 0, flags [DF], proto TCP (6), length 40)
        192.168.1.101.49998 > 212.112.153.224.58011: Flags [R.], cksum 0xf6a6 (correct), seq 0, ack 2264030190, win 0, length 0
    
    For that you should be seeing connection refused. See the [R.] being returned? That is RST,ACK that will be interpreted as the server saying "I received your connection but I am not listening on that port (or a firewall is rejecting the connection or some other reason for it).
    
    There is also UDP traffic there. Is that a UDP port or a TCP port on the target system? You cannot test UDP connections with tools like CanYouSeeMe. Only TCP.[/s]
    


  • It's both TCP and UDP.
    After reading that link, i restarted the server which fixed the problem, it's now responsive on port 49998. And i changed the TIME_WAIT delay in regedit to 100 secs over the default 240 secs. Hopefully that will permanently fix it. But at least i've found out that this is probably a 2012 server problem, so i got that going for me.


Log in to reply