Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unexplained Excess Traffic on WAN

    Scheduled Pinned Locked Moved General pfSense Questions
    9 Posts 4 Posters 3.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      TC10284
      last edited by

      I am running pfSense 2.0.3.

      For a while, I've been seeing bandwidth usage spikes on the WAN connection. I have a 15mbps down connection and it has stayed maxed out for a while. The only way to resolve it is to either reset the firewall states or restart the router. But eventually, the traffic will come back. There is nothing on my LAN that is using this much bandwidth. The only package I have installed is Squid 2.7.9.
      I do have an Open-VPN site-to-site VPN setup, but the traffic graph doesn't show anything on that interface is using that bandwidth either. Plus, it doesn't seem to help if I break the site-to-site VPN anyway

      Below I have done some packet captures. All are within a few minutes of each other. I let them all run for a minute or longer.

      Here is a packet capture from the WAN interface:
      10:36:47.912634 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.912660 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.913507 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.913529 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.914345 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.914365 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.915204 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.915222 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.916156 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.916173 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.916492 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.916509 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.917356 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.917373 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.918205 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.918222 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.919066 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.919084 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.919742 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.919759 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.920356 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.920373 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.921242 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.921259 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.922072 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.922090 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.922918 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.922935 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.923784 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.923801 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.924635 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.924652 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.925052 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.925069 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.926467 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.926485 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.926623 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.926639 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.927646 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.927666 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.928503 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.928522 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.929360 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.929378 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.929768 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.929785 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.931202 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.931225 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.931476 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.931493 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.932475 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.932492 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.933225 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.933242 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.934082 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.934099 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.934490 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.934507 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.935380 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.935397 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.936278 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.936295 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.937090 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.937109 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.937945 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.937962 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.938924 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.938941 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.939660 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.939677 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.940521 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.940538 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.941176 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.941193 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.941825 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.941842 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.942664 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.942685 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.943523 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.943543 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.944382 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.944400 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.944792 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.944809 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.946226 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.946243 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.946490 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.946508 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.947385 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.947402 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.948236 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.948253 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.949100 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.949117 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.949962 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.949979 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.950364 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.950381 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.951300 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.951317 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.952115 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.952132 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.952962 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.952979 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.953818 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.953835 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.954672 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.954689 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.955086 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.955103 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.956331 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.956349 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.956815 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.956832 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.957683 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.957704 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.958555 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.958574 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.959399 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.959416 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.959806 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.959823 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.961237 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.961255 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.961498 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.961516 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.962406 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.962423 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.963260 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.963277 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.964403 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.964420 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.964981 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.964998 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.965382 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.965437 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.966301 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.966318 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.967127 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.967144 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.967980 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.967997 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.968838 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.968856 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.969697 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.969716 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.971300 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.971317 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.971456 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.971473 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.971841 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.971859 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.972704 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.972725 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.973558 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.973578 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.974412 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.974429 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.974821 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.974838 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.976323 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.976340 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.976739 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.976756 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.977447 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.977464 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.978278 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.978295 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.979141 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.979158 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.979993 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.980011 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.981323 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.981340 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.981470 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.981489 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.982152 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.982171 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.982998 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.983015 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.983876 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.983893 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.984260 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.984277 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.985586 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.985603 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.986273 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.986290 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.986871 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.986888 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.987718 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.987740 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.988578 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.988599 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.989435 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.989453 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.990110 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.990128 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.991178 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.991195 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.991544 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.991562 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.992442 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.992459 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.993291 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.993308 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.994155 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.994172 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.995007 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.995024 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.996453 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.996470 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.996628 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.996644 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.997169 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.997185 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.998018 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.998035 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.998874 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.998891 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:47.999281 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:47.999298 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.000168 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.000185 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.001281 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.001298 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.001877 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.001894 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.002762 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.002784 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.003594 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.003614 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.004452 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.004469 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.004872 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.004889 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.006353 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.006373 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.006760 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.006777 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.007466 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.007483 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.008315 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.008332 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.009285 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.009302 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.010032 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.010048 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.010438 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.010456 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.011462 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.011479 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.012195 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.012212 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.013035 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.013053 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.013894 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.013914 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.014752 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.014822 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.015148 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.015180 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.016256 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.016339 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.016909 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.016967 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.017763 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.017834 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.018614 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.018687 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.019476 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.019535 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.020335 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.020355 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.021235 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.021253 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.021613 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.021633 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.022491 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.022509 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.022515 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 0
      10:36:48.023336 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.023353 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.024197 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.024247 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.025053 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.025124 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.026320 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.026410 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.026467 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.026487 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.027208 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.027259 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.028052 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.028074 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.028929 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.028947 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.029769 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.029788 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.029793 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 0
      10:36:48.031137 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.031154 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.031306 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.031323 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.031916 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.031938 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.032772 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.032795 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.033631 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.033652 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.034762 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.034779 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.035352 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.035371 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.036240 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.036257 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.036629 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.036699 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.037496 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.037515 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.038350 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.038371 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.039210 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.039227 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.040067 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.040083 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.041393 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.041411 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.041548 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.041564 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.042217 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.042234 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.043071 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.043088 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.043093 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 0
      10:36:48.043102 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 0
      10:36:48.043928 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.043945 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.044781 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.044798 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.045222 ARP, Request who-has cpe-024-167-139-067.triad.res.rr.com tell cpe-024-167-128-001.triad.res.rr.com, length 46
      10:36:48.045412 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.045429 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.046550 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.046567 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.047590 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.047607 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.047765 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.047786 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.049087 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.049107 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.049484 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.049502 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.050366 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.050383 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.051307 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.051324 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.052088 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.052105 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.052489 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.052507 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.053369 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.053387 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.054262 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.054279 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.055078 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.055095 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.056261 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.056278 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.056429 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.056446 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.057658 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.057676 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.058066 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.058083 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.058947 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.058964 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.059804 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.059822 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.061052 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.061068 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.061206 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.061223 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.061951 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.061968 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.062811 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.062832 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.063660 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.063680 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.064540 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.064557 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.065385 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.065402 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.066318 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.066335 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.067115 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.067132 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.067510 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.067527 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.068391 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.068407 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.068420 IP rrcs-98-101-53-51.midsouth.biz.rr.com > user-0c993g7.cable.mindspring.com: GREv1, call 30557, seq 1907, ack 2155, length 61: compressed PPP data
      10:36:48.068444 IP rrcs-98-101-53-51.midsouth.biz.rr.com > user-0c993g7.cable.mindspring.com: GREv1, call 30557, seq 1908, ack 2157, length 61: compressed PPP data
      10:36:48.069233 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.069252 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.070097 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.070115 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.071275 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.071292 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.071838 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.071855 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.072696 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.072713 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.073561 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.073580 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.073952 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.073969 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.074825 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.074842 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.076290 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.076308 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.076464 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.076481 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.077399 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.077416 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.077524 ARP, Request who-has cpe-024-167-134-175.triad.res.rr.com tell cpe-024-167-128-001.triad.res.rr.com, length 46
      10:36:48.078266 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.078289 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.078660 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.078679 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.079761 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.079779 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.080401 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.080418 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.081288 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.081305 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.081578 IP rrcs-98-101-53-51.midsouth.biz.rr.com > user-0c993g7.cable.mindspring.com: GREv1, call 30557, seq 1909, ack 2159, length 61: compressed PPP data
      10:36:48.082125 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.082144 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.082968 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.082988 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.083835 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.083852 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.084690 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.084708 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.085101 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.085118 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.086449 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.086466 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.086805 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.086822 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.087700 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.087717 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.088557 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.088575 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.088957 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.088974 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.089843 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.089861 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.091251 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.091268 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.091405 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.091422 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.092428 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.092445 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.093275 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.093296 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.094134 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.094154 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.094554 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.094571 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.095415 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.095432 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.096307 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.096323 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.097141 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.097159 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.097994 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.098011 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.098928 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.098944 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.099242 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.099259 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.100143 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.100161 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.100166 IP rrcs-98-101-53-51.midsouth.biz.rr.com > user-0c993g7.cable.mindspring.com: GREv1, call 30557, seq 1910, ack 2161, length 61: compressed PPP data
      10:36:48.101226 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.101244 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.101872 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.101889 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.102715 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.102733 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.103572 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.103589 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.104431 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.104449 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.105381 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.105398 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0
      10:36:48.106161 IP 64.208.241.50.http > user-0c993g7.cable.mindspring.com.47681: tcp 1448
      10:36:48.106178 IP user-0c993g7.cable.mindspring.com.47681 > 64.208.241.50.http: tcp 0

      Here is a packet capture from my LAN interface:
      10:44:47.557536 IP 63.251.34.129.https > 192.168.1.2.63739: tcp 37
      10:44:47.643435 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2572, ack 3098, length 61: compressed PPP data
      10:44:47.643445 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2573, ack 3099, length 61: compressed PPP data
      10:44:47.643870 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.643887 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.668718 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2574, ack 3101, length 61: compressed PPP data
      10:44:47.668961 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.689040 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2575, ack 3103, length 61: compressed PPP data
      10:44:47.689319 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.701704 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2576, ack 3105, length 61: compressed PPP data
      10:44:47.701960 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.740582 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2577, ack 3107, length 61: compressed PPP data
      10:44:47.740591 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2578, ack 3109, length 61: compressed PPP data
      10:44:47.740932 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.741057 IP 192.168.1.112.9842 > pfsense.tc.local.http: tcp 0
      10:44:47.741651 IP 192.168.1.2.63739 > 63.251.34.129.https: tcp 0
      10:44:47.746019 IP 192.168.1.3 > rrcs-98-101-53-51.midsouth.biz.rr.com: GREv1, call 62562, ack 2578, no-payload, length 12
      10:44:47.842449 IP 63.251.34.134.https > 192.168.1.212.elan: tcp 53
      10:44:47.842462 IP 63.251.34.130.https > 192.168.1.206.49228: tcp 53
      10:44:47.904377 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 469
      10:44:47.904399 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:47.932524 IP 192.168.1.206.49228 > 63.251.34.130.https: tcp 53
      10:44:48.058518 IP 192.168.1.212.elan > 63.251.34.134.https: tcp 0
      10:44:48.103490 IP 63.251.34.130.https > 192.168.1.206.49228: tcp 0
      10:44:48.123056 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 464
      10:44:48.124604 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:48.124826 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:48.182233 IP6 fe80::544d:cd3a:7b2c:49d7.60901 > ff02::c.1900: UDP, length 146
      10:44:48.247486 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 354
      10:44:48.247508 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:48.259710 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 528
      10:44:48.261247 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:48.261349 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:48.869638 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 155
      10:44:48.869693 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 138
      10:44:48.869731 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 51
      10:44:48.869766 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 50
      10:44:48.869803 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 78
      10:44:49.152372 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 469
      10:44:49.152399 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:49.295290 ARP, Request who-has 192.168.1.202 tell 192.168.1.8, length 46
      10:44:49.371196 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 464
      10:44:49.372803 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:49.372986 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:50.289974 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2579, length 65: compressed PPP data
      10:44:50.386650 IP 192.168.1.3 > rrcs-98-101-53-51.midsouth.biz.rr.com: GREv1, call 62562, ack 2579, no-payload, length 12
      10:44:50.400332 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 469
      10:44:50.400353 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:50.618155 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 464
      10:44:50.619768 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:50.619959 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:51.252348 IP6 fe80::bcec:898c:7396:bf65.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 93
      10:44:51.289361 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 354
      10:44:51.289388 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:51.301533 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 528
      10:44:51.303077 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:51.303308 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:51.365780 IP 192.168.1.212.elan > 63.251.34.134.https: tcp 53
      10:44:51.413831 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2113: tcp 180
      10:44:51.414784 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2113: tcp 1448
      10:44:51.415010 IP 192.168.1.212.2113 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.415485 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2113: tcp 1370
      10:44:51.415611 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2113: tcp 0
      10:44:51.415648 IP 192.168.1.212.2113 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.415687 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2113: tcp 0
      10:44:51.415816 IP 192.168.1.212.2113 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.416516 IP 192.168.1.212.2115 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.416579 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2115: tcp 0
      10:44:51.416804 IP 192.168.1.212.2115 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.416965 IP 192.168.1.212.2115 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 227
      10:44:51.416983 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2115: tcp 0
      10:44:51.557036 IP 63.251.34.134.https > 192.168.1.212.elan: tcp 0
      10:44:51.580267 IP a23-62-111-25.deploy.akamaitechnologies.com.http > 192.168.1.212.2115: tcp 574
      10:44:51.606860 IP 192.168.1.208.49979 > app01-12.logmein.com.https: tcp 37
      10:44:51.638351 IP app01-12.logmein.com.https > 192.168.1.208.49979: tcp 37
      10:44:51.640943 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 469
      10:44:51.640963 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:51.786852 IP 192.168.1.212.2115 > a23-62-111-25.deploy.akamaitechnologies.com.http: tcp 0
      10:44:51.840461 IP 192.168.1.208.49979 > app01-12.logmein.com.https: tcp 0
      10:44:51.858212 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 464
      10:44:51.859776 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:51.859972 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:52.176174 IP6 fe80::544d:cd3a:7b2c:49d7.60901 > ff02::c.1900: UDP, length 146
      10:44:52.258949 IP6 fe80::bcec:898c:7396:bf65.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 93
      10:44:52.429115 IP 192.168.1.2.62008 > 64.74.103.171.https: tcp 37
      10:44:52.474961 IP 192.168.1.214.2331 > 157.55.130.154.40034: UDP, length 36
      10:44:52.534787 IP 64.74.103.171.https > 192.168.1.2.62008: tcp 37
      10:44:52.559312 IP 157.55.130.154.40034 > 192.168.1.214.2331: UDP, length 20
      10:44:52.737644 IP 192.168.1.2.62008 > 64.74.103.171.https: tcp 0
      10:44:52.880950 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 469
      10:44:52.880975 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:53.098250 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 483
      10:44:53.099824 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 5
      10:44:53.099844 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:53.100010 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:53.100052 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:53.100290 IP 192.168.1.212.2114 > pfsense.tc.local.http: tcp 0
      10:44:53.100322 IP pfsense.tc.local.http > 192.168.1.212.2114: tcp 0
      10:44:53.510096 IP6 fe80::f095:e64c:e700:b993.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 90
      10:44:53.665277 IP 192.168.1.9.65006 > 64.74.103.179.https: tcp 37
      10:44:53.829126 IP 64.74.103.179.https > 192.168.1.9.65006: tcp 37
      10:44:54.039613 IP 192.168.1.9.65006 > 64.74.103.179.https: tcp 0
      10:44:54.129293 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:54.129358 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:54.129619 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:54.129837 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:44:54.129855 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:54.271291 IP6 fe80::bcec:898c:7396:bf65.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 93
      10:44:54.315957 IP 192.168.1.212.2117 > pfsense.tc.local.http: tcp 0
      10:44:54.316021 IP pfsense.tc.local.http > 192.168.1.212.2117: tcp 0
      10:44:54.316266 IP 192.168.1.212.2117 > pfsense.tc.local.http: tcp 0
      10:44:54.316472 IP 192.168.1.212.2117 > pfsense.tc.local.http: tcp 354
      10:44:54.316492 IP pfsense.tc.local.http > 192.168.1.212.2117: tcp 0
      10:44:54.327660 IP pfsense.tc.local.http > 192.168.1.212.2117: tcp 528
      10:44:54.329002 IP pfsense.tc.local.http > 192.168.1.212.2117: tcp 5
      10:44:54.329181 IP 192.168.1.212.2117 > pfsense.tc.local.http: tcp 0
      10:44:54.347206 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 464
      10:44:54.348832 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:54.349025 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:54.869782 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 155
      10:44:54.869834 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 138
      10:44:54.869870 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 51
      10:44:54.869905 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 50
      10:44:54.869942 IP pfsense.tc.local.syslog > 192.168.1.4.syslog: UDP, length 78
      10:44:55.063110 IP 192.168.1.212.prospero-np > 157.56.233.66.https: tcp 45
      10:44:55.063133 IP 192.168.1.212.rds2 > 157.56.242.105.https: tcp 45
      10:44:55.186768 IP6 fe80::544d:cd3a:7b2c:49d7.60901 > ff02::c.1900: UDP, length 146
      10:44:55.376884 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:44:55.376911 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:55.419612 IP 157.56.233.66.https > 192.168.1.212.prospero-np: tcp 0
      10:44:55.491280 IP 157.56.242.105.https > 192.168.1.212.rds2: tcp 0
      10:44:55.594341 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 464
      10:44:55.595884 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:55.596129 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:56.324086 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 252
      10:44:56.527350 IP 192.168.1.3.1553 > 64.74.103.171.https: tcp 37
      10:44:56.600298 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 0
      10:44:56.600434 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 837
      10:44:56.624768 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:44:56.624792 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:56.690295 IP 64.74.103.171.https > 192.168.1.3.1553: tcp 37
      10:44:56.738065 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 252
      10:44:56.843336 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 464
      10:44:56.844954 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:56.845150 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:56.917882 IP 192.168.1.3.1553 > 64.74.103.171.https: tcp 0
      10:44:56.936767 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
      10:44:57.067984 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 95
      10:44:57.105704 ARP, Request who-has pfsense.tc.local (00:1b:21:50:04:65 (oui Unknown)) tell 192.168.1.2, length 46
      10:44:57.105713 ARP, Reply pfsense.tc.local is-at 00:1b:21:50:04:65 (oui Unknown), length 28
      10:44:57.132100 IP 192.168.1.3 > rrcs-98-101-53-51.midsouth.biz.rr.com: GREv1, call 62562, seq 3110, length 63: compressed PPP data
      10:44:57.269779 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
      10:44:57.278928 IP rrcs-98-101-53-51.midsouth.biz.rr.com > 192.168.1.3: GREv1, call 30557, seq 2580, ack 3110, length 73: compressed PPP data
      10:44:57.357820 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 354
      10:44:57.357841 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:57.369860 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 528
      10:44:57.371427 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:57.371631 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:57.386617 IP 192.168.1.3 > rrcs-98-101-53-51.midsouth.biz.rr.com: GREv1, call 62562, ack 2580, no-payload, length 12
      10:44:57.868785 IP 63.251.34.134.https > 192.168.1.212.elan: tcp 37
      10:44:57.873026 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:44:57.873047 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:57.876784 IP 63.251.34.134.https > 192.168.1.212.elan: tcp 53
      10:44:57.876976 IP 192.168.1.212.elan > 63.251.34.134.https: tcp 0
      10:44:57.887079 IP 63.251.34.130.https > 192.168.1.206.49228: tcp 37
      10:44:57.887096 IP 63.251.34.130.https > 192.168.1.206.49228: tcp 53
      10:44:57.887231 IP 192.168.1.206.49228 > 63.251.34.130.https: tcp 0
      10:44:57.947940 IP 192.168.1.206.49228 > 63.251.34.130.https: tcp 53
      10:44:57.949090 IP 192.168.1.212.1557 > 157.56.242.105.https: tcp 45
      10:44:58.091356 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 464
      10:44:58.092932 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:58.093123 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:44:58.197752 IP6 fe80::544d:cd3a:7b2c:49d7.60901 > ff02::c.1900: UDP, length 146
      10:44:58.245304 IP 63.251.34.130.https > 192.168.1.206.49228: tcp 0
      10:44:58.280331 IP6 fe80::bcec:898c:7396:bf65.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 93
      10:44:58.386486 IP 157.56.242.105.https > 192.168.1.212.1557: tcp 0
      10:44:58.444932 IP 192.168.1.204.sae-urn > sg.vzwfemto.com.sae-urn: UDP, length 1
      10:44:59.120670 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:44:59.120697 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 0
      10:44:59.339472 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 464
      10:44:59.341021 IP pfsense.tc.local.http > 192.168.1.212.2116: tcp 5
      10:44:59.341217 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 0
      10:45:00.055283 IP6 fe80::9943:229b:cbb8:804e.dhcpv6-client > ff02::1:2.dhcpv6-server: UDP, length 95
      10:45:00.369256 IP 192.168.1.212.2116 > pfsense.tc.local.http: tcp 469
      10:45:00.369284

      1 Reply Last reply Reply Quote 0
      • T
        TC10284
        last edited by

        Here is a packet capture from the DMZ interface:
        10:53:28.605190 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 37
        10:53:28.774330 IP 64.74.103.183.https > 192.168.0.2.50784: tcp 37
        10:53:28.963855 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 0
        10:53:59.181096 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 37
        10:53:59.243526 IP 64.74.103.183.https > 192.168.0.2.50784: tcp 37
        10:53:59.446179 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 0
        10:54:04.032549 ARP, Request who-has 192.168.0.1 (00:1a:a0:63:d9:08 (oui Unknown)) tell 192.168.0.2, length 46
        10:54:04.032563 ARP, Reply 192.168.0.1 is-at 00:1a:a0:63:d9:08 (oui Unknown), length 28
        10:54:29.663397 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 37
        10:54:29.831945 IP 64.74.103.183.https > 192.168.0.2.50784: tcp 37
        10:54:30.022465 IP 192.168.0.2.50784 > 64.74.103.183.https: tcp 0
        10:54:34.405653 ARP, Request who-has 192.168.0.1 (00:1a:a0:63:d9:08 (oui Unknown)) tell 192.168.0.2, length 46
        10:54:34.405669 ARP, Reply 192.168.0.1 is-at 00:1a:a0:63:d9:08 (oui Unknown), length 28

        Here is a packet capture from the OpenVPN interface:
        10:55:41.367756 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 252
        10:55:41.708387 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 0
        10:55:41.708597 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 837
        10:55:41.837058 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 252
        10:55:42.031112 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
        10:55:42.156715 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 95
        10:55:42.342627 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
        10:55:48.716028 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:49.730019 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:50.728423 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:51.726818 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:52.725223 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:53.723609 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:54.737621 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:55.736011 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:56.364942 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 252
        10:55:56.671939 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 0
        10:55:56.672130 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 837
        10:55:56.734407 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:56.800971 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 252
        10:55:56.983753 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
        10:55:57.113888 IP 192.168.2.3.2161 > 192.168.1.2.63681: tcp 95
        10:55:57.316751 IP 192.168.1.2.63681 > 192.168.2.3.2161: tcp 0
        10:55:57.732801 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 1
        10:55:58.746799 IP 192.168.1.9.49155 > 192.168.2.3.1894: tcp 0

        1 Reply Last reply Reply Quote 0
        • W
          wallabybob
          last edited by

          Squid is downloading something for its cache?

          What is at  64.208.241.50?

          1 Reply Last reply Reply Quote 0
          • T
            TC10284
            last edited by

            @wallabybob:

            Squid is downloading something for its cache?

            What is at  64.208.241.50?

            I'm not sure why Squid would be?

            I'm not aware of anything that I actively use at IP 64.208.241.50. an IPWHOIS says:
            64.208.241.50 - Geo Information
            IP Address 64.208.241.50
            Host 64.208.241.50
            Location US, United States
            City -, - -
            Organization Level 3 Communications
            ISP Level 3 Communications
            AS Number AS3549 Global Crossing Ltd.
            Latitude 38°00'00" North
            Longitude 97°00'00" West
            Distance 9208.78 km (5722.07 miles)

            However, the only thing I use with Level 3 are 4.2.2.1 and 4.2.2.2 for DNS servers to forward DNS queries there if the DNS server cannot find an address. But I also use 8.8.8.8 and 8.8.4.4 as well.
            On my DNS servers, they are in the order of:
            4.2.2.1
            8.8.8.8
            4.2.2.2
            8.8.4.4

            1 Reply Last reply Reply Quote 0
            • W
              wallabybob
              last edited by

              Is there any apparent pattern to the usage spike?

              From the data presented it looks as if the data sink might be the pfSense box itself. So when you see the traffic spike on the WAN interface do a packet capture to determine the local port number for the traffic, then issue the pfSense shell command```
              sockstat -4

              
Consult the FreeBSD man page for sockstat at [http://www.freebsd.org/cgi/man.cgi?query=sockstat&sektion=1&apropos=0&manpath=FreeBSD+9.1-RELEASE](http://www.freebsd.org/cgi/man.cgi?query=sockstat&sektion=1&apropos=0&manpath=FreeBSD+9.1-RELEASE) to see other options which will enable you to be more selective about what sockstat displays.
              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Vs just looking at the headers of your captures - why don't you download the capture and look at exactly what is in there. - should be able to see the actual url its using vs just an IP that way, and headers from the http stream can give you a clue to what is being looked at or downloaded, etc.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • T
                  TC10284
                  last edited by

                  Since I have removed the Squid v1 proxy package, I haven't noticed any more of this so far.

                  1 Reply Last reply Reply Quote 0
                  • T
                    TC10284
                    last edited by

                    @TC10284:

                    Since I have removed the Squid v1 proxy package, I haven't noticed any more of this so far.

                    This appears to have resolved my problem.

                    A shame though, as I liked using the Squid proxy package.

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      Sounds like you somehow created open proxy…

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.