1 Тема от ansh

  • ansh
  • Новичок
  • Неактивен
  • Зарегистрирован: 28.06.2010
  • Сообщений: 25
  • Репутация : [ 0 | 0 ]

На CentOS поднят pptpd. Подключаюсь к VPN через Windows 7. Галка в настройках "Использовать удаленный шлюз" установлена. После подключения routetrace проходит через удаленный сервер... ping отвечает, но как  только я загружаю сайт google.com в firefox, сразу, после полной загрузки сайта, пропадает ping и инет... но при этом VPN подключение в Windows  не отключается (в настройках стоит "отключатся если нет шифрования"). Что это за чудеса такие?)

[root@srv1 ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 6C:62:6D:90:6F:2A  
          inet addr:46.X.XX.XX  Bcast:46.X.XX.XXX  Mask:255.255.255.255
          inet6 addr: fe80::6e62:6dff:fe90:6f2a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1009460 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1455503 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:300483124 (286.5 MiB)  TX bytes:1597142860 (1.4 GiB)
          Interrupt:82 Base address:0x2000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:895 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:47588 (46.4 KiB)  TX bytes:47588 (46.4 KiB)

ppp0      Link encap:Point-to-Point Protocol  
          inet addr:172.16.0.1  P-t-P:172.16.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1396  Metric:1
          RX packets:5976 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8567 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:909569 (888.2 KiB)  TX bytes:6236857 (5.9 MiB)
[root@srv1 ~]# /sbin/sysctl -e -p /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_local_port_range = 1024 65535
pptpd.conf:
#######
option    /etc/ppp/options.pptpd
debug
noipparam
logwtmp
connections 30
localip    172.16.0.1
remoteip    172.16.0.2-30

option.pptp:
lock
noauth
refuse-pap
refuse-eap
refuse-chap
refuse-mschap
nobsdcomp
nodeflate
require-mppe
require-mppe-128

option.pptpd:
name pptpd
logfile /var/log/ppp/pptpd.log
debug
lock
nobsdcomp 
novj
novjccomp
auth
proxyarp
require-mppe-128
require-mschap-v2
refuse-pap
refuse-chap
nomppe-40
refuse-mschap
require-mppe
login
mtu 1400
mru 1400

iptables:

# Generated by iptables-save v1.3.5 on Fri Dec  2 17:08:37 2011
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ppp0 -s 172.16.0.0/16 -j MASQUERADE
-A POSTROUTING -o ppp1 -s 172.16.0.0/16 -j MASQUERADE
-A POSTROUTING -o eth0 -s 172.16.0.0/16 -j MASQUERADE


COMMIT
# Completed on Fri Dec  2 17:08:37 2011
# Generated by iptables-save v1.3.5 on Fri Dec  2 17:08:37 2011
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp -i eth0 --icmp-type echo-request -j ACCEPT
# NTP
-A INPUT -p udp -m udp -i eth0 --dport 123 -j ACCEPT
-A INPUT -p udp -m udp -i eth0 --sport 123 -j ACCEPT
# DNS
-A INPUT -p udp -m udp -i eth0 --dport 53 -j ACCEPT
-A INPUT -p udp -m udp -i eth0 --sport 53 -j ACCEPT
# webmin
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
# VPN
-A INPUT -p tcp -m tcp -i eth0 --dport 1723 -j ACCEPT
-A INPUT -p gre -i eth0 -j ACCEPT
# Lotus
-A INPUT -p tcp -m tcp -i eth0 --dport 1352 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 25 -j ACCEPT
# VNC
-A INPUT -p tcp -m tcp -i eth0 --dport 5901 -j ACCEPT
# SSH
-A INPUT -p tcp -m tcp -m state -m recent --dport 22 --state NEW -j DROP  --update --seconds 15
-A INPUT -p tcp -m state -m recent --dport 22 --state NEW -j ACCEPT  --set 
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
# VPN 
-A FORWARD -m conntrack -j ACCEPT --ctstate ESTABLISHED,RELATED
-A FORWARD -s 172.16.0.0/16 -o eth0 -j ACCEPT
-A FORWARD -d 172.16.0.0/16 -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT
#-A FORWARD ! -i eth0 -j ACCEPT
#-A FORWARD ! -o eth0 -j ACCEPT
COMMIT
# Completed on Fri Dec  2 17:08:37 2011
# Generated by iptables-save v1.3.5 on Fri Dec  2 17:08:37 2011
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

COMMIT
# Completed on Fri Dec  2 17:08:37 2011

2 Ответ от verg

  • verg
  • verg
  • Пользователь
  • Неактивен
  • Зарегистрирован: 06.09.2010
  • Сообщений: 10,132
  • Репутация : [ 432 | 1 ]

ansh,
Пользуйтесь тегами оформления сообщений
verg

3 Ответ от afanasev.p

  • afanasev.p
  • Пользователь
  • Неактивен
  • Зарегистрирован: 02.10.2012
  • Сообщений: 126
  • Репутация : [ 13 | 0 ]

А логи-то, логи-то забыли?

ЗЫ: зачем в mangle пачка правил с -j ACCEPT? И зачем в *nat маскарадинг для ppp+?
ЗЫ2: чего показывает tcpdump на интерфейсах ppp+ после "падения" интернета на клиенте?

И баба с воза, и волки сыты...

4 Ответ от ansh

  • ansh
  • Новичок
  • Неактивен
  • Зарегистрирован: 28.06.2010
  • Сообщений: 25
  • Репутация : [ 0 | 0 ]

/var/log/ppp/pptpd.log:

Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded.
pptpd-logwtmp: $Version$
using channel 13
Using interface ppp0
Connect: ppp0 <--> /dev/pts/0
sent [LCP ConfReq id=0x1 <mru 1400> <asyncmap 0x0> <auth chap MS-v2> <magic 0xa78d7d5e> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x15a47c80> <pcomp> <accomp> <callback CBCP>]
sent [LCP ConfRej id=0x0 <callback CBCP>]
rcvd [LCP ConfAck id=0x1 <mru 1400> <asyncmap 0x0> <auth chap MS-v2> <magic 0xa78d7d5e> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x15a47c80> <pcomp> <accomp>]
sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x15a47c80> <pcomp> <accomp>]
sent [CHAP Challenge id=0xd5 <b8dafad24519871928884498884c5f6d>, name = "pptpd"]
rcvd [LCP Ident id=0x2 magic=0x15a47c80 "MSRASV5.10"]
rcvd [LCP Ident id=0x3 magic=0x15a47c80 "MSRAS-0-ADMIN"]
rcvd [CHAP Response id=0xd5 <0697e3c624fecc40affdb12840ea60610000000000000000daa2473c3f68fba4c1124a37ea323bfddca61c87740b398b00>, name = "ashurshov"]
sent [CHAP Success id=0xd5 "S=9865D663BE786F7A2084B7676C50E5774C246388 M=Access granted"]
sent [CCP ConfReq id=0x1 <mppe +H -M +S +L -D -C>]
rcvd [CCP ConfReq id=0x4 <mppe +H +M +S +L -D -C>]
sent [CCP ConfNak id=0x4 <mppe +H -M +S -L -D -C>]
rcvd [IPCP ConfReq id=0x5 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
sent [IPCP TermAck id=0x5]
rcvd [CCP ConfNak id=0x1 <mppe +H -M +S -L -D -C>]
sent [CCP ConfReq id=0x2 <mppe +H -M +S -L -D -C>]
rcvd [CCP ConfReq id=0x6 <mppe +H -M +S -L -D -C>]
sent [CCP ConfAck id=0x6 <mppe +H -M +S -L -D -C>]
rcvd [CCP ConfAck id=0x2 <mppe +H -M +S -L -D -C>]
MPPE 128-bit stateless compression enabled
sent [IPCP ConfReq id=0x1 <addr 172.16.0.1>]
rcvd [IPCP ConfAck id=0x1 <addr 172.16.0.1>]
rcvd [IPCP ConfReq id=0x7 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
sent [IPCP ConfRej id=0x7 <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
rcvd [IPCP ConfReq id=0x8 <addr 0.0.0.0>]
sent [IPCP ConfNak id=0x8 <addr 172.16.0.2>]
rcvd [IPCP ConfReq id=0x9 <addr 172.16.0.2>]
sent [IPCP ConfAck id=0x9 <addr 172.16.0.2>]
Cannot determine ethernet address for proxy ARP
local  IP address 172.16.0.1
remote IP address 172.16.0.2
pptpd-logwtmp.so ip-up ppp0 user 212.XX.XX.XXX
Script /etc/ppp/ip-up started (pid 31312)
Script /etc/ppp/ip-up finished (pid 31312), status = 0x0
rcvd [Compressed data] 92 ce 73 41 46 36 30 62 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 cf 63 72 88 24 ac 7f ...
rcvd [Compressed data] 92 d0 7b b6 81 7a 03 e3 ...
rcvd [Compressed data] 92 d1 7e 90 da 8c cf fe ...
rcvd [Compressed data] 92 d2 41 31 a4 ae 8d fa ...
rcvd [Compressed data] 92 d3 83 d9 5c b6 31 d4 ...
rcvd [Compressed data] 92 d4 9e 7c 8c 71 7f de ...
rcvd [Compressed data] 92 d5 66 cf e0 8c 65 06 ...
rcvd [Compressed data] 92 d6 8a b9 ec 38 9c d8 ...
rcvd [Compressed data] 92 d7 14 ea 23 e2 65 49 ...
rcvd [Compressed data] 92 d8 81 c6 71 6f d8 e4 ...
rcvd [Compressed data] 92 d9 ab a3 93 2d e1 76 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 da 1c 46 81 2f c5 88 ...
rcvd [Compressed data] 92 db 5f 4b 43 cd f3 88 ...
rcvd [Compressed data] 92 dc c3 05 a6 aa 46 ea ...
rcvd [Compressed data] 92 dd 2a b3 20 a1 81 28 ...
rcvd [Compressed data] 92 de 4f 91 fd c2 d2 51 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 df 24 1f f6 05 c1 ac ...
rcvd [Compressed data] 92 e0 6d ec 80 58 0a 66 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 e1 5f 2e 5e e3 1d 32 ...
rcvd [Compressed data] 92 e2 74 8d dd 73 3a ba ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 e3 31 7f 93 79 4e 17 ...
rcvd [Compressed data] 92 e4 46 83 53 c2 03 6c ...
rcvd [Compressed data] 92 e5 05 33 a3 b3 e9 95 ...
rcvd [Compressed data] 92 e6 f5 59 71 32 8e 0d ...
rcvd [Compressed data] 92 e7 e0 65 02 c9 d2 bb ...
rcvd [Compressed data] 92 e8 26 88 63 33 64 8e ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 e9 0a 02 a9 99 eb 05 ...
rcvd [Compressed data] 92 ea 3e ad 27 de 17 9a ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 eb d9 2e 58 d7 51 04 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 ec ff 15 86 4d 46 ac ...
rcvd [Compressed data] 92 ed 31 36 4a 80 1d 31 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 ee c5 eb 36 dd fe f6 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 ef af e6 3e 74 01 93 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 f0 80 00 ad 84 ae 63 ...
rcvd [Compressed data] 92 f1 14 f0 08 c7 c7 27 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 92 f2 c6 db 21 20 b3 4e ...
rcvd [Compressed data] 92 f3 72 9c 11 c1 7e 92 ...
rcvd [Compressed data] 92 f4 03 6e d3 61 08 da ...
rcvd [Compressed data] 92 f5 71 16 f4 66 d1 36 ...
rcvd [Compressed data] 92 f6 c8 0b 0f 73 9a a9 ...
rcvd [Compressed data] 92 f7 22 5b 20 be 9f aa ...
rcvd [Compressed data] 92 f8 3d 4d 34 d8 4b 9e ...
rcvd [Compressed data] 92 f9 27 dc 35 f3 be 81 ...
rcvd [Compressed data] 92 fa c0 fa a2 58 47 84 ...
rcvd [Compressed data] 92 fb eb d4 4e 3d 1f 69 ...
rcvd [Compressed data] 92 fc e9 70 d2 23 f6 62 ...
rcvd [Compressed data] 92 fd 39 87 f1 e3 a6 89 ...
rcvd [Compressed data] 92 fe fb 69 96 81 1b 4b ...
rcvd [Compressed data] 92 ff 40 97 8d f5 d4 9d ...
rcvd [Compressed data] 93 00 57 14 4f d0 3f 0e ...
rcvd [Compressed data] 93 01 0e ad 3c 05 b5 db ...
rcvd [Compressed data] 93 02 cd 9e a0 a6 8b a0 ...
rcvd [Compressed data] 93 03 aa ec 39 50 03 c3 ...
rcvd [Compressed data] 93 04 f0 60 0e 91 0e cb ...
rcvd [Compressed data] 93 05 f6 25 2b 1e ad f7 ...
rcvd [Compressed data] 93 06 62 87 ea e1 4a f9 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 07 71 e8 f6 4f 7c b6 ...
rcvd [Compressed data] 93 08 99 d6 68 8b b5 da ...
rcvd [Compressed data] 93 09 89 f5 b5 6f 06 94 ...
rcvd [Compressed data] 93 0a a4 63 2c 20 0e f5 ...
rcvd [Compressed data] 93 0b 12 d1 56 57 cc 3d ...
rcvd [Compressed data] 93 0c 14 62 84 21 7a 39 ...
rcvd [Compressed data] 93 0d 43 4c e0 40 dc 25 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 0e 5c 21 68 96 c1 c9 ...
rcvd [Compressed data] 93 0f b4 c0 cf 87 e5 93 ...
rcvd [Compressed data] 93 10 97 06 0d 65 e8 12 ...
rcvd [Compressed data] 93 11 70 f7 18 22 8c 60 ...
rcvd [Compressed data] 93 12 29 61 2a 58 08 08 ...
rcvd [Compressed data] 93 13 44 8a 40 ef 62 1b ...
rcvd [Compressed data] 93 14 15 33 26 79 3d 94 ...
rcvd [Compressed data] 93 15 e5 56 71 d7 ba 03 ...
rcvd [Compressed data] 93 16 6f b3 f3 48 ae e1 ...
rcvd [Compressed data] 93 17 d0 1e d9 2c 9d 99 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 18 d3 f9 a2 6a d3 8b ...
rcvd [Compressed data] 93 19 fd 7c 21 0e c4 76 ...
rcvd [Compressed data] 93 1a b4 f2 41 8a cb 4d ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 1b 02 12 10 6b 4e c1 ...
rcvd [Compressed data] 93 1c f0 9a 61 5f fd 52 ...
rcvd [Compressed data] 93 1d 46 89 d7 74 63 55 ...
rcvd [Compressed data] 93 1e fc 0d cc 79 cf e1 ...
rcvd [Compressed data] 93 1f 1e 69 46 01 e5 8f ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 20 a7 ba ab e0 cf 50 ...
rcvd [Compressed data] 93 21 3e 98 d7 47 de 2a ...
rcvd [Compressed data] 93 22 54 6e 56 1d 8d 52 ...
rcvd [Compressed data] 93 23 b1 93 dd 30 18 d9 ...
rcvd [Compressed data] 93 24 61 30 47 ea fd ea ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 25 38 60 ec fa 22 5a ...
rcvd [Compressed data] 93 26 d3 cc e6 a9 a4 b6 ...
rcvd [Compressed data] 93 27 b7 3a 98 0f 36 06 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 28 b8 c1 38 39 82 49 ...
rcvd [Compressed data] 93 29 1b b5 54 c8 82 e8 ...
rcvd [Compressed data] 93 2a 0e d9 81 d0 94 9e ...
rcvd [Compressed data] 93 2b 77 fb 10 f1 66 63 ...
rcvd [Compressed data] 93 2c 48 e8 33 96 18 67 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 2d 63 74 05 88 c4 cb ...
rcvd [Compressed data] 93 2e e8 f9 26 d8 eb 41 ...
rcvd [Compressed data] 93 2f 22 39 16 f2 24 87 ...
rcvd [Compressed data] 93 30 a5 c3 75 1c cc 62 ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 31 8e 78 48 65 f2 20 ...
rcvd [Compressed data] 93 32 1c c9 7e 84 75 4e ...
sent [CCP ResetReq id=0x3]
rcvd [Compressed data] 93 33 67 ce cd 62 94 4b ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 34 ce dc 86 ec fc 08 ...
rcvd [Compressed data] 93 35 e6 93 d2 5b 3d b2 ...
rcvd [Compressed data] 93 36 a5 0b dd 21 c8 bc ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 37 22 80 1f cd a8 af ...
rcvd [Compressed data] 93 38 b7 01 7c 48 b8 03 ...
rcvd [Compressed data] 93 39 fe 34 69 a7 86 3c ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 3a 71 5e d4 19 9b 05 ...
rcvd [Compressed data] 93 3b 6e 38 9c 87 6e ea ...
rcvd [Compressed data] 93 3c a4 5c 7a c9 e8 03 ...
rcvd [Compressed data] 93 3d 98 d2 89 36 1c b6 ...
rcvd [Compressed data] 93 3e 67 86 ec 12 f4 d8 ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 3f 56 d8 29 73 48 90 ...
rcvd [Compressed data] 93 40 91 6d dc 2d 9c 63 ...
rcvd [Compressed data] 93 41 13 8c 00 40 15 aa ...
rcvd [Compressed data] 93 42 59 7e 6e be a7 e9 ...
rcvd [Compressed data] 93 43 fc 16 74 36 af cb ...
rcvd [Compressed data] 93 44 74 25 f7 e3 f6 b7 ...
rcvd [Compressed data] 93 45 0f 33 85 47 b2 ee ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 46 da 56 4d cb fd bf ...
rcvd [Compressed data] 93 47 2a d6 97 ef be fa ...
rcvd [Compressed data] 93 48 d1 55 21 af ba 1d ...
rcvd [Compressed data] 93 49 aa 99 b7 6f 7a dd ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 4a 17 32 30 d7 ef 6a ...
rcvd [Compressed data] 93 4b 94 27 78 74 19 0d ...
rcvd [Compressed data] 93 4c 0c 9d 71 85 b2 33 ...
rcvd [Compressed data] 93 4d fc 36 a3 ea 25 ae ...
rcvd [Compressed data] 93 4e 01 d0 db 18 57 eb ...
rcvd [Compressed data] 93 4f 24 75 3e 43 39 46 ...
rcvd [Compressed data] 93 50 7d e2 9d f1 8c c7 ...
rcvd [Compressed data] 93 51 42 b5 3c fd 33 51 ...
rcvd [Compressed data] 93 52 92 63 be 77 22 f5 ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 53 06 8c f1 af c1 8a ...
rcvd [Compressed data] 93 54 c4 2b 86 be 11 dc ...
rcvd [Compressed data] 93 55 fd 22 49 c8 89 84 ...
rcvd [Compressed data] 93 56 7f e1 c1 a3 39 53 ...
rcvd [Compressed data] 93 57 37 f0 f9 3d 03 f7 ...
rcvd [Compressed data] 93 58 40 b7 78 9d 3d 2f ...
rcvd [Compressed data] 93 59 29 36 04 1b dd c4 ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 5a 30 5b 06 3e 7e f4 ...
rcvd [Compressed data] 93 5b 06 7a e1 17 af ce ...
rcvd [Compressed data] 93 5c 86 bc 45 ea c5 76 ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 5d 0c 3e 77 ba c5 aa ...
rcvd [Compressed data] 93 5e dc d0 69 32 2b 48 ...
rcvd [Compressed data] 93 5f 6b c9 31 16 c8 b6 ...
sent [CCP ResetReq id=0x4]
rcvd [Compressed data] 93 60 82 76 60 9f d8 64 ...
sent [CCP ResetReq id=0x5]
rcvd [Compressed data] 93 61 d5 33 79 7f e8 48 ...
sent [CCP ResetReq id=0x5]
rcvd [Compressed data] 93 62 01 af 43 d8 32 31 ...
rcvd [Compressed data] 93 63 ee 1f 8f c2 5c 8a ...
sent [CCP ResetReq id=0x5]
rcvd [Compressed data] 93 64 f4 0b 8d d7 dc ed ...
rcvd [Compressed data] 93 65 64 9c 40 47 31 96 ...
rcvd [Compressed data] 93 66 72 7f 2d 14 ee 13 ...
sent [CCP ResetReq id=0x5]
rcvd [Compressed data] 93 67 aa 09 3a ae 81 7d ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 68 4e 42 38 ef d7 ff ...
rcvd [Compressed data] 93 69 9c 02 8e ef 1b da ...
rcvd [Compressed data] 93 6a 35 c4 2a 68 81 9d ...
rcvd [Compressed data] 93 6b 53 e0 31 e5 81 39 ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 6c f8 63 90 80 be 2c ...
rcvd [Compressed data] 93 6d 53 3a 66 12 78 ed ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 6e 83 87 ac 26 6a de ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 6f d1 54 9f 35 3b eb ...
rcvd [Compressed data] 93 70 c3 1d 20 28 07 a8 ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 71 9a 42 4d ef 17 e2 ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 72 9d c1 f6 e0 d8 7f ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 73 7a d9 c0 fd 10 fa ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 74 d2 62 3d 59 7a b3 ...
rcvd [Compressed data] 93 75 fc 40 3c 77 4b 60 ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 76 cc 8e 88 07 a1 d1 ...
rcvd [Compressed data] 93 77 9c 22 48 2b 61 14 ...
rcvd [Compressed data] 93 78 e9 3f 49 df d2 3c ...
rcvd [Compressed data] 93 79 12 52 5f 93 4d 8c ...
sent [CCP ResetReq id=0x6]
rcvd [Compressed data] 93 7a 26 f6 e0 da 92 21 ...
rcvd [Compressed data] 93 7b e6 4a 92 54 11 e7 ...
sent [CCP ResetReq id=0x6]

tcpdump при запущенном ping ya.ru
12:39:05.224050 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 22528, length 40
12:39:06.211073 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 22784, length 40
12:39:06.224033 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 22784, length 40
12:39:07.211062 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 23040, length 40
12:39:07.224028 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 23040, length 40
12:39:08.211395 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 23296, length 40
12:39:08.224385 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 23296, length 40
12:39:09.211039 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 23552, length 40
12:39:09.224151 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 23552, length 40
12:39:10.211028 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 23808, length 40
12:39:10.223991 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 23808, length 40
12:39:11.210827 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 24064, length 40
12:39:11.223705 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 24064, length 40
12:39:12.210992 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 24320, length 40
12:39:12.223961 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 24320, length 40
12:39:13.210950 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 24576, length 40
12:39:13.223899 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 24576, length 40
12:39:14.210919 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 24832, length 40
12:39:14.223787 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 24832, length 40
12:39:15.211296 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 25088, length 40
12:39:15.224185 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 25088, length 40
12:39:16.210887 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 25344, length 40
12:39:16.223781 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 25344, length 40
12:39:17.210910 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 25600, length 40
12:39:17.223871 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 25600, length 40
12:39:18.210685 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 25856, length 40
12:39:18.224049 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 25856, length 40
12:39:18.790284 IP 172.16.0.2.sxmp > 10.0.0.1.http: S 1885391596:1885391596(0) win 65535 <mss 1360,nop,wscale 1,nop,nop,sackOK>
12:39:19.210748 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 26112, length 40
12:39:19.223736 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 26112, length 40
12:39:20.210737 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 26368, length 40
12:39:20.223732 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 26368, length 40
12:39:21.210684 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 26624, length 40
12:39:21.223573 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 26624, length 40
12:39:22.211150 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 26880, length 40
12:39:22.224100 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 26880, length 40
12:39:23.210688 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 27136, length 40
12:39:23.223608 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 27136, length 40
12:39:24.210813 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 27392, length 40
12:39:24.223784 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 27392, length 40
12:39:25.210594 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 27648, length 40
12:39:25.223504 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 27648, length 40
12:39:26.210618 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 27904, length 40
12:39:26.223756 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 27904, length 40
12:39:27.210576 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 28160, length 40
12:39:27.223734 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 28160, length 40
12:39:28.210542 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 28416, length 40
12:39:28.223420 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 28416, length 40
12:39:29.210990 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 28672, length 40
12:39:29.223862 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 28672, length 40
12:39:30.210499 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 28928, length 40
12:39:30.223378 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 28928, length 40
12:39:31.210485 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 29184, length 40
12:39:31.223443 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 29184, length 40
12:39:32.210350 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 29440, length 40
12:39:32.223293 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 29440, length 40
12:39:33.210444 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 29696, length 40
12:39:33.223422 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 29696, length 40
12:39:33.790302 IP 172.16.0.2.ordinox-server > 10.0.0.1.http: S 2232158954:2232158954(0) win 65535 <mss 1360,nop,wscale 1,nop,nop,sackOK>
12:39:34.210491 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 29952, length 40
12:39:34.223455 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 29952, length 40
12:39:35.210383 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 30208, length 40
12:39:35.223314 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 30208, length 40
12:39:36.210802 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 30464, length 40
12:39:36.223692 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 30464, length 40
12:39:37.210379 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 30720, length 40
12:39:37.223346 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 30720, length 40
12:39:38.210349 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 30976, length 40
12:39:38.223225 IP www.yandex.ru > 172.16.0.2: ICMP echo reply, id 768, seq 30976, length 40
12:39:39.210380 IP 172.16.0.2 > www.yandex.ru: ICMP echo request, id 768, seq 31232, length 40

tcpdump после загрузки сайта и последующего пропадания ping

[root@srv1 ~]# tcpdump -i ppp0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
12:54:22.198618 IP 172.16.0.2.52522 > 192.168.0.1.ldap: S 2794123673:2794123673(0) win 8192 <mss 1360,nop,nop,sackOK>
12:54:22.199264 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:22.323572 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:23.088550 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:23.852495 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:24.616902 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:25.381739 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:26.145744 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:26.910141 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:27.675101 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:28.438997 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:29.203487 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:29.968214 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:30.732244 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:31.496672 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:32.261783 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:33.025433 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:33.789900 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:34.211653 IP 172.16.0.2.52524 > 192.168.0.1.ldap: S 1372050035:1372050035(0) win 8192 <mss 1360,nop,nop,sackOK>
12:54:34.212371 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:34.554693 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:35.318705 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:36.083135 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:36.332735 IP 172.16.0.2.52525 > 192.168.0.1.ldap: S 3832620438:3832620438(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:36.333346 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:36.441804 IP 172.16.0.2.52526 > 192.168.0.1.ldap: S 1192565969:1192565969(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:36.442474 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:36.848176 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:37.611991 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:38.376375 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:39.141311 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:39.343357 IP 172.16.0.2.52525 > 192.168.0.1.ldap: S 3832620438:3832620438(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:39.344310 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:39.452567 IP 172.16.0.2.52526 > 192.168.0.1.ldap: S 1192565969:1192565969(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:39.453290 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:39.905298 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:40.452028 IP 172.16.0.2.52527 > 192.168.0.2.ldap: S 1816542936:1816542936(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:40.560318 IP 172.16.0.2.52528 > 192.168.0.1.ldap: S 623281489:623281489(0) win 8192 <mss 1360,nop,nop,sackOK>
12:54:40.561093 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:40.669608 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:41.434429 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:42.198507 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:42.962893 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:43.461875 IP 172.16.0.2.52527 > 192.168.0.2.ldap: S 1816542936:1816542936(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:54:43.571054 IP 172.16.0.2.52528 > 192.168.0.1.ldap: S 623281489:623281489(0) win 8192 <mss 1360,nop,nop,sackOK>
12:54:43.571695 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:43.727806 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:44.491705 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:45.256208 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:46.020965 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:46.784900 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:47.549409 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:48.314255 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:49.078243 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:54:49.467999 IP 172.16.0.2.52527 > 192.168.0.2.ldap: S 1816542936:1816542936(0) win 65535 <mss 1360,nop,nop,sackOK>
12:54:49.592789 IP 172.16.0.2.52528 > 192.168.0.1.ldap: S 623281489:623281489(0) win 8192 <mss 1360,nop,nop,sackOK>
12:54:49.593558 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:54:49.842646 IP 172.16.0.2.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
12:55:01.466584 IP 172.16.0.2.52529 > 192.168.0.1.ldap: S 1221852963:1221852963(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:01.467595 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:04.475538 IP 172.16.0.2.52529 > 192.168.0.1.ldap: S 1221852963:1221852963(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:04.476211 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:10.481682 IP 172.16.0.2.52529 > 192.168.0.1.ldap: S 1221852963:1221852963(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:10.483955 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:22.494837 IP 172.16.0.2.52530 > 192.168.0.1.ldap: S 917431986:917431986(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:22.495425 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:24.615841 IP 172.16.0.2.52531 > 192.168.0.1.ldap: S 967019174:967019174(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:24.619881 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:24.724841 IP 172.16.0.2.52532 > 192.168.0.1.ldap: S 431224831:431224831(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:24.729256 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:27.626445 IP 172.16.0.2.52531 > 192.168.0.1.ldap: S 967019174:967019174(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:27.627306 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:27.735602 IP 172.16.0.2.52532 > 192.168.0.1.ldap: S 431224831:431224831(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:27.738751 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:28.734717 IP 172.16.0.2.52533 > 192.168.0.2.ldap: S 3841771934:3841771934(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:28.843276 IP 172.16.0.2.52534 > 192.168.0.1.ldap: S 3279739297:3279739297(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:28.843911 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:31.744938 IP 172.16.0.2.52533 > 192.168.0.2.ldap: S 3841771934:3841771934(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:31.854090 IP 172.16.0.2.52534 > 192.168.0.1.ldap: S 3279739297:3279739297(0) win 8192 <mss 1360,nop,wscale 8,nop,nop,sackOK>
12:55:31.857437 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:55:37.751044 IP 172.16.0.2.52533 > 192.168.0.2.ldap: S 3841771934:3841771934(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:37.860229 IP 172.16.0.2.52534 > 192.168.0.1.ldap: S 3279739297:3279739297(0) win 8192 <mss 1360,nop,nop,sackOK>
12:55:37.861084 IP 192.168.0.1 > 172.16.0.2: ICMP host 192.168.0.1 unreachable, length 36
12:56:52.099580 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: S 4130199757:4130199757(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:52.140113 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: S 4129533003:4129533003(0) ack 4130199758 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:52.195030 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 1 win 16660
12:56:52.195608 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: P 1:363(362) ack 1 win 16660
12:56:52.236160 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . ack 363 win 665
12:56:52.236548 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 1:134(133) ack 363 win 665
12:56:52.292471 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: P 363:1040(677) ack 134 win 16626
12:56:52.369527 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 134:1490(1356) ack 1040 win 661
12:56:52.369556 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.369568 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 1494:2850(1356) ack 1040 win 661
12:56:52.369593 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.369602 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 2854:4210(1356) ack 1040 win 661
12:56:52.369622 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.369905 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 4214:5570(1356) ack 1040 win 661
12:56:52.369932 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.369937 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 5574:6930(1356) ack 1040 win 661
12:56:52.425650 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 2854 win 16660
12:56:52.425812 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 5574 win 16660
12:56:52.466265 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 13734:15090(1356) ack 1040 win 661
12:56:52.466298 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.466316 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 15094:16450(1356) ack 1040 win 661
12:56:52.466351 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.466369 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 16454:17810(1356) ack 1040 win 661
12:56:52.466401 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.466416 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 17814:19170(1356) ack 1040 win 661
12:56:52.466448 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.521840 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 5574 win 16660 <nop,nop,sack 1 {13734:15094}>
12:56:52.521961 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 5574 win 16660 <nop,nop,sack 1 {13734:16454}>
12:56:52.522006 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 5574 win 16660 <nop,nop,sack 1 {13734:17814}>
12:56:52.522152 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 5574 win 16660 <nop,nop,sack 1 {13734:19174}>
12:56:52.562531 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 5574:6930(1356) ack 1040 win 661
12:56:52.562559 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.562570 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 6934:8290(1356) ack 1040 win 661
12:56:52.562593 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.562602 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 8294:9650(1356) ack 1040 win 661
12:56:52.562621 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.562768 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 9654:11010(1356) ack 1040 win 661
12:56:52.562804 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.562812 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 11014:12370(1356) ack 1040 win 661
12:56:52.562864 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 19174:20530(1356) ack 1040 win 661
12:56:52.562904 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.562920 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 20534:21890(1356) ack 1040 win 661
12:56:52.562959 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.618440 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 6934 win 16660 <nop,nop,sack 1 {13734:19174}>
12:56:52.618567 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 8294 win 16660 <nop,nop,sack 1 {13734:19174}>
12:56:52.618571 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 9654 win 16660 <nop,nop,sack 1 {13734:19174}>
12:56:52.618822 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:19174}>
12:56:52.618981 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:20534}>
12:56:52.619087 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:21894}>
12:56:52.659166 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 21894:23250(1356) ack 1040 win 661
12:56:52.659194 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659205 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 23254:24610(1356) ack 1040 win 661
12:56:52.659229 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659238 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 24614:25970(1356) ack 1040 win 661
12:56:52.659258 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659362 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 25974:27330(1356) ack 1040 win 661
12:56:52.659386 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659418 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 27334:28690(1356) ack 1040 win 661
12:56:52.659441 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659494 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 11014:12370(1356) ack 1040 win 661
12:56:52.659518 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659526 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 12374:13730(1356) ack 1040 win 661
12:56:52.659548 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659612 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 28694:30050(1356) ack 1040 win 661
12:56:52.659635 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.659643 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 30054:31410(1356) ack 1040 win 661
12:56:52.659666 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.714995 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:23254}>
12:56:52.714999 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:24614}>
12:56:52.715172 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:25974}>
12:56:52.715221 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:27334}>
12:56:52.715393 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 11014 win 16660 <nop,nop,sack 1 {13734:28694}>
12:56:52.715629 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 12374 win 16660 <nop,nop,sack 1 {13734:28694}>
12:56:52.715633 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 28694 win 16660
12:56:52.715859 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 31414 win 15980
12:56:52.715920 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 31414 win 16660
12:56:52.755806 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 31414:32770(1356) ack 1040 win 661
12:56:52.755835 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.755844 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 32774:34130(1356) ack 1040 win 661
12:56:52.755867 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.755877 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: . 34134:35490(1356) ack 1040 win 661
12:56:52.755897 IP la-in-f94.1e100.net > 172.16.0.2: tcp
12:56:52.756004 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 35494:36133(639) ack 1040 win 661
12:56:52.811840 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 34134 win 16660
12:56:52.811844 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 36133 win 16660
12:56:52.842085 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: S 4220459944:4220459944(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:52.857870 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: P 1040:1831(791) ack 36133 win 16660
12:56:52.857875 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: S 3628707654:3628707654(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:52.858113 IP 172.16.0.2.52538 > la-in-f94.1e100.net.https: S 3532438938:3532438938(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:52.882472 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: S 3557889207:3557889207(0) ack 4220459945 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:52.897646 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: S 3161211811:3161211811(0) ack 3628707655 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:52.898430 IP la-in-f94.1e100.net.https > 172.16.0.2.52538: S 3770916615:3770916615(0) ack 3532438939 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:52.898805 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 36133:36323(190) ack 1831 win 661
12:56:52.937384 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: . ack 1 win 16660
12:56:52.937812 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: P 1:169(168) ack 1 win 16660
12:56:52.952543 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: . ack 1 win 16660
12:56:52.952941 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: P 1:169(168) ack 1 win 16660
12:56:52.953248 IP 172.16.0.2.52538 > la-in-f94.1e100.net.https: . ack 1 win 16660
12:56:52.953774 IP 172.16.0.2.52538 > la-in-f94.1e100.net.https: P 1:363(362) ack 1 win 16660
12:56:52.978238 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: . ack 169 win 668
12:56:52.979148 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: . 1:1357(1356) ack 169 win 668
12:56:52.979176 IP la-in-f120.1e100.net > 172.16.0.2: tcp
12:56:52.979188 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: . 1361:2717(1356) ack 169 win 668
12:56:52.979212 IP la-in-f120.1e100.net > 172.16.0.2: tcp
12:56:52.979220 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: P 2721:3819(1098) ack 169 win 668
12:56:52.992742 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: . ack 169 win 668
12:56:52.994125 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: . 1:1357(1356) ack 169 win 668
12:56:52.994153 IP la-in-f120.1e100.net > 172.16.0.2: tcp
12:56:52.994164 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: . 1361:2717(1356) ack 169 win 668
12:56:52.994188 IP la-in-f120.1e100.net > 172.16.0.2: tcp
12:56:52.994196 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: P 2721:3818(1097) ack 169 win 668
12:56:52.994215 IP la-in-f94.1e100.net.https > 172.16.0.2.52538: . ack 363 win 665
12:56:52.994329 IP la-in-f94.1e100.net.https > 172.16.0.2.52538: P 1:134(133) ack 363 win 665
12:56:53.035007 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: . ack 2721 win 16660
12:56:53.045577 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: P 169:291(122) ack 3819 win 16385
12:56:53.050007 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: . ack 2721 win 16660
12:56:53.060077 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: P 169:291(122) ack 3818 win 16385
12:56:53.083833 IP 172.16.0.2.52538 > la-in-f94.1e100.net.https: P 363:1116(753) ack 134 win 16626
12:56:53.083959 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: P 1831:3006(1175) ack 36323 win 16612
12:56:53.083964 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: S 3384987337:3384987337(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:53.084426 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: S 206467579:206467579(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:53.086645 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: P 3819:4045(226) ack 291 win 667
12:56:53.100551 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: P 3818:4044(226) ack 291 win 667
12:56:53.124279 IP la-in-f94.1e100.net.https > 172.16.0.2.52540: S 4083092487:4083092487(0) ack 206467580 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:53.124458 IP la-in-f120.1e100.net.https > 172.16.0.2.52539: S 3949006997:3949006997(0) ack 3384987338 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:53.124472 IP la-in-f94.1e100.net.https > 172.16.0.2.52538: P 134:324(190) ack 1116 win 661
12:56:53.125027 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 36323:36513(190) ack 3006 win 661
12:56:53.142618 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: P 291:852(561) ack 4045 win 16329
12:56:53.156135 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: P 291:759(468) ack 4044 win 16329
12:56:53.179160 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: . ack 1 win 16660
12:56:53.179343 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: . ack 1 win 16660
12:56:53.179773 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: P 1:363(362) ack 1 win 16660
12:56:53.180067 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: P 1:365(364) ack 1 win 16660
12:56:53.183391 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: P 4045:4235(190) ack 852 win 661
12:56:53.196392 IP la-in-f120.1e100.net.https > 172.16.0.2.52537: P 4044:4235(191) ack 759 win 661
12:56:53.219746 IP la-in-f94.1e100.net.https > 172.16.0.2.52540: . ack 363 win 665
12:56:53.219790 IP la-in-f94.1e100.net.https > 172.16.0.2.52540: P 1:134(133) ack 363 win 665
12:56:53.220586 IP la-in-f120.1e100.net.https > 172.16.0.2.52539: . ack 365 win 665
12:56:53.220735 IP la-in-f120.1e100.net.https > 172.16.0.2.52539: P 1:134(133) ack 365 win 665
12:56:53.276916 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: P 363:1100(737) ack 134 win 16626
12:56:53.278004 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: P 365:880(515) ack 134 win 16626
12:56:53.278009 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: S 211874116:211874116(0) win 8192 <mss 1360,nop,wscale 2,nop,nop,sackOK>
12:56:53.318504 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: S 2135865147:2135865147(0) ack 211874117 win 42900 <mss 1430,nop,nop,sackOK,nop,wscale 6>
12:56:53.318988 IP la-in-f120.1e100.net.https > 172.16.0.2.52539: P 134:325(191) ack 880 win 661
12:56:53.319077 IP la-in-f94.1e100.net.https > 172.16.0.2.52540: P 134:387(253) ack 1100 win 661
12:56:53.373475 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: . ack 1 win 16660
12:56:53.373966 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: P 1:169(168) ack 1 win 16660
12:56:53.381410 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: . ack 36513 win 16565
12:56:53.381485 IP 172.16.0.2.52538 > la-in-f94.1e100.net.https: . ack 324 win 16579
12:56:53.414450 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: . ack 169 win 668
12:56:53.415653 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: . 1:1357(1356) ack 169 win 668
12:56:53.415753 IP la-in-f102.1e100.net > 172.16.0.2: tcp
12:56:53.415765 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: . 1361:2717(1356) ack 169 win 668
12:56:53.415788 IP la-in-f102.1e100.net > 172.16.0.2: tcp
12:56:53.415797 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: P 2721:3819(1098) ack 169 win 668
12:56:53.443930 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: . ack 4235 win 16660
12:56:53.443934 IP 172.16.0.2.52537 > la-in-f120.1e100.net.https: . ack 4235 win 16660
12:56:53.471732 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: . ack 2721 win 16660
12:56:53.478798 IP la-in-f120.1e100.net.https > 172.16.0.2.52536: P 4045:4235(190) ack 852 win 661
12:56:53.486975 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: P 169:291(122) ack 3819 win 16385
12:56:53.528123 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: P 3819:4045(226) ack 291 win 667
12:56:53.533809 IP 172.16.0.2.52536 > la-in-f120.1e100.net.https: . ack 4235 win 16660 <nop,nop,sack 1 {4045:4235}>
12:56:53.583861 IP 172.16.0.2.52541 > la-in-f102.1e100.net.https: P 291:1111(820) ack 4045 win 16329
12:56:53.584251 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: . ack 387 win 16563
12:56:53.584256 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: . ack 325 win 16579
12:56:53.614061 IP la-in-f94.1e100.net.https > 172.16.0.2.52540: P 134:387(253) ack 1100 win 661
12:56:53.614931 IP la-in-f120.1e100.net.https > 172.16.0.2.52539: P 134:325(191) ack 880 win 661
12:56:53.624790 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: P 4045:4236(191) ack 1111 win 661
12:56:53.669058 IP 172.16.0.2.52540 > la-in-f94.1e100.net.https: . ack 387 win 16563 <nop,nop,sack 1 {134:387}>
12:56:53.669802 IP 172.16.0.2.52539 > la-in-f120.1e100.net.https: . ack 325 win 16579 <nop,nop,sack 1 {134:325}>
12:56:53.737314 IP 172.16.0.2.52535 > la-in-f94.1e100.net.https: P 3006:3711(705) ack 36513 win 16565
12:56:53.778267 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 36513:36703(190) ack 3711 win 661
12:56:53.921787 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: P 4045:4236(191) ack 1111 win 661
12:56:54.179777 IP la-in-f94.1e100.net.https > 172.16.0.2.52535: P 36513:36703(190) ack 3711 win 661
12:56:54.218789 IP la-in-f102.1e100.net.https > 172.16.0.2.52541: P 4045:4236(191) ack 1111 win 661

"зачем в mangle пачка правил с -j ACCEPT?" - будет input DROP после того как сделаю VPN

"И зачем в *nat маскарадинг для ppp+?" - убрал

5 Ответ от afanasev.p

  • afanasev.p
  • Пользователь
  • Неактивен
  • Зарегистрирован: 02.10.2012
  • Сообщений: 126
  • Репутация : [ 13 | 0 ]

После пропадания интернета:
на клиенте (отключив весь софт, который может генерить трафик)

 Консоль:

ping 8.8.8.8

на сервере (надеюсь там не очень много клиентов? ab ):
 Консоль:

# tcpdump -nn -i any icmp

ЗЫ: *mangle служит для изменения заголовков пакетов. Для фильтрации используйте *filter. Цепочка FORWARD в ней как раз для фильтрации "проходящего мимо" трафика
ЗЫ2: в логах вроде ничего "криминального" нет. Треша правда многовато ag

И баба с воза, и волки сыты...

6 Ответ от ansh

  • ansh
  • Новичок
  • Неактивен
  • Зарегистрирован: 28.06.2010
  • Сообщений: 25
  • Репутация : [ 0 | 0 ]

вроде как тишина...

[root@srv1 ~]# tcpdump -nn -i any icmp
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes

7 Ответ от afanasev.p

  • afanasev.p
  • Пользователь
  • Неактивен
  • Зарегистрирован: 02.10.2012
  • Сообщений: 126
  • Репутация : [ 13 | 0 ]

Хм. При этом с клиента icmp в сторону 8.8.8.8 улетают?

И баба с воза, и волки сыты...

8 Ответ от ansh

  • ansh
  • Новичок
  • Неактивен
  • Зарегистрирован: 28.06.2010
  • Сообщений: 25
  • Репутация : [ 0 | 0 ]

нет нет... на клиенте тоже... ping вместе с инетом отваливается...