if_pppoe ping works but dns doesn't?
-
@stephenw10 Yes you're correct, I enabled it on sep 5 so the previous logs are using the older module. I'm not sure how to troubleshoot or test. The only thing is when I use if_pppoe the dns resolving stop (even on the host itself).
-
That's using Unbound locally? Testing against something external like?:
[2.8.1-RELEASE][admin@pfsense.fire.box]/root: dig @8.8.8.8 pfsense.org ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48941 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;pfsense.org. IN A ;; ANSWER SECTION: pfsense.org. 300 IN A 208.123.73.78 ;; Query time: 129 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Fri Sep 05 23:18:15 BST 2025 ;; MSG SIZE rcvd: 56It could an MTU issue. Can you send large pings?
[2.8.1-RELEASE][admin@pfsense.fire.box]/root: ping -4 -s 1472 pfsense.org PING pfsense.org (208.123.73.78): 1472 data bytes 1480 bytes from 208.123.73.78: icmp_seq=0 ttl=47 time=115.757 ms 1480 bytes from 208.123.73.78: icmp_seq=1 ttl=47 time=112.487 ms 1480 bytes from 208.123.73.78: icmp_seq=2 ttl=47 time=112.512 ms -
@stephenw10 Yes Unbound locally,
Seems large ping doesn't work:
[2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 pfsense.org ping: cannot resolve pfsense.org: Host name lookup failure [2.8.1-RELEASE][root@gw.*****..com]/root: ping -4 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=120 time=2.013 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=120 time=2.183 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=120 time=2.383 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=120 time=1.835 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=120 time=2.132 ms 64 bytes from 8.8.8.8: icmp_seq=5 ttl=120 time=2.270 ms 64 bytes from 8.8.8.8: icmp_seq=6 ttl=120 time=2.500 ms ^C --- 8.8.8.8 ping statistics --- 7 packets transmitted, 7 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.835/2.188/2.500/0.207 msà [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 1472 data bytes ^C --- 8.8.8.8 ping statistics --- 4 packets transmitted, 0 packets received, 100.0% packet loss [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 -s 1472 208.123.73.78 PING 208.123.73.78 (208.123.73.78): 1472 data bytes ^C --- 208.123.73.78 ping statistics --- 9 packets transmitted, 0 packets received, 100.0% packet loss [2.8.1-RELEASE][root@gw.*****.com]/root: ping -4 208.123.73.78 PING 208.123.73.78 (208.123.73.78): 56 data bytes 64 bytes from 208.123.73.78: icmp_seq=0 ttl=50 time=45.105 ms 64 bytes from 208.123.73.78: icmp_seq=1 ttl=50 time=45.264 ms 64 bytes from 208.123.73.78: icmp_seq=2 ttl=50 time=45.400 ms ^C --- 208.123.73.78 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 45.105/45.256/45.400/0.121 ms[2.8.1-RELEASE][root@gw.*****.com]/root: dig @8.8.8.8 pfsense.org ; <<>> DiG 9.20.6 <<>> @8.8.8.8 pfsense.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29501 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;pfsense.org. IN A ;; ANSWER SECTION: pfsense.org. 300 IN A 208.123.73.78 ;; Query time: 51 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Fri Sep 05 18:51:10 EDT 2025 ;; MSG SIZE rcvd: 56 -
1472 might be too large for your MTU but you should be able to ping at 1400 for example.
Yup sorry 1472 is the largest packet I can send but that's after setting the parent NICs to use 1508 so I can pass full 1500B packets. Most PPPoE connections will top out with the 8B overhead at 1464.
-
Ok since digging an external server does work this seems more like an Unbound issue. Does it stop running? Any errors in the DNS Resolver log?
-
@stephenw10 I just tried using 1400 and it’s giving the same problem.
-
@stephenw10 So pinging in IPv4 i can go up to max of 132. In IPv6 I can do 112 as the size in the ping command. Seems the issue is not the dns resolver.
-
Huh. 132 Bytes total?
What does the interface show the MTU as?
ifconfig pppoe0 -
@stephenw10 Exact 132 bytes
Here's the pppoe info:
[2.8.1-RELEASE][root@gw.*****.com]/root: ifconfig pppoe0 pppoe0: flags=1008951<UP,POINTOPOINT,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1492 description: WAN options=0 inet 66.xx.xx.50 --> 198.xx.xx.33 netmask 0xffffffff inet6 fe80::xx:xx:xx:8660%pppoe0 prefixlen 64 scopeid 0xd inet6 2606:xx:xx:xx:xx:xx:xx:8660 prefixlen 64 autoconf pltime 604800 vltime 2592000 groups: pppoec nd6 options=123<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL,NO_DAD> -
Hmm. Can you ping the gateway IP with large packets? Or something closer to you in the route?
I've not seen any other report of MTU issues with if_pppoe. I assume if you just disable it and go back to mpd5/netgraph it passes large pings OK?
-
@stephenw10 So to make sure I decided to do a clean install of pfSense 2.8.1. Same issues.
Using mpd5 I can ping with a size of 1464 (with overhead and pppoe I think it's really sends 1500 right?). I tried switching back to if_pppoe and I can ping the IPv4 gateway upto 132bytes + overhead. I also tried pinging the IPv6 gateway using both mpd5 and if_pppoe and it doesn't respond at all, strangely I can ping v6 external servers tho but in if_pppoe I'm limited to a size of 112bytes + overhead. I'm monitoring cloudflare ipv6 dns server instead of the ipv6 gateway since day one and everything seems ok so far.
Any ideas?
[2.8.1-RELEASE][root@gw.******.com]/root: traceroute6 2606:xxxx:xxxx::1111 traceroute6 to 2606:xxxx:xxxx::1111 (2606:xxxx:xxxx::1111) from 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660, 64 hops max, 28 byte packets 1 2606:xxxx:xxxx:xxxx::36 (2606:xxxx:xxxx:xxxx::36) 3.733 ms 1.933 ms 1.519 ms 2 2606:xxxx:xxxx:xxxx::3d (2606:xxxx:xxxx:xxxx::3d) 1.667 ms 2.358 ms 3.631 ms 3 * 2400:xxxx:xxxx:xxxx::2 (2400:xxxx:xxxx:xxxx::2) 3.408 ms 2.403 ms 4 2400:xxxx:xxxx:xxxx::xxxx:7dab (2400:xxxx:xxxx:xxxx::xxxx:7dab) 1.939 ms 2400:xxxx:xxxx:xxxx::xxxx:7d7e (2400:xxxx:xxxx:xxxx::xxxx:7d7e) 2.048 ms 2400:xxxx:xxxx:xxxx::xxxx:7d9a (2400:xxxx:xxxx:xxxx::xxxx:7d9a) 2.051 ms [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 2606:xxxx:xxxx::1111 PING(160=40+8+112 bytes) 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 --> 2606:xxxx:xxxx::1111 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=0 hlim=61 time=2.765 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=1 hlim=61 time=2.316 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=2 hlim=61 time=2.424 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=3 hlim=61 time=2.555 ms 120 bytes from 2606:xxxx:xxxx::1111, icmp_seq=4 hlim=61 time=2.540 ms ^C --- 2606:xxxx:xxxx::1111 ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 2.316/2.520/2.765/0.150 ms [2.8.1-RELEASE][root@gw.******.com]/root: ping -s 112 fe80::xxxx:xxxx:fe00:0%pppoe0 PING(160=40+8+112 bytes) fe80::xxxx:xxxx:xxxx:8660%pppoe0 --> fe80::xxxx:xxxx:fe00:0%pppoe0 ^C --- fe80::xxxx:xxxx:fe00:0%pppoe0 ping statistics --- 10 packets transmitted, 0 packets received, 100.0% packet loss -
@exomic
The only thing I notice is that you’re using MLPPP with mpd5. I’m not sure whether that could be responsible for such large differences. -
@w0w I’m using Ebox (a child company of Bell Canada). Not sure they support mlppp.
-
Hmm, well that would certainly be an issue, if_pppoe doesn't support mlppp. But I think what you might be seeing is mpd5 just reporting it does support it. It also shows there is only one link in the above log.
But you seem to have proven an issue in your particular setup. I'll see what other tests might be pertinent here.
One thing we discovered recently is that whilst if_pppoe negotiates the MTU/MRU during the connection it doesn't do anything with the result. mpd5 does this correctly. When you use mpd5 hat MTU does the interface end up with?
It's possible your ISP is forcing some low packet size but 132B would be tiny!
-
@stephenw10 By default the wan mtu is 1492 but my isp support baby jumbo frames so I like to set it to 1500 (in ifconfig I see the pppoe mtu at 1500, the vlan interface at 1508 and the raw interface at 1520). Pinging at 1472 (1500 with the overhead) works without any issues using MPD5
-
Are you running any traffic shaping on the WAN?
Check the output of
netstat -I pppoe0 -dfor errors or drops.Lastly try to grab a pcap of the connection negotiation with the ISP in the parent NIC.
-
@stephenw10 I'm not running any traffic shaping at all.
Here's the netstat result:
[2.8.1-RELEASE][root@gw.********.com]/root: netstat -I pppoe0 -d Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop pppoe0 1500 <Link#13> pppoe0 3879 2258 2258 1722 pppoe0 - fe80::%pppoe0/64 fe80::20a:xxxx:xxxx:8660%pppoe0 0 - - 10 - - - pppoe0 - 173.xxx.xxx.29/32 173.xxx.xxx.29 393 - - 21 - - - pppoe0 - 2606:xxxx:xxxx:2f3a::/64 2606:xxxx:xxxx:2f3a:20a:xxxx:xxxx:8660 394 - - 16 -And the pcap of the pppoe negotiation
16:38:47.347011 PPPoE PADI [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.348431 PPPoE PADO [Service-Name] [AC-Name "VDRLPQ5502W"] [Host-Uniq 0x4680C6A1] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [PPP-Max-Payload 0x05DC] 16:38:47.348434 PPPoE PADR [Service-Name] [AC-Cookie 0x195BD05CD9BE36E411DCFADBD4EDF185] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.350558 PPPoE PADS [ses 0x92a] [Service-Name] [Host-Uniq 0x4680C6A1] [PPP-Max-Payload 0x05DC] 16:38:47.350562 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 1, length 12 16:38:47.351004 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 111, length 20 16:38:47.351006 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 111, length 20 16:38:47.352703 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 1, length 12 16:38:47.352707 PPPoE [ses 0x92a] PAP, Auth-Req (0x01), id 2, Peer REDACTED@pppoe.ebox.net, Name REDACTED 16:38:47.739573 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 17 16:38:47.739582 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 17 16:38:47.739588 PPPoE [ses 0x92a] LCP, Conf-Request (0x01), id 3, length 12 16:38:47.741720 PPPoE [ses 0x92a] LCP, Conf-Ack (0x02), id 3, length 12 16:38:47.741745 PPPoE [ses 0x92a] CHAP, Challenge (0x01), id 185, Value REDACTED, Name JUNOS 16:38:47.741749 PPPoE [ses 0x92a] CHAP, Response (0x02), id 185, Value REDACTED, Name REDACTED@pppoe.ebox.net 16:38:47.961651 PPPoE [ses 0x92a] CHAP, Success (0x03), id 185, Msg 16:38:47.961663 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 4, length 24 16:38:47.961666 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28 16:38:47.961667 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 1 group record(s), length 28 16:38:47.961669 PPPoE [ses 0x92a] IP6CP, Conf-Request (0x01), id 5, length 16 16:38:47.964889 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 120, length 12 16:38:47.964893 PPPoE [ses 0x92a] IPCP, Conf-Ack (0x02), id 120, length 12 16:38:47.965091 PPPoE [ses 0x92a] IPCP, Conf-Nack (0x03), id 4, length 24 16:38:47.965092 PPPoE [ses 0x92a] IPCP, Conf-Request (0x01), id 6, length 24 16:38:48.112866 PPPoE [ses 0x92a] IP6 :: > ff02::16: ICMP6, multicast listener report v2, 2 group record(s), length 48 16:38:48.121018 PPPoE [ses 0x92a] IPCP, Conf-Ack (0x02), id 6, length 24 16:38:48.121041 PPPoE [ses 0x92a] IP6CP, Conf-Request (0x01), id 10, length 16 16:38:48.121045 PPPoE [ses 0x92a] IP6CP, Conf-Ack (0x02), id 10, length 16 16:38:48.121216 PPPoE [ses 0x92a] IP6CP, Conf-Ack (0x02), id 5, length 16 16:38:48.210937 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:48.211237 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:48.212934 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:48.212957 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:48.213396 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 324 16:38:48.215935 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:48.216404 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.216406 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.216407 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268 16:38:48.223016 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1268 16:38:48.257783 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88 16:38:48.351853 PPPoE [ses 0x92a] PAP, Auth-Req (0x01), id 7, Peer REDACTED@pppoe.ebox.net, Name REDACTED 16:38:48.392359 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:48.431076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.480197 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:48.480263 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:48.482181 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:48.482201 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:48.482532 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 324 16:38:48.484929 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:48.485288 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.485290 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.485320 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267 16:38:48.494859 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1267 16:38:48.512954 PPPoE [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0 16:38:48.517870 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:48.520057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:48.520079 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:48.520401 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 324 16:38:48.523181 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:48.524074 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.524076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.524077 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268 16:38:48.533299 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1268 16:38:48.700950 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:48.707667 PPPoE [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0 16:38:48.742329 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:48.839075 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 1448 16:38:48.882533 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64561 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:49.108952 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 1448 16:38:49.140987 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:49.159327 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 1448 16:38:49.210866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00::1.35795 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.275807 PPPoE [ses 0x92a] IP 207.xx.xx.10.1702 > 173.xxx.xxx.246.9051: tcp 0 16:38:49.349232 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:49.383193 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.30963 > 1.1.1.1.853: tcp 0 16:38:49.386172 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.63607 > 1.1.1.1.853: tcp 0 16:38:49.389088 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:49.389247 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.7296 > 1.1.1.1.853: tcp 0 16:38:49.427059 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.30963: tcp 0 16:38:49.429306 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.63607: tcp 0 16:38:49.432933 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.7296: tcp 0 16:38:49.455807 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.455875 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.455944 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:49.457987 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:49.458009 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:49.458017 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:49.458041 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.458057 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:49.458078 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.458265 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 324 16:38:49.458269 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 324 16:38:49.458313 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 324 16:38:49.460936 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:49.460938 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:49.460976 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:49.461374 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.461376 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.461377 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267 16:38:49.461496 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461498 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461501 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.461560 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119 16:38:49.462323 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462352 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462355 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.462356 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120 16:38:49.469059 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1267 16:38:49.470454 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 119 16:38:49.471142 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 120 16:38:49.481293 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.481295 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.483338 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:49.483371 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.483433 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:49.483461 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.483671 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 324 16:38:49.483735 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 324 16:38:49.485985 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:49.486057 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:49.486435 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486439 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486440 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.486442 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119 16:38:49.486520 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.486523 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.486525 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267 16:38:49.495439 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1267 16:38:49.496070 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.53355: tcp 0 16:38:49.496311 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 119 16:38:49.498368 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 31466, seq 0, length 9 16:38:49.499896 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 31707, seq 0, length 9 16:38:49.501408 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 31466, seq 0, length 9 16:38:49.501916 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 31707, seq 0, length 9 16:38:49.505611 PPPoE [ses 0x92a] IP 10.10.6.10.51746 > 13.xxx.xxx.123.443: tcp 0 16:38:49.654859 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64562 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:49.676201 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:49.680324 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:49.681823 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:49.705451 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:49.707574 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:49.712731 PPPoE [ses 0x92a] IP 10.10.6.102.34645 > 142.xxx.xxx.99.443: tcp 0 16:38:49.831178 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0 16:38:49.834091 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 0 16:38:49.837630 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857 > 2a00:xxxx:xxxx:xxxx::2003.443: tcp 517 16:38:49.974266 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 0 16:38:49.975822 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 0, length 9 16:38:49.977522 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 0, length 9 16:38:49.977944 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 0, length 9 16:38:49.986604 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.9924 > 1.1.1.1.853: tcp 0 16:38:49.986685 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.987213 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 0, length 9 16:38:49.989261 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:49.991877 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:49.994465 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.4551 > 1.1.1.1.853: tcp 0 16:38:50.024857 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51832: tcp 1208 16:38:50.027071 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027075 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027077 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.027079 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507 16:38:50.029432 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 0 16:38:50.030441 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 0 16:38:50.032318 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 0 16:38:50.034213 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 0 16:38:50.038057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 0 16:38:50.084076 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.4551: tcp 1448 16:38:50.088323 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.17775: tcp 1348 16:38:50.090573 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1001.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.57686: tcp 1348 16:38:50.113449 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111.853 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660.3938: tcp 1348 16:38:50.114453 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.9924: tcp 1448 16:38:50.239779 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:50.243990 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:50.311065 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 507 16:38:50.333518 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:50.336556 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0 16:38:50.336817 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 0 16:38:50.337103 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578 > 2606:xxxx:xxxx::xxxx:8969.443: tcp 286 16:38:50.340056 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 0 16:38:50.341915 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.341917 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.341944 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508 16:38:50.349749 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 508 16:38:50.475866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 1, length 9 16:38:50.477926 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 1, length 9 16:38:50.480860 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 1, length 9 16:38:50.482607 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 1, length 9 16:38:50.559827 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.734051 PPPoE [ses 0x92a] IP6 2a00:xxxx:xxxx:xxxx::2003.443 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:861f.51857: tcp 1208 16:38:50.891003 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.21016 > 2606:xxxx:xxxx::1001.853: tcp 0 16:38:50.891014 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:fe49:8660.60724 > 2606:xxxx:xxxx::1111.853: tcp 0 16:38:50.966822 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::xxxx:8969.443 > 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64578: tcp 1360 16:38:50.977862 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 2, length 9 16:38:50.979901 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 2, length 9 16:38:50.981856 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 2, length 9 16:38:50.983782 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 2, length 9 16:38:51.027530 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660 > ff02::2: ICMP6, router solicitation, length 8 16:38:51.029905 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0 > ff02::1: ICMP6, router advertisement, length 88 16:38:51.156471 PPPoE [ses 0x92a] IP6 fe80::20a:f7ff:fe49:8660.546 > ff02::1:2.547: UDP, length 81 16:38:51.159187 PPPoE [ses 0x92a] IP6 fe80::200:ff:fe00:0.547 > fe80::20a:f7ff:fe49:8660.546: UDP, length 133 16:38:51.307098 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:2c00:xxxx:xxxx:xxxx:e0c6.64567 > 2001:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:af43.7680: tcp 0 16:38:51.478866 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660 > 2606:xxxx:xxxx::1111: ICMP6, echo request, id 5854, seq 3, length 9 16:38:51.480905 PPPoE [ses 0x92a] IP6 2606:xxxx:xxxx::1111 > 2606:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:8660: ICMP6, echo reply, id 5854, seq 3, length 9 16:38:51.487127 PPPoE [ses 0x92a] IP 173.xxx.xxx.246 > 198.xx.xx.34: ICMP echo request, id 6138, seq 3, length 9 16:38:51.487837 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0 16:38:51.487837 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0 16:38:51.489979 PPPoE [ses 0x92a] IP 198.xx.xx.34 > 173.xxx.xxx.246: ICMP echo reply, id 6138, seq 3, length 9 16:38:51.490281 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0 16:38:51.490282 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0 16:38:51.490298 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 0 16:38:51.490298 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 0 16:38:51.490747 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.12118 > 1.1.1.1.853: tcp 324 16:38:51.490748 PPPoE [ses 0x92a] IP 173.xxx.xxx.246.33426 > 1.1.1.1.853: tcp 324 16:38:51.492931 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 0 16:38:51.493057 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 0 16:38:51.493594 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448 16:38:51.493597 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1448 16:38:51.493599 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269 16:38:51.493885 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448 16:38:51.493886 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1448 16:38:51.493887 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268 16:38:51.502386 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.33426: tcp 1269 16:38:51.502811 PPPoE [ses 0x92a] IP 1.1.1.1.853 > 173.xxx.xxx.246.12118: tcp 1268 -
Hmm, nothing obvious there. It sure looks to be trying to use 1500B.
I see plenty on incoming large size packets too but also the Idrop counter being huge.....
Are you able to upload the pcap itself to us for analysis?
Do you see any large outgoing packets at all? Maybe outside the PPPoE stream?
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.