Firewall rule schedule problem



  • Hi. I'm a newbie on both "firewalls" and on this forum. I configured the firewall to successfully block "supercell" (CoC/Clash Royale) through their used port (9339). Normally, the rules are:

    • Always block port 9339
    • Pass port 9339 on certain times (schedule)

    The configurations work, but if we try to launch the game on a "pass schedule", it is able to connect like it's supposed to, but if the schedule expires and the block rule is supposed to take effect, the game won't get disconnected. The user can only get disconnected from the game if he restarts it. How can I configure the firewall to block existing connections to the game? Thanks



  • By default pfSense kills states that are based on a scheduled pass-rule. But this behaviour can be disabled by checking "Schedule States" in System > Advanced > Miscellaneous
    Check if this option is set.



  • Thanks. ^^ It would seem to solve the problem but apparently, the option is unchecked (w/c means existing connections should be killed on schedule timeout, right?). What could be the problem?

    PS. I'm still just a student aha


  • Netgate

    @gbreadman:

    • Always block port 9339
    • Pass port 9339 on certain times (schedule)

    I'm concerned for your firewall rule ordering. Those two you posted are backwards.

    Maybe post a screenshot of this interface's rules?



  • Sorry, the way I enumerated them was wrong but I'm pretty sure the rule hierarchy is correct. It goes like this:

    • Anti lockout rule
    • Allow port 9339 on schedule 'Testsched'
    • Block port 9339

    Also, I have almost same configuration for Facebook but I'm blocking the IPs instead of port.
    You can connect to FB if schedule is open but once it's up, you get disconnected as you're supposed to.
    Unfortunately, this doesn't happen for blocking the games.

    Thanks for your replies :)



  • If you can grab and post screenshots of the rules, it helps, because when you say "port" do you mean destination port or source port?  Make a lot of difference in a rule.

    You've verified that the game traffic is truly using port 9339 as either source or destination port?



  • I'm only using 9339 on both blocking and passing the destination ports.
    Also, I've already mentioned that the rules are actually working, except for the part that existing sessions should stop should the schedule take effect.




  • Ok, but you also say that trying to create new sessions  "fail correctly" during the block period, yes?

    That goes to the second part of what I asked, about verifying the game traffic is actually using the ports in the rules.  A simple packet capture would let you figure out if 9339 is really only used for control channels/initial setup and the actual game traffic is on a different set of ports.



  • Ah I see.. that might be causing the prob. Now, to avoid further probs I might encounter for misled researching, can I just ask you how to do the packet capturing you're suggesting? Many thanks :3


  • Netgate

    Diagnostics > Packet Capture



  • Will look into it once our supervisor puts the WAN interface back up lol. thanks :)



  • Interface: LAN
    Address Family: IPv4 only
    Protocol: TCP
    Host: 192.168.1.199 *device's IP
    Port: –-

    Capture started while port 9339 is blocked and device is trying to connect to game
    For about a minute, I disabled the block rule.
    Device was able to connect to the game and play.
    After about a minute, I enabled the rule again..

    This was the log:

    09:25:16.993856 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 128
    09:25:20.403165 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:20.667080 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:20.731803 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:20.732145 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
    09:25:21.543655 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:21.828517 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:21.828755 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:21.860160 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:21.860746 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
    09:25:21.860757 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:22.166328 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:22.268155 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:22.268353 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 6
    09:25:23.033505 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 30
    09:25:23.179947 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:23.181569 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:23.379497 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:23.381409 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 64
    09:25:23.382581 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 6
    09:25:23.672232 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:23.672462 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:23.701759 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:23.711626 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:25.883305 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
    09:25:26.131864 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:26.132089 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:26.160957 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:27.247733 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:27.285708 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:29.075628 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:29.128908 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:30.893281 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
    09:25:31.573455 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
    09:25:32.731701 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:32.815361 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:32.883947 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
    09:25:35.583508 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 23
    09:25:35.871593 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 23
    09:25:35.887271 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:35.887708 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:36.533207 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:36.635159 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 94
    09:25:36.682637 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:36.827553 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:36.829435 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:36.829817 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:37.453322 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:38.561181 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 94
    09:25:38.652198 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:38.652727 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:38.947430 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:38.949011 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:38.949436 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:39.563316 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:40.016269 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 144
    09:25:40.085760 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 0
    09:25:40.763443 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:41.050306 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:41.109918 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:41.110295 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:41.394743 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:41.422426 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:41.423006 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:41.423018 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:42.033298 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:42.276564 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:42.338977 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:42.339393 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28
    09:25:42.943384 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:43.188928 IP 54.160.213.64.9339 > 192.168.1.199.43625: tcp 0
    09:25:43.260037 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 36
    09:25:43.260397 IP 192.168.1.199.43625 > 54.160.213.64.9339: tcp 28



  • This part of the log looks like it covers about 30 seconds.  What part of the test does it correspond to?  During the minute when the rule was disabled?
    Regardless, this is showing that the dest port is 9339, traffic is TCP. 
    Hmm.
    Just to make sure, the screenshot of the rules you posted earlier, they were on the LAN or FLOATING tab, yes?

    When the traffic should be stopped (created when the rule allows it, the block rule comes into play at the scheduled time), have you done a "clear states" (should be under the Diagnostics tab)?  That would  tell us that in general the rules are "working" but the states are not getting flushed for the established session which is why the traffic still passes.  I know this is covered by the first reply to your original post, but want to cover all the bases.  You could also see what happens if you go back to that reply and just change the state of that option (if it's checked, clear it, if it's unchecked, check it).

    I'm running out of ideas.



  • Oops, sorry bout the info, but that's the whole disable-enable process (my time estimation is bad lol).
    So we tested it again and tried to check or uncheck the state killing option but still the same, like it's on the non-default option.
    We used two devices this time; one connected before block applies and is still connected when block took place, while the other connected after the block but was unable to. (so rules are working)

    .the rules are on the LAN tab ONLY and not on FLOATING. Idk what floating tab is for and haven't configured anything there. Does that matter?

    Thanks



  • So we tested it AGAIN, after i re-read mer's reply about the state reset…
    Allow port 9339 from 9:00-9:15, device was able to connect..

    I went to the reset states tab at about 9:14+ and before I even get to click reset, the device lost connection at 9:15; so it's working properly now..

    BUT I DIDN'T CHANGE A THING. I'm losing my mind. xD

    Anyway maybe we'll just let it like this since it's not really a big flaw...

    THANKS for helping! ^^


  • Netgate

    Capture started while port 9339 is blocked and device is trying to connect to game
    For about a minute, I disabled the block rule.
    Device was able to connect to the game and play.
    After about a minute, I enabled the rule again..

    That looks like a flawed test.

    Enabling a block rule will not kill existing states.

    You need to test by letting the scheduled pass rule actually expire which will walk through the states created by the scheduled rule and kill them.



  • Haha sorry.. Altho the only thing it'll change is that we get to see what happens to the states on schedule timeout, but it won't change the fact that the problem is there.

    But I will try it later. Might give us some good clues.. thanks.



  • So here it is:

    Interface: LAN
    Address Family: any
    Protocol: any
    Host address: 192.168.1.109
    Port: –-
    Count: 0

    The device got disconnected only when the internet went unstable.
    It should've been disconnected by 13:31  (Rule allows from 13:00-13:30)
    Later, (still connected to game) we switched to a different same port game; Clash Royale, but were unable to connect.
    We tried to go back to CoC but we can't. (Means blocking is working)

    13:26:43.179683 IP 192.168.1.109.6422 > 192.168.1.1.53: UDP, length 36
    13:26:43.870029 IP 192.168.1.109.1145 > 192.168.1.1.53: UDP, length 39
    13:26:45.420404 IP 192.168.1.109.29953 > 192.168.1.1.53: UDP, length 40
    13:26:47.569525 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
    13:26:48.179779 IP 192.168.1.109.22284 > 192.168.1.1.53: UDP, length 48
    13:26:48.869570 IP 192.168.1.109.36500 > 192.168.1.1.53: UDP, length 51
    13:26:48.869974 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
    13:26:48.869981 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
    13:26:49.339988 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 31
    13:26:50.429466 IP 192.168.1.109.37798 > 192.168.1.1.53: UDP, length 52
    13:26:53.189657 IP 192.168.1.109.22284 > 192.168.1.1.53: UDP, length 48
    13:26:53.879517 IP 192.168.1.109.36500 > 192.168.1.1.53: UDP, length 51
    13:26:55.439420 IP 192.168.1.109.37798 > 192.168.1.1.53: UDP, length 52
    13:26:56.609403 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 31
    13:26:56.620798 IP 192.168.1.109.1402 > 192.168.1.1.53: UDP, length 40
    13:26:56.621987 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:26:57.639433 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:26:59.388479 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
    13:26:59.388640 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 0
    13:26:59.429814 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
    13:26:59.430999 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:26:59.431432 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:26:59.618889 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:26:59.983428 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 0
    13:27:00.095947 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:27:00.440254 IP 192.168.1.109.52525 > 192.168.1.1.53: UDP, length 52
    13:27:00.695441 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
    13:27:00.712425 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:27:00.712908 IP 122.52.230.73 > 192.168.1.109: ICMP net 173.252.88.78 unreachable, length 48
    13:27:01.630014 IP 192.168.1.109.1402 > 192.168.1.1.53: UDP, length 40
    13:27:02.121271 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
    13:27:02.144149 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:27:03.650202 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:27:04.909571 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
    13:27:04.973689 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
    13:27:04.975380 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:27:05.309911 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
    13:27:05.429461 IP 192.168.1.109.52525 > 192.168.1.1.53: UDP, length 52
    13:27:05.711443 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
    13:27:05.889050 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
    13:27:05.900797 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
    13:27:06.119721 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
    13:27:06.234127 IP 192.168.1.1.53 > 192.168.1.109.36500: UDP, length 126
    13:27:06.235514 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 36500 unreachable, length 162
    13:27:06.289578 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
    13:27:06.303036 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
    13:27:06.506892 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
    13:27:06.632150 IP 192.168.1.109.57885 > 192.168.1.1.53: UDP, length 52
    13:27:06.709889 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
    13:27:06.710592 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
    13:27:06.889030 ARP, Request who-has 192.168.1.106 tell 192.168.1.109, length 46
    13:27:06.898921 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
    13:27:06.932628 IP 192.168.1.1.53 > 192.168.1.109.57885: UDP, length 127
    13:27:07.099067 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
    13:27:07.310486 ARP, Request who-has 192.168.1.108 tell 192.168.1.109, length 46
    13:27:07.310984 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
    13:27:07.501463 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
    13:27:07.583254 IP 192.168.1.1.53 > 192.168.1.109.37798: UDP, length 127
    13:27:07.585120 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 37798 unreachable, length 163
    13:27:07.689296 ARP, Request who-has 192.168.1.110 tell 192.168.1.109, length 46
    13:27:07.698784 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
    13:27:07.921374 ARP, Request who-has 192.168.1.111 tell 192.168.1.109, length 46
    13:27:08.099251 ARP, Request who-has 192.168.1.112 tell 192.168.1.109, length 46
    13:27:08.329468 ARP, Request who-has 192.168.1.113 tell 192.168.1.109, length 46
    13:27:08.377281 IP 192.168.1.1.53 > 192.168.1.109.1402: UDP, length 203
    13:27:08.386277 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1402 unreachable, length 239
    13:27:08.502359 ARP, Request who-has 192.168.1.114 tell 192.168.1.109, length 46
    13:27:08.719626 ARP, Request who-has 192.168.1.115 tell 192.168.1.109, length 46
    13:27:09.549993 IP 192.168.1.109.36393 > 54.223.95.195.443: tcp 31
    13:27:09.550010 IP 192.168.1.109.36393 > 54.223.95.195.443: tcp 0
    13:27:09.885701 IP 192.168.1.1.53 > 192.168.1.109.1145: UDP, length 167
    13:27:09.887697 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1145 unreachable, length 203
    13:27:09.991491 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
    13:27:09.991499 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
    13:27:10.436895 IP 192.168.1.109.58230 > 192.168.1.1.53: UDP, length 40
    13:27:10.669835 IP 173.252.88.78.443 > 192.168.1.109.33423: tcp 31
    13:27:10.746094 IP 192.168.1.109.33423 > 173.252.88.78.443: tcp 0
    13:27:10.776154 IP 192.168.1.1.53 > 192.168.1.109.1402: UDP, length 203
    13:27:10.777728 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1402 unreachable, length 239
    13:27:11.450983 IP 192.168.1.1.53 > 192.168.1.109.58230: UDP, length 306
    13:27:11.451000 IP 192.168.1.1.53 > 192.168.1.109.29953: UDP, length 306
    13:27:11.565083 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 29953 unreachable, length 342
    13:27:11.568718 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:11.649047 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:27:11.686645 IP 192.168.1.1.53 > 192.168.1.109.6422: UDP, length 217
    13:27:11.688808 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 6422 unreachable, length 253
    13:27:12.579441 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:13.344531 IP 192.168.1.1.53 > 192.168.1.109.6422: UDP, length 217
    13:27:13.409288 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 6422 unreachable, length 253
    13:27:13.593701 IP 192.168.1.1.53 > 192.168.1.109.1145: UDP, length 167
    13:27:13.595279 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 1145 unreachable, length 203
    13:27:14.579413 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:14.795745 IP 192.168.1.1.53 > 192.168.1.109.29953: UDP, length 306
    13:27:14.841740 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 29953 unreachable, length 342
    13:27:14.854959 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:14.856512 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:14.885043 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
    13:27:15.765848 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
    13:27:15.920074 IP 192.168.1.1.53 > 192.168.1.109.22284: UDP, length 123
    13:27:15.923962 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 22284 unreachable, length 159
    13:27:16.191173 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:16.275256 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:17.499489 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 79
    13:27:17.765378 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:17.765481 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 35
    13:27:17.812568 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:17.872259 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 368
    13:27:18.769490 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 368
    13:27:19.061633 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 286
    13:27:19.075574 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.076130 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.077506 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.077949 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.080131 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.080252 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.086680 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.087135 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.087201 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 692
    13:27:19.096635 IP 192.168.1.1.53 > 192.168.1.109.52525: UDP, length 127
    13:27:19.143457 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144207 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144218 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144228 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144564 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144575 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.144987 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.145453 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.145464 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.145741 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.145921 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 52525 unreachable, length 163
    13:27:19.193781 IP 192.168.1.109.20455 > 192.168.1.1.53: UDP, length 39
    13:27:19.193880 IP 192.168.1.1.53 > 192.168.1.109.20455: UDP, length 167
    13:27:19.198721 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:19.266178 IP 192.168.1.109.19159 > 192.168.1.1.53: UDP, length 44
    13:27:19.426108 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.426295 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.426428 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.428493 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.428661 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.430981 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 847
    13:27:19.437613 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.437733 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.437856 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.437980 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.439827 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.439947 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.445729 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.446284 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.446428 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.448233 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.448353 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.450803 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.451443 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.451828 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.454932 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.454944 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.454953 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.454963 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455802 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455813 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455823 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455832 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455842 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455851 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.455861 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456009 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456246 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456257 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456267 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456519 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.456610 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.456632 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.457109 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.458493 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.459080 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:19.461005 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:19.464620 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 228
    13:27:19.521022 IP 192.168.1.1.53 > 192.168.1.109.19159: UDP, length 84
    13:27:19.524707 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:19.712308 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.714357 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.726517 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.727089 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.727211 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.727333 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.727456 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.729081 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.729178 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.729500 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.730811 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.731251 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.731262 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.731422 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.731596 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.733315 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.738340 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.738460 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.738837 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.738988 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.740658 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.740912 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.741064 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.741142 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.742064 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.742076 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.742690 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.743280 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.747894 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.748754 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.748926 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.749049 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.750798 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.750918 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.751764 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.752656 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.752667 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.754854 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.755752 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.755770 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.757229 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.757670 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1440
    13:27:19.757911 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1215
    13:27:19.760164 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.760632 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:19.760943 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:20.289259 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 228
    13:27:20.540716 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:20.554539 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:20.557370 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 1440
    13:27:20.559114 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 1440
    13:27:20.559186 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 63
    13:27:20.559275 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:20.560992 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:20.561422 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:20.612911 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 126
    13:27:20.900040 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 242
    13:27:20.986025 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:20.989487 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
    13:27:20.990450 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1448
    13:27:20.991560 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1448
    13:27:21.000459 IP 122.52.230.73 > 192.168.1.109: ICMP 54.235.110.82 unreachable - need to frag (mtu 1492), length 556
    13:27:21.000704 IP 122.52.230.73 > 192.168.1.109: ICMP 54.235.110.82 unreachable - need to frag (mtu 1492), length 556
    13:27:21.002604 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:21.002821 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:21.137163 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 1215
    13:27:21.139053 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:21.281919 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:21.285328 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:21.534092 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:21.601827 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:21.778989 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
    13:27:21.867366 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:22.519690 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:22.694142 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
    13:27:22.696979 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:22.698313 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 517
    13:27:22.885729 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
    13:27:22.885912 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 158
    13:27:22.887638 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:22.891890 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 51
    13:27:22.917976 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 1418
    13:27:22.999958 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 117
    13:27:23.001574 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:23.068504 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 57
    13:27:23.068732 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 45
    13:27:23.070360 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 796
    13:27:23.108649 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:23.153251 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
    13:27:23.168562 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 35
    13:27:23.241857 IP 74.125.23.188.5228 > 192.168.1.109.33542: tcp 33
    13:27:23.243288 IP 192.168.1.109.33542 > 74.125.23.188.5228: tcp 0
    13:27:23.255976 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
    13:27:23.310008 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 263
    13:27:23.310575 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 523
    13:27:23.311711 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:23.312313 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:23.312392 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 37
    13:27:23.312421 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 41
    13:27:23.313599 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:23.313868 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 0
    13:27:23.368943 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 331
    13:27:23.375743 IP 192.168.1.109.40100 > 216.58.221.142.443: tcp 41
    13:27:23.617441 IP 216.58.221.142.443 > 192.168.1.109.40100: tcp 0
    13:27:23.617959 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:23.650650 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:23.650837 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:23.889689 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:23.892135 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:23.956715 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:23.957087 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:23.957528 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:23.957540 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:24.212922 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.215616 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.235821 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.236072 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.264930 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:24.265145 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:24.266096 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:24.505860 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.505878 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.526477 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.569698 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:24.570537 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:24.570838 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:24.800785 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.821245 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.821473 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:24.878315 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:24.878556 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:24.879629 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1440
    13:27:24.879641 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 8
    13:27:25.149920 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.152125 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.173066 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.173082 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.173541 IP 192.168.1.1.53 > 192.168.1.109.36500: UDP, length 126
    13:27:25.184704 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 1155
    13:27:25.184844 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 36500 unreachable, length 162
    13:27:25.370756 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
    13:27:25.470694 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.472460 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 211
    13:27:25.472670 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 31
    13:27:25.493270 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 31
    13:27:25.493763 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:25.638988 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:27:25.640702 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:25.758756 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:25.760372 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:26.239179 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
    13:27:26.481844 IP 54.235.110.82.443 > 192.168.1.109.52611: tcp 0
    13:27:26.514979 IP 192.168.1.109.52611 > 54.235.110.82.443: tcp 0
    13:27:26.569967 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:26.571310 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
    13:27:26.575886 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 517
    13:27:26.622525 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:27:26.624229 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:26.660742 IP 192.168.1.1.53 > 192.168.1.109.37798: UDP, length 127
    13:27:26.662460 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 37798 unreachable, length 163
    13:27:26.813553 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:26.813696 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 137
    13:27:26.815068 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
    13:27:26.815914 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 51
    13:27:26.817658 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:26.818254 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:26.818833 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:26.822941 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:27.082761 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:27.084559 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 944
    13:27:27.142147 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:27.372769 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:27.729628 IP 192.168.1.109.37719 > 173.252.88.78.443: tcp 0
    13:27:28.089236 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:28.129190 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:28.390550 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:28.402127 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:28.439839 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 171
    13:27:28.442134 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 1440
    13:27:28.705946 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:28.728342 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 0
    13:27:28.730127 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 211
    13:27:28.730138 IP 54.235.110.82.443 > 192.168.1.109.39468: tcp 31
    13:27:28.770736 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 31
    13:27:28.771120 IP 192.168.1.109.39468 > 54.235.110.82.443: tcp 0
    13:27:28.810542 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:29.073440 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:29.314981 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:29.689185 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
    13:27:29.808762 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:30.249246 IP 192.168.1.1.53 > 192.168.1.109.22284: UDP, length 123
    13:27:30.303439 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 22284 unreachable, length 159
    13:27:30.438906 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 23
    13:27:30.445851 IP 192.168.1.1.53 > 192.168.1.109.52525: UDP, length 127
    13:27:30.447242 IP 192.168.1.109 > 192.168.1.1: ICMP 192.168.1.109 udp port 52525 unreachable, length 163
    13:27:30.710973 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:27:30.711003 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:27:30.713008 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:30.713465 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:31.428820 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:31.829416 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:32.104026 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:27:32.149419 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:32.152287 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
    13:27:32.889349 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:33.169540 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
    13:27:35.229301 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 517
    13:27:35.508493 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:27:35.509717 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
    13:27:35.511187 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:35.512284 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:27:35.514042 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 1440
    13:27:35.779347 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:36.404856 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
    13:27:36.448395 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:36.518694 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:27:37.180430 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
    13:27:37.267670 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:37.274609 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
    13:27:37.276291 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:38.569297 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:27:39.850744 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 67
    13:27:39.929909 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:40.528476 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
    13:27:40.544463 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:41.549236 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:42.619110 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:27:44.341312 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 105
    13:27:44.435231 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:45.186632 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 105
    13:27:45.253764 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:47.216178 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 137
    13:27:47.303684 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 0
    13:27:48.571188 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 116
    13:27:48.633941 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:50.561474 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 100
    13:27:50.579687 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:50.688785 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:27:53.109212 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:27:53.398794 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
    13:27:53.446772 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:57.426656 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
    13:27:57.542827 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:27:58.119079 ARP, Request who-has 192.168.1.1 tell 192.168.1.109, length 46
    13:27:58.119086 ARP, Reply 192.168.1.1 is-at 3c:4a:92:6e:2d:38, length 28
    13:28:05.490713 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 216
    13:28:05.530094 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:05.798182 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
    13:28:05.837290 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:06.594729 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
    13:28:06.656164 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:06.909109 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 51
    13:28:07.231473 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:07.270181 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:07.270538 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:07.568795 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:07.679611 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:07.680126 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:07.680139 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:07.962023 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:07.987464 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:08.386460 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 196
    13:28:08.501007 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:08.648504 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 128
    13:28:10.443210 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
    13:28:10.547611 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:10.589701 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
    13:28:10.869151 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:10.957112 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
    13:28:10.957438 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
    13:28:11.234337 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
    13:28:11.264170 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:11.939880 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 64
    13:28:12.822247 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
    13:28:12.902842 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:13.878898 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:16.005242 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 97
    13:28:16.077105 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:16.208522 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 35
    13:28:16.510312 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:16.589725 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:16.590131 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:16.810457 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 108
    13:28:16.861408 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:16.861437 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:16.896852 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:16.897514 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:16.897527 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 40
    13:28:16.902079 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:16.903532 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:17.161768 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:17.238629 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:17.568887 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:17.748733 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:17.926033 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:18.022670 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:18.025070 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.026590 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.027000 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.315084 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.330265 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:28:18.330802 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.330812 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.608033 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.610714 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.637379 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.637777 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:28:18.848592 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 64
    13:28:18.910803 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.913532 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:18.944341 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:18.944773 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:19.229397 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:19.252693 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:19.608841 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:19.886470 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:19.968997 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:19.969342 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.240543 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.242257 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.242756 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.242767 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:28:20.243017 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.515489 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.520430 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.584064 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.584399 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.872005 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.872245 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:20.889839 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:20.890628 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:21.187880 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:21.299270 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:21.458450 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:21.569177 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:28:23.489116 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:28:23.767470 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:23.859597 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:23.859894 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:24.849081 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.125523 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:25.190925 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.191241 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.469741 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:25.498114 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.499489 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.499917 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:25.588511 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 107
    13:28:25.590063 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:26.481666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:26.669921 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:27.899338 IP 192.168.1.109.47898 > 192.168.1.1.53: UDP, length 51
    13:28:28.419415 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:28.695877 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:28.776325 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:28.776753 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:29.052620 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:29.081965 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:29.082368 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:29.082380 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.020158 IP 192.168.1.1.53 > 192.168.1.109.47898: UDP, length 316
    13:28:30.079041 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.083592 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.216034 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:30.217560 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.221092 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 240
    13:28:30.359423 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:30.361094 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.361519 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.629115 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 240
    13:28:30.644498 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:30.646107 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.646598 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.646612 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:30.770086 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:30.771424 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1428
    13:28:30.772901 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1428
    13:28:30.773555 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.774339 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1240
    13:28:30.775023 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.775548 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 1126
    13:28:30.776634 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.777336 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.816362 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 126
    13:28:30.860560 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 102
    13:28:30.862103 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:30.953976 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 258
    13:28:30.957713 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:30.962653 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1448
    13:28:30.963015 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 629
    13:28:30.963653 IP 122.52.230.73 > 192.168.1.109: ICMP 54.199.191.47 unreachable - need to frag (mtu 1492), length 556
    13:28:30.966136 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1440
    13:28:30.966262 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 8
    13:28:31.094111 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:31.104223 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:31.360655 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 1440
    13:28:31.497198 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:31.499704 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 299
    13:28:31.608579 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:31.610078 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 102
    13:28:31.611483 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:31.630516 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 0
    13:28:31.637495 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 553
    13:28:31.679696 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:31.884259 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:31.950101 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:31.950391 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.250887 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.253365 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.358783 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.359272 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.359283 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.633997 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.641185 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.665884 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.666513 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.941501 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.941741 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:32.973037 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:32.973355 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:33.249492 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:33.280067 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:33.561831 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:33.587469 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:33.618371 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:33.658878 IP 54.199.191.47.443 > 192.168.1.109.59998: tcp 553
    13:28:33.660560 IP 192.168.1.109.59998 > 54.199.191.47.443: tcp 0
    13:28:33.896487 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:33.997244 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:33.997587 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:34.273689 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:34.276155 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:34.304408 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:34.304861 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:34.305051 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:34.581674 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:34.611712 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:34.889643 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:34.918624 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:35.589116 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:35.901327 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:35.943161 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:35.943600 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:36.928878 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:37.088761 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:37.205149 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:37.274094 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:37.274450 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:37.357636 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:37.358114 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:37.359796 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:37.360241 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
    13:28:37.360763 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:37.640262 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:37.642434 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:37.684281 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
    13:28:37.684707 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:37.685182 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
    13:28:38.268930 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:38.298432 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
    13:28:38.556772 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:38.605291 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:38.605942 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:39.238912 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:40.208892 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:40.478658 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:41.244345 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 96
    13:28:41.268767 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:42.162569 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 96
    13:28:42.188986 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:42.958835 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:43.238569 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:43.238590 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:43.315588 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:43.316153 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
    13:28:43.316165 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:43.959071 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
    13:28:44.078252 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:45.219502 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 4
    13:28:45.484541 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:45.569937 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:45.570326 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
    13:28:45.846963 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:45.876260 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:45.876835 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 28
    13:28:45.876847 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:46.141869 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:46.182844 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:46.449854 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:46.490178 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:46.498126 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:46.754872 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:47.778972 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:48.049090 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:48.049345 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
    13:28:48.128599 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:48.128982 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:48.129395 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:48.405626 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:48.405845 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:48.435635 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:48.436197 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
    13:28:48.436208 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:49.058798 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:50.309029 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:51.868944 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:52.139517 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:52.225871 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:52.226294 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:52.788860 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:53.055079 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:53.055633 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
    13:28:53.145067 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:53.145897 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:53.145907 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:53.188217 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.497325 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:53.556516 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.556810 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.758607 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 20
    13:28:53.830693 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:53.832505 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.832979 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.832989 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:53.833402 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:54.022366 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:54.022394 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:28:54.023896 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:54.024438 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:54.024449 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:54.648929 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:54.808305 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:54.910339 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:54.910573 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
    13:28:54.990567 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:54.991026 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:54.991037 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:55.081067 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:55.082666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:55.083051 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:55.598983 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:56.068835 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:56.306320 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 46
    13:28:56.308216 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:56.349433 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:56.351762 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:56.352132 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:56.809006 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:57.328666 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:57.604273 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:57.651505 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:57.651933 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 12
    13:28:57.841030 IP 192.168.1.109.20783 > 192.168.1.1.53: UDP, length 40
    13:28:57.859455 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:57.951072 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
    13:28:58.061030 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:58.063826 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 226
    13:28:58.079333 IP 192.168.1.1.53 > 192.168.1.109.20783: UDP, length 203
    13:28:58.136495 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 124
    13:28:58.138293 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:28:58.628854 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:58.659173 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 226
    13:28:58.777044 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
    13:28:58.779739 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 1440
    13:28:58.781398 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 1440
    13:28:58.781744 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:58.783152 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:58.783358 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 309
    13:28:58.785155 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:58.821389 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 126
    13:28:58.928574 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:58.930339 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:58.930674 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:59.208751 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:59.232346 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:28:59.233964 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:59.234561 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:28:59.234572 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:28:59.253827 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 309
    13:28:59.258198 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:59.408326 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 126
    13:28:59.493421 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 51
    13:28:59.518153 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:28:59.597327 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:28:59.598025 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:59.598357 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:28:59.605404 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 524
    13:29:00.146459 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 66
    13:29:00.189166 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 524
    13:29:00.189626 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:00.190038 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:29:00.199901 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:00.300675 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
    13:29:00.422681 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:00.456141 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:00.457604 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:00.457901 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:00.458822 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:00.461191 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 65
    13:29:00.465482 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 0
    13:29:00.465722 IP 54.158.54.184.1863 > 192.168.1.109.41460: tcp 23
    13:29:00.467195 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:00.467525 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:00.498463 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 0
    13:29:00.626026 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 189
    13:29:00.986225 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:01.019028 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
    13:29:01.020111 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:01.058309 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:01.418750 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:01.724013 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:01.747738 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:01.747873 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:02.032731 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:02.054763 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:02.055220 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:02.055664 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:02.078680 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
    13:29:02.118402 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:02.119759 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:02.258585 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:02.329881 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:02.361885 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:29:02.958843 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:04.258757 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 254
    13:29:04.346240 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
    13:29:04.348084 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 189
    13:29:04.433692 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 0
    13:29:04.500254 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:04.500483 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:04.501851 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:04.502130 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:04.658433 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:04.740379 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:05.016900 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:05.126682 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:05.126991 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:05.412834 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:05.414558 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:05.415156 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:29:05.415168 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:05.489215 IP 31.13.95.5.443 > 192.168.1.109.39282: tcp 33
    13:29:05.490638 IP 192.168.1.109.39282 > 31.13.95.5.443: tcp 0
    13:29:05.695173 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:05.696910 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:06.608855 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 20
    13:29:06.903954 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:06.970574 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:06.970895 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:07.250838 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:07.277433 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:07.277895 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:07.277906 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:07.574452 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:07.686807 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:08.609059 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:08.878190 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:08.915011 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:08.915619 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:09.191111 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:09.222748 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:09.223279 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:09.223291 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:09.489915 IP 192.168.1.109.41460 > 54.158.54.184.1863: tcp 36
    13:29:09.519500 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:09.520940 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 36
    13:29:10.449556 IP 192.168.1.109.55194 > 54.235.110.82.443: tcp 28
    13:29:10.724067 IP 54.235.110.82.443 > 192.168.1.109.55194: tcp 0
    13:29:10.758983 IP 192.168.1.109.55194


  • Netgate

    I don't see any 9339 states. What is that supposed to show?



  • @Derelict:

    I don't see any 9339 states. What is that supposed to show?

    Oh sorry. Turns out it was WAY TOO LONG so the post was cut. Guess I'll just attach the txt file. :/

    [New Text Document.txt](/public/imported_attachments/1/New Text Document.txt)


  • Netgate

    Every time I look at this, it works for me.

    I just set up a scheduled rule to pass from my workstation to an ssh host ending at 01:59.

    Established two ssh sessions to that host and started a top in each.

    Went about my business…

    Session 1:

    top - 01:59:58 up 53 days,  5:10,  5 users,  load average: 0.03, 0.06, 0.07
    Tasks: 151 total,  1 running, 150 sleeping,  0 stopped,  0 zombie
    Cpu(s):  0.2%us,  0.2%sy,  0.0%ni, 99.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
    Mem:  3875144k total,  3191288k used,  683856k free,  247136k buffers
    Swap:  4194300k total,        4k used,  4194296k free,  2473136k cached
    packet_write_wait: Connection to 172.22.81.8: Broken pipe

    Note the time, and the state cleared, connection closed.

    Session 2:

    top - 01:59:58 up 53 days,  5:10,  5 users,  load average: 0.03, 0.06, 0.07
    Tasks: 151 total,  1 running, 150 sleeping,  0 stopped,  0 zombie
    Cpu(s):  0.3%us,  0.2%sy,  0.0%ni, 99.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
    Mem:  3875144k total,  3191288k used,  683856k free,  247136k buffers
    Swap:  4194300k total,        4k used,  4194296k free,  2473136k cached
    packet_write_wait: Connection to 172.22.81.8: Broken pipe

    Note the time, and the state cleared. Connection closed.

    Every time someone says it doesn't work and I try it, it works. More details needed.



  • Hmmm I would like to apologize for having a hard time interpreting that output.
    I'm a newbie and I don't really understand what part I'm supposed to notice.
    But anyway, I think I've mentioned that IP blocking and pass rules work perfectly for Facebook, but not port blocking for the game/s.

    If it's not too much to ask, could anyone at least try the same config and test it on their device/s to see if it would work flawlessly? That would be a big help.



  • @gbreadman:

    Hmmm I would like to apologize for having a hard time interpreting that output.
    I'm a newbie and I don't really understand what part I'm supposed to notice.
    But anyway, I think I've mentioned that IP blocking and pass rules work perfectly for Facebook, but not port blocking for the game/s.

    If it's not too much to ask, could anyone at least try the same config and test it on their device/s to see if it would work flawlessly? That would be a big help.

    Derelict did a similar config, simply to another port (ssh).  What you need to notice in his output is the timestamps.  He says his pass rule end time is 01:59, the timestamp is 01:59:58 and the Broken Pipe message.  He had the pass rule running then ssh'd into a remote machine (equivalent of you starting a game session), then ran top (equivalent of you playing the game).  When the pass rule timed out at 01:59, his ssh connections were dropped, there is typically a little bit of a lag between the socket closing and the Broken Pipe message (the broken pipe is showing up as an error on the write to the socket).

    So he did exactly what you did, just used a different "game" (ssh) and different dest port.

    It would be difficult for anyone to try the same config since a proper test would require use of the same game;  google around for something like "ports used by CoC…" may give more information about what needs to be blocked.  I keep going back to your statement about "existing connections are not dropped but new connections are not allowed".  To me that starts to feel like different ports getting used.  It's possible that the game traffic may actually be on a different stream, say a multicast stream instead of unicast.

    Raw packet captures on the LAN side of the pfSense box (tcpdump or through the pfSense Web interface) tells you what is actually going through the interface, pull them off pfSense and look at them with wireshark on a different box.  It may be a little tedious, but you'll be guaranteed to "know" what traffic is there.