ANDROID WIFI



  • hey everyone.

    i have noticed that on multiple android devices on wifi i am have intermittent issues with DNS resolving and IP access.

    I will be browsing and suddenly everything comes to a halt.  although all other devices on the network are fine. 
    Facebook app on android will NEVER work.  It just sits there waiting to update constantly but will never load pictures or update the feed.

    I have tried changing my DNS from google to open dns and even my ISP dns but have seen NO change in the issue.

    I have seen a simliar issue posted about but no resolution as i can see.

    Thanks and please let me know what information from me would be helpful to troubleshoot this.  I know i am not including some vital piece of information!


  • Netgate Administrator

    What version of pfSense are you running? What hardware are you running it on? Are you using a separate access point? Are the other functioning devices also wireless and on the same access point?

    Steve



  • I am running this in a virtual enviornment via esxi on a….
    dell r210 poweredge server.
    it has 3 gb ram (virtual assign)
    2.4ghz processor
    10GB virtual HD
    Version 2.1.5 64-bit

    all other devices on my network (wired and wireless) work perfectly on the same AP (xbox, TV, mac laptops, iphones, ipad) but there is something about the way these android devices are querying that pfsense doesnt seem to like.  I was also unable to locate any log items leaning to any issue with resolving or routing which is just puzzling because if the sometimes the device works perfectly for about 3 minutes and than snails pace will load one picture in about 5 minutes.  I also have NO packages installed and am running bare bones pfsense at the moment

    Thanks



  • Do you have any sort of content/web filtering going on? Do you have anything explicitly blocked that you can check against? Anything showing up in the firewall logs? I have a very similar setup pfsense on ESXI and android devices.. no issue.


  • Netgate Administrator

    So you have an external wifi access point. Is it running as a pure access point?
    What Android devices specifically? I have multiple Android devices here with no problems.

    Steve



  • I do have a seperate external AP that is acting only as an AP. 
    The issue is effecting my Galaxy S5 device and will not allow youtube, facebook, whatsapp, and any other streaming applications to work.


  • Netgate Administrator

    Hmm, very odd. Just that one device?
    I would try to pin point what's not working. Get network tool on the device and test ping response and DNS when it stops working. Check for log entries in pfSense. Try running a packet capture in pfSense to see it the Galaxy is sending anything at all.
    Perhaps it's trying to use a mobile data connection instead?

    Steve


  • LAYER 8 Netgate

    I would also look at the AP to see if you can get any information out of it related to that specific client association.  Noise, retransmissions, signal strength, etc.  Does it log anything useful?

    Does the Wi-Fi interface on the problem phone work fine on other APs/Networks?

    I wouldn't be looking at pfSense until you're positive it's not a layer 1 or 2 issue.



  • I'm inclined to lean on pfsense being the issue because if I swap my pf box for a $45 link sys router everything works fine.

    I'm going crazy over this as pfsense works so well with everything except this one galaxy s5.


  • LAYER 8 Netgate

    Next step would be a packet capture then as has been mentioned.


  • Netgate Administrator

    When you swap in the Linksys router for pfSense are you still using the same wifi access point?

    Steve



  • I will check that out.

    I have been using the same AP this whole time regardless of router.  It is a ruckus 7363 AP.

    Tha ks for the help so far everyone.  Great community.


  • Netgate Administrator

    Hmm tricky. Do you have a link to the similar issues you talked about earlier?

    At this point I would get back to basics. Wait until it's not working and then test exactly what is not working. Look at the logs. Do a packet capture.

    Steve

    Edit: This thread? https://forum.pfsense.org/index.php?topic=68764.0
    That looks to me like it could be an MTU issue. Are you using modem in bridged mode?
    https://doc.pfsense.org/index.php/Unable_to_Access_Some_Websites



  • My modem does not have settings for bridge mode or router, etc.  Its a basic hand off on one  10/100/1000 port on a cable modem.  My MTU by default should be 1500 but now that you mention it my xbox one does complain about my MTU being 1483.

    I will try and enter 1500 into pfs Wan port and see how that works.

    And yes that was the post I was referring to.

    Thanks again


  • Netgate Administrator

    If your xbox complains about it being 1483 then you probably have that restriction somewhere in the path. The xbox may be clever enough to diagnose that by itself and reduce it's own MTU to match.
    Do you connect via PPPoE or DHCP to the ISP?
    Run ifconfig at the console to see what the MTU is currently for each of your interfaces. If your pfSense WAN should be <1500 and it isn't try setting that to 1483.

    Steve



  • For some reason after installing a fresh copy of pf it worked for about an hour and now will not load again and is constantly stalling.

    I put below the packet capture results.  Not sure really what I'm looking for.

    19:24:46.761500 IP (tos 0x0, ttl 59, id 20338, offset 0, flags [none], proto TCP (6), length 186)
        167.206.145.119.https > 10.2.2.3.55043: Flags [P.], cksum 0xe8c3 (correct), ack 614423723, win 313, length 146
    19:24:46.761519 IP (tos 0x0, ttl 59, id 20339, offset 0, flags [none], proto TCP (6), length 73)
        167.206.145.119.https > 10.2.2.3.55043: Flags [P.], cksum 0x21d5 (correct), ack 1, win 313, length 33
    19:24:46.762980 IP (tos 0x0, ttl 64, id 58240, offset 0, flags [DF], proto TCP (6), length 505)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [P.], cksum 0xd0e9 (correct), ack 1587559684, win 520, options [nop,nop,TS val 687640649 ecr 13894], length 453
    19:24:46.763026 IP (tos 0x0, ttl 64, id 36062, offset 0, flags [DF], proto TCP (6), length 105)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [P.], cksum 0xc5ea (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13894], length 53
    19:24:46.763198 IP (tos 0x0, ttl 64, id 59155, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x928e (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13894], length 1448
    19:24:46.763221 IP (tos 0x0, ttl 64, id 9532, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x1195 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13894], length 1448
    19:24:46.763241 IP (tos 0x0, ttl 64, id 57855, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0xcaed (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13894], length 1448
    19:24:46.763639 IP (tos 0x0, ttl 64, id 48162, offset 0, flags [DF], proto TCP (6), length 40)
        10.2.2.3.55043 > 167.206.145.119.https: Flags [.], cksum 0xe03b (correct), ack 179, win 148, length 0
    19:24:46.766263 IP (tos 0x0, ttl 64, id 6497, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x4231 (correct), ack 1954, win 893, options [nop,nop,TS val 13899 ecr 687640649], length 0
    19:24:46.766304 IP (tos 0x0, ttl 64, id 18200, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x89b1 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766323 IP (tos 0x0, ttl 64, id 29783, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x2241 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766337 IP (tos 0x0, ttl 64, id 48151, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x6066 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766346 IP (tos 0x0, ttl 64, id 4412, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0xbb27 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766354 IP (tos 0x0, ttl 64, id 22436, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0xd389 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766363 IP (tos 0x0, ttl 64, id 3957, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x3d3d (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766371 IP (tos 0x0, ttl 64, id 56360, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0xffc2 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766380 IP (tos 0x0, ttl 64, id 45299, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0xb503 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766389 IP (tos 0x0, ttl 64, id 33450, offset 0, flags [DF], proto TCP (6), length 1500)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [.], cksum 0x1682 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1448
    19:24:46.766397 IP (tos 0x0, ttl 64, id 17578, offset 0, flags [DF], proto TCP (6), length 1111)
        rt1stmfdhse.grunowmedia.https > 10.2.2.3.55336: Flags [P.], cksum 0x2fd8 (correct), ack 1, win 520, options [nop,nop,TS val 687640649 ecr 13899], length 1059
    19:24:46.766400 IP (tos 0x0, ttl 64, id 6498, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x36b4 (correct), ack 4850, win 938, options [nop,nop,TS val 13899 ecr 687640649], length 0
    19:24:46.773642 IP (tos 0x0, ttl 64, id 6499, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x2b36 (correct), ack 7746, win 983, options [nop,nop,TS val 13900 ecr 687640649], length 0
    19:24:46.773657 IP (tos 0x0, ttl 64, id 6500, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x1fb9 (correct), ack 10642, win 1028, options [nop,nop,TS val 13900 ecr 687640649], length 0
    19:24:46.773667 IP (tos 0x0, ttl 64, id 6501, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x143b (correct), ack 13538, win 1074, options [nop,nop,TS val 13900 ecr 687640649], length 0
    19:24:46.773675 IP (tos 0x0, ttl 64, id 6502, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0x08be (correct), ack 16434, win 1119, options [nop,nop,TS val 13900 ecr 687640649], length 0
    19:24:46.773680 IP (tos 0x0, ttl 64, id 6503, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.55336 > rt1stmfdhse.grunowmedia.https: Flags [.], cksum 0xfec5 (correct), ack 18941, win 1164, options [nop,nop,TS val 13900 ecr 687640649], length 0
    19:24:46.776581 IP (tos 0x0, ttl 64, id 48163, offset 0, flags [DF], proto TCP (6), length 73)
        10.2.2.3.55043 > 167.206.145.119.https: Flags [P.], cksum 0xfe11 (correct), ack 179, win 148, length 33
    19:24:46.828695 IP (tos 0x0, ttl 59, id 20340, offset 0, flags [none], proto TCP (6), length 40)
        167.206.145.119.https > 10.2.2.3.55043: Flags [.], cksum 0xdf75 (correct), ack 34, win 313, length 0
    19:24:49.477294 IP (tos 0x0, ttl 64, id 42331, offset 0, flags [DF], proto TCP (6), length 196)
        10.2.2.3.48960 > mqtt-shv-06-ash2.facebook.com.https: Flags [P.], cksum 0x7ca6 (correct), ack 2897688008, win 182, options [nop,nop,TS val 14170 ecr 347716430], length 144
    19:24:49.486435 IP (tos 0x0, ttl 64, id 42332, offset 0, flags [DF], proto TCP (6), length 150)
        10.2.2.3.48960 > mqtt-shv-06-ash2.facebook.com.https: Flags [P.], cksum 0x03c5 (correct), ack 1, win 182, options [nop,nop,TS val 14171 ecr 347716430], length 98
    19:24:49.494913 IP (tos 0x0, ttl 82, id 43570, offset 0, flags [DF], proto TCP (6), length 52)
        mqtt-shv-06-ash2.facebook.com.https > 10.2.2.3.48960: Flags [.], cksum 0xaf9c (correct), ack 144, win 88, options [nop,nop,TS val 347829623 ecr 14170], length 0
    19:24:49.495863 IP (tos 0x0, ttl 82, id 43571, offset 0, flags [DF], proto TCP (6), length 87)
        mqtt-shv-06-ash2.facebook.com.https > 10.2.2.3.48960: Flags [P.], cksum 0x7820 (correct), ack 144, win 88, options [nop,nop,TS val 347829623 ecr 14170], length 35
    19:24:49.502929 IP (tos 0x0, ttl 82, id 43572, offset 0, flags [DF], proto TCP (6), length 52)
        mqtt-shv-06-ash2.facebook.com.https > 10.2.2.3.48960: Flags [.], cksum 0xaf0e (correct), ack 242, win 88, options [nop,nop,TS val 347829631 ecr 14171], length 0
    19:24:49.503065 IP (tos 0x0, ttl 82, id 43573, offset 0, flags [DF], proto TCP (6), length 81)
        mqtt-shv-06-ash2.facebook.com.https > 10.2.2.3.48960: Flags [P.], cksum 0x2da6 (correct), ack 242, win 88, options [nop,nop,TS val 347829631 ecr 14171], length 29
    19:24:49.517473 IP (tos 0x0, ttl 64, id 42333, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.48960 > mqtt-shv-06-ash2.facebook.com.https: Flags [.], cksum 0xaeb6 (correct), ack 36, win 182, options [nop,nop,TS val 14173 ecr 347829623], length 0
    19:24:49.518231 IP (tos 0x0, ttl 64, id 42334, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.48960 > mqtt-shv-06-ash2.facebook.com.https: Flags [.], cksum 0xae8f (correct), ack 65, win 182, options [nop,nop,TS val 14175 ecr 347829631], length 0
    19:24:49.659240 IP (tos 0x0, ttl 82, id 43574, offset 0, flags [DF], proto TCP (6), length 445)
        mqtt-shv-06-ash2.facebook.com.https > 10.2.2.3.48960: Flags [P.], cksum 0xae03 (correct), ack 242, win 88, options [nop,nop,TS val 347829786 ecr 14175], length 393
    19:24:49.683048 IP (tos 0x0, ttl 64, id 42335, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.48960 > mqtt-shv-06-ash2.facebook.com.https: Flags [.], cksum 0xac44 (correct), ack 458, win 205, options [nop,nop,TS val 14191 ecr 347829786], length 0
    19:24:49.717604 IP (tos 0x0, ttl 64, id 7006, offset 0, flags [DF], proto TCP (6), length 1002)
        10.2.2.3.46409 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xda8f (correct), ack 1559295382, win 138, options [nop,nop,TS val 14195 ecr 93878804], length 950
    19:24:49.717991 IP (tos 0x0, ttl 64, id 7007, offset 0, flags [DF], proto TCP (6), length 82)
        10.2.2.3.46409 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xdb91 (correct), ack 1, win 138, options [nop,nop,TS val 14195 ecr 93878804], length 30
    19:24:49.729155 IP (tos 0x0, ttl 87, id 35163, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46409: Flags [.], cksum 0x4a46 (correct), ack 950, win 106, options [nop,nop,TS val 93958676 ecr 14195], length 0
    19:24:49.730483 IP (tos 0x0, ttl 87, id 35164, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46409: Flags [.], cksum 0x4a28 (correct), ack 980, win 106, options [nop,nop,TS val 93958676 ecr 14195], length 0
    19:24:49.784652 IP (tos 0x0, ttl 64, id 5237, offset 0, flags [DF], proto TCP (6), length 799)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x9df6 (correct), ack 2549633465, win 409, options [nop,nop,TS val 14201 ecr 2350792143], length 747
    19:24:49.787649 IP (tos 0x0, ttl 64, id 5238, offset 0, flags [DF], proto TCP (6), length 1197)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xf7be (correct), ack 1, win 409, options [nop,nop,TS val 14201 ecr 2350792143], length 1145
    19:24:49.798987 IP (tos 0x0, ttl 87, id 11324, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xc29a (correct), ack 747, win 140, options [nop,nop,TS val 2350905588 ecr 14201], length 0
    19:24:49.801371 IP (tos 0x0, ttl 87, id 11325, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xbe10 (correct), ack 1892, win 152, options [nop,nop,TS val 2350905593 ecr 14201], length 0
    19:24:49.821315 IP (tos 0x0, ttl 87, id 35165, offset 0, flags [DF], proto TCP (6), length 776)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46409: Flags [P.], cksum 0x69f4 (correct), ack 980, win 106, options [nop,nop,TS val 93958768 ecr 14195], length 724
    19:24:49.845412 IP (tos 0x0, ttl 64, id 5239, offset 0, flags [DF], proto TCP (6), length 79)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x1175 (correct), ack 1, win 409, options [nop,nop,TS val 14201 ecr 2350792143], length 27
    19:24:49.845484 IP (tos 0x0, ttl 64, id 5240, offset 0, flags [DF], proto TCP (6), length 82)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x7cc1 (correct), ack 1, win 409, options [nop,nop,TS val 14201 ecr 2350792143], length 30
    19:24:49.846108 IP (tos 0x0, ttl 64, id 7008, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46409 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x46bd (correct), ack 725, win 153, options [nop,nop,TS val 14207 ecr 93958768], length 0
    19:24:49.859069 IP (tos 0x0, ttl 87, id 11326, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xbdbc (correct), ack 1919, win 152, options [nop,nop,TS val 2350905650 ecr 14201], length 0
    19:24:49.859198 IP (tos 0x0, ttl 87, id 11327, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xbd9e (correct), ack 1949, win 152, options [nop,nop,TS val 2350905650 ecr 14201], length 0
    19:24:49.946528 IP (tos 0x0, ttl 64, id 32598, offset 0, flags [DF], proto TCP (6), length 780)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x3bb2 (correct), ack 3710602505, win 226, options [nop,nop,TS val 14217 ecr 2350825951], length 728
    19:24:49.946573 IP (tos 0x0, ttl 64, id 32599, offset 0, flags [DF], proto TCP (6), length 334)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xc2fc (correct), ack 1, win 226, options [nop,nop,TS val 14217 ecr 2350825951], length 282
    19:24:49.947410 IP (tos 0x0, ttl 64, id 32600, offset 0, flags [DF], proto TCP (6), length 79)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x1049 (correct), ack 1, win 226, options [nop,nop,TS val 14217 ecr 2350825951], length 27
    19:24:49.947440 IP (tos 0x0, ttl 64, id 32601, offset 0, flags [DF], proto TCP (6), length 82)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x1a46 (correct), ack 1, win 226, options [nop,nop,TS val 14217 ecr 2350825951], length 30
    19:24:49.969621 IP (tos 0x0, ttl 87, id 8756, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x6a4c (correct), ack 728, win 186, options [nop,nop,TS val 2350905750 ecr 14217], length 0
    19:24:49.969643 IP (tos 0x0, ttl 87, id 8757, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x6927 (correct), ack 1010, win 197, options [nop,nop,TS val 2350905750 ecr 14217], length 0
    19:24:49.970507 IP (tos 0x0, ttl 87, id 8758, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x690c (correct), ack 1037, win 197, options [nop,nop,TS val 2350905750 ecr 14217], length 0
    19:24:49.970530 IP (tos 0x0, ttl 87, id 8759, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x68ee (correct), ack 1067, win 197, options [nop,nop,TS val 2350905750 ecr 14217], length 0
    19:24:50.040823 IP (tos 0x0, ttl 87, id 8760, offset 0, flags [DF], proto TCP (6), length 563)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [P.], cksum 0xe968 (correct), ack 1067, win 197, options [nop,nop,TS val 2350905832 ecr 14217], length 511
    19:24:50.046800 IP (tos 0x0, ttl 64, id 32602, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x666a (correct), ack 512, win 238, options [nop,nop,TS val 14227 ecr 2350905832], length 0
    19:24:50.785449 IP (tos 0x0, ttl 87, id 11328, offset 0, flags [DF], proto TCP (6), length 1500)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0x0369 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906576 ecr 14201], length 1448
    19:24:50.785477 IP (tos 0x0, ttl 87, id 11329, offset 0, flags [DF], proto TCP (6), length 205)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0x9a0e (correct), ack 1949, win 152, options [nop,nop,TS val 2350906576 ecr 14201], length 153
    19:24:50.785740 IP (tos 0x0, ttl 87, id 11330, offset 0, flags [DF], proto TCP (6), length 1500)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xbc03 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906577 ecr 14201], length 1448
    19:24:50.785778 IP (tos 0x0, ttl 87, id 11331, offset 0, flags [DF], proto TCP (6), length 1206)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0x692f (correct), ack 1949, win 152, options [nop,nop,TS val 2350906577 ecr 14201], length 1154
    19:24:50.785799 IP (tos 0x0, ttl 87, id 11332, offset 0, flags [DF], proto TCP (6), length 566)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0xdab1 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906577 ecr 14201], length 514
    19:24:50.786024 IP (tos 0x0, ttl 87, id 11333, offset 0, flags [DF], proto TCP (6), length 1500)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0xb864 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906577 ecr 14201], length 1448
    19:24:50.786167 IP (tos 0x0, ttl 87, id 11334, offset 0, flags [DF], proto TCP (6), length 414)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0xf2a0 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906577 ecr 14201], length 362
    19:24:50.839890 IP (tos 0x0, ttl 87, id 11335, offset 0, flags [DF], proto TCP (6), length 121)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0xe427 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906631 ecr 14201], length 69
    19:24:50.840156 IP (tos 0x0, ttl 87, id 11336, offset 0, flags [DF], proto TCP (6), length 97)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0x0948 (correct), ack 1949, win 152, options [nop,nop,TS val 2350906632 ecr 14201], length 45
    19:24:50.849521 IP (tos 0x0, ttl 64, id 5241, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xb2d6 (correct), ack 1449, win 431, options [nop,nop,TS val 14308 ecr 2350906576], length 0
    19:24:50.850451 IP (tos 0x0, ttl 64, id 5242, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xb226 (correct), ack 1602, win 454, options [nop,nop,TS val 14308 ecr 2350906576], length 0
    19:24:50.850895 IP (tos 0x0, ttl 64, id 5243, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xac66 (correct), ack 3050, win 477, options [nop,nop,TS val 14308 ecr 2350906577], length 0
    19:24:50.850936 IP (tos 0x0, ttl 64, id 5244, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xa7ce (correct), ack 4204, win 499, options [nop,nop,TS val 14308 ecr 2350906577], length 0
    19:24:50.851408 IP (tos 0x0, ttl 64, id 5245, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xa5b5 (correct), ack 4718, win 522, options [nop,nop,TS val 14308 ecr 2350906577], length 0
    19:24:50.851757 IP (tos 0x0, ttl 64, id 5246, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x9ff7 (correct), ack 6166, win 544, options [nop,nop,TS val 14308 ecr 2350906577], length 0
    19:24:50.852203 IP (tos 0x0, ttl 64, id 5247, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x9e76 (correct), ack 6528, win 567, options [nop,nop,TS val 14308 ecr 2350906577], length 0
    19:24:50.853170 IP (tos 0x0, ttl 64, id 5248, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x9dfb (correct), ack 6597, win 567, options [nop,nop,TS val 14308 ecr 2350906631], length 0
    19:24:50.853208 IP (tos 0x0, ttl 64, id 5249, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x9dcd (correct), ack 6642, win 567, options [nop,nop,TS val 14308 ecr 2350906632], length 0
    19:24:51.245236 IP (tos 0x0, ttl 64, id 5250, offset 0, flags [DF], proto TCP (6), length 799)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xfb79 (correct), ack 6642, win 567, options [nop,nop,TS val 14340 ecr 2350906632], length 747
    19:24:51.245300 IP (tos 0x0, ttl 64, id 5251, offset 0, flags [DF], proto TCP (6), length 467)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x8be3 (correct), ack 6642, win 567, options [nop,nop,TS val 14340 ecr 2350906632], length 415
    19:24:51.245313 IP (tos 0x0, ttl 64, id 5252, offset 0, flags [DF], proto TCP (6), length 79)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x39e1 (correct), ack 6642, win 567, options [nop,nop,TS val 14340 ecr 2350906632], length 27
    19:24:51.245323 IP (tos 0x0, ttl 64, id 5253, offset 0, flags [DF], proto TCP (6), length 82)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x1c3b (correct), ack 6642, win 567, options [nop,nop,TS val 14340 ecr 2350906632], length 30
    19:24:51.259714 IP (tos 0x0, ttl 87, id 11337, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0x9ab3 (correct), ack 2696, win 163, options [nop,nop,TS val 2350907051 ecr 14340], length 0
    19:24:51.259740 IP (tos 0x0, ttl 87, id 11338, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0x9909 (correct), ack 3111, win 174, options [nop,nop,TS val 2350907051 ecr 14340], length 0
    19:24:51.259750 IP (tos 0x0, ttl 87, id 11339, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0x98ee (correct), ack 3138, win 174, options [nop,nop,TS val 2350907051 ecr 14340], length 0
    19:24:51.259758 IP (tos 0x0, ttl 87, id 11340, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [.], cksum 0x98d0 (correct), ack 3168, win 174, options [nop,nop,TS val 2350907051 ecr 14340], length 0
    19:24:51.360841 IP (tos 0x0, ttl 87, id 11341, offset 0, flags [DF], proto TCP (6), length 688)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46403: Flags [P.], cksum 0xfd7a (correct), ack 3168, win 174, options [nop,nop,TS val 2350907151 ecr 14340], length 636
    19:24:51.383107 IP (tos 0x0, ttl 64, id 5254, offset 0, flags [DF], proto TCP (6), length 52)
        10.2.2.3.46403 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0x943c (correct), ack 7278, win 590, options [nop,nop,TS val 14360 ecr 2350907151], length 0
    19:24:51.882232 IP (tos 0x0, ttl 64, id 32603, offset 0, flags [DF], proto TCP (6), length 541)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xb986 (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 489
    19:24:51.883867 IP (tos 0x0, ttl 64, id 32604, offset 0, flags [DF], proto TCP (6), length 1500)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [.], cksum 0xccd3 (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 1448
    19:24:51.883912 IP (tos 0x0, ttl 64, id 32605, offset 0, flags [DF], proto TCP (6), length 175)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0xb349 (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 123
    19:24:51.884651 IP (tos 0x0, ttl 64, id 32606, offset 0, flags [DF], proto TCP (6), length 589)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x52e0 (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 537
    19:24:51.884691 IP (tos 0x0, ttl 64, id 32607, offset 0, flags [DF], proto TCP (6), length 163)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x926f (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 111
    19:24:51.884712 IP (tos 0x0, ttl 64, id 32608, offset 0, flags [DF], proto TCP (6), length 82)
        10.2.2.3.46402 > edge-star-shv-07-lga1.facebook.com.https: Flags [P.], cksum 0x97ba (correct), ack 512, win 238, options [nop,nop,TS val 14410 ecr 2350905832], length 30
    19:24:51.903093 IP (tos 0x0, ttl 87, id 8761, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x5ca0 (correct), ack 1556, win 208, options [nop,nop,TS val 2350907696 ecr 14410], length 0
    19:24:51.903365 IP (tos 0x0, ttl 87, id 8762, offset 0, flags [DF], proto TCP (6), length 64)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x1ea0 (correct), ack 1556, win 208, options [nop,nop,TS val 2350907696 ecr 14410,nop,nop,sack 1 {3004:3127}], length 0
    19:24:51.903376 IP (tos 0x0, ttl 87, id 8763, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x5671 (correct), ack 3127, win 220, options [nop,nop,TS val 2350907696 ecr 14410], length 0
    19:24:51.903385 IP (tos 0x0, ttl 87, id 8764, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x544d (correct), ack 3664, win 231, options [nop,nop,TS val 2350907696 ecr 14410], length 0
    19:24:51.903394 IP (tos 0x0, ttl 87, id 8765, offset 0, flags [DF], proto TCP (6), length 52)
        edge-star-shv-07-lga1.facebook.com.https > 10.2.2.3.46402: Flags [.], cksum 0x53de (correct), ack 3775, win 231, options [nop,nop,TS val 2350907696 ecr 14410], length 0


  • Netgate Administrator

    So 10.2.2.3 is your GS5?
    What options did you use to capture that?

    Steve


Log in to reply