My 'iptables' rules change by itself and add some ip-addresses

hkjz · 09-27-2021, 06:19 PM

Hey Hello,

First of all - 'cronetab' at every reboot reload iptables rules.

recenty i randlomly ran program >> tcpdump <<
to check whats happening what are connections that performs.

Problem is that my iptables got changed, by some unknown force. Any idea what that could be?

When they are freshly loaded they look like this

Code:

$ sudo iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT

however during the check i had this

Code:

$ sudo iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -s 107.150.94.3/32 -i wlan0 -j ACCEPT
-A INPUT -s 107.150.94.3/32 -i eth0 -j ACCEPT
-A INPUT -i wlan0 -j DROP
-A INPUT -i eth0 -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A OUTPUT -d 107.150.94.3/32 -o wlan0 -j ACCEPT
-A OUTPUT -d 107.150.94.3/32 -o eth0 -j ACCEPT
-A OUTPUT -o wlan0 -j DROP
-A OUTPUT -o eth0 -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT

and my tcpdump had a lot of those

Code:

00:13:14.889336 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.889373 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.889622 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:14.889646 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:14.889866 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.890408 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:14.890749 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:14.890772 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:14.890790 IP 107.150.94.3.1216 > mx.52975: UDP, length 678
00:13:14.891173 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.891490 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.891620 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:14.994781 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:15.098738 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:15.098917 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:15.914889 IP mx.52975 > 107.150.94.3.1216: UDP, length 84
00:13:15.979540 IP 107.150.94.3.1216 > mx.52975: UDP, length 311
00:13:15.981930 IP mx.52975 > 107.150.94.3.1216: UDP, length 85
00:13:16.046333 IP 107.150.94.3.1216 > mx.52975: UDP, length 85
00:13:16.046538 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.046584 IP mx.52975 > 107.150.94.3.1216: UDP, length 274
00:13:16.111812 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:16.397400 IP 107.150.94.3.1216 > mx.52975: UDP, length 221
00:13:16.397589 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.400295 IP mx.52975 > 107.150.94.3.1216: UDP, length 84
00:13:16.464656 IP 107.150.94.3.1216 > mx.52975: UDP, length 311
00:13:16.466825 IP mx.52975 > 107.150.94.3.1216: UDP, length 85
00:13:16.531744 IP 107.150.94.3.1216 > mx.52975: UDP, length 85
00:13:16.531937 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.543677 IP mx.52975 > 107.150.94.3.1216: UDP, length 594
00:13:16.609471 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:16.891860 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:16.891892 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:16.891904 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:16.892080 IP 107.150.94.3.1216 > mx.52975: UDP, length 845
00:13:16.892325 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.892368 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.892395 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.892422 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:16.897658 IP mx.52975 > 107.150.94.3.1216: UDP, length 235
00:13:16.961150 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.105790 IP 107.150.94.3.1216 > mx.52975: UDP, length 128
00:13:17.107236 IP mx.52975 > 107.150.94.3.1216: UDP, length 303
00:13:17.172072 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.318467 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:17.318739 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:17.318820 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:17.319015 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:17.319028 IP 107.150.94.3.1216 > mx.52975: UDP, length 1391
00:13:17.319032 IP 107.150.94.3.1216 > mx.52975: UDP, length 557
00:13:17.319146 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:17.319854 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:17.320658 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:17.430676 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.430831 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.526959 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.527097 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:17.528375 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:17.528493 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:28.061473 IP _gateway > all-systems.mcast.net: igmp query v3
00:13:48.362757 IP _gateway > all-systems.mcast.net: igmp query v3
00:13:51.483950 IP mx.52975 > 107.150.94.3.1216: UDP, length 138
00:13:51.549192 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:13:51.677058 IP 107.150.94.3.1216 > mx.52975: UDP, length 230
00:13:51.677253 IP mx.52975 > 107.150.94.3.1216: UDP, length 77
00:13:54.365744 IP mx.52975 > 107.150.94.3.1216: UDP, length 101
00:13:54.502097 IP 107.150.94.3.1216 > mx.52975: UDP, length 101
00:13:56.674243 ARP, Request who-has _gateway tell mx, length 28
00:13:56.675275 ARP, Reply _gateway is-at 24:4b:fe:e4:7e:00 (oui Unknown), length 46
00:14:01.381356 IP mx.52975 > 107.150.94.3.1216: UDP, length 138
00:14:01.446102 IP 107.150.94.3.1216 > mx.52975: UDP, length 77
00:14:01.572937 IP 107.150.94.3.1216 > mx.52975: UDP, length 139
00:14:01.573106 IP mx.52975 > 107.150.94.3.1216: UDP, length 77

Recently i made simmilar check, and i got this

Code:

$ sudo iptables -S
[sudo] password for mx: 
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -s 5.180.62.164/32 -i wlan0 -j ACCEPT
-A INPUT -s 5.180.62.164/32 -i eth0 -j ACCEPT
-A INPUT -i wlan0 -j DROP
-A INPUT -i eth0 -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A OUTPUT -d 5.180.62.164/32 -o wlan0 -j ACCEPT
-A OUTPUT -d 5.180.62.164/32 -o eth0 -j ACCEPT
-A OUTPUT -o wlan0 -j DROP
-A OUTPUT -o eth0 -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT

astrogeek · 09-27-2021, 06:50 PM

Unless those IP addresses mean something to you, I would conclude that the system has been compromised and is likely serving as a node in someone elses botnet (the new owners).

I would immediately remove internet access to the machine, power it off and check any others on the same local network for similar problems.

If you need to save any data from it or want to do some forensic work to try to figure out how it has been compromised, do so in isolation and do not expose that machine to the internet again. If you remove any files from that machine be very selective and validate that they are what you think they are or you just might propagate the problem to another machine.

How to fix it? I would do nothing less than perform a complete fresh install from repartioned and reformatted drive and not restore anything from backups until it was validated.

hkjz · 09-28-2021, 02:53 AM

I found out, that tcpdump shows only ip number happens after connecting to VPN,
before connection takes place, domains have names, and there are few.

It is not the first time when i found such a situation, so i took some measures,
after redoing the system, i always have updates && upgrades, i use vpn, the iptable rules are loaded up again at every boot, i use password managers, have some sandboxes

what else can i do to prevent such a situation? Thanks

hkjz · 09-28-2021, 05:17 AM

Beside i use OpenSnitch - active firewall application

dont know what else i can do to prevent such a situation, thanks

sundialsvcs · 09-28-2021, 10:05 AM

If "these things only happen after connecting VPN," obviously we need to know more about this – and, you might need to investigate.

Who is "the VPN server?" Are you connecting publicly in a coffee shop, or are you establishing a VPN tunnel to a remote office or trusted client? Exactly what sort of VPN is it ("OpenSwan == IPSec" or "OpenVPN?") How is it secured? ("PSKs == passwords" or "digital certificates?")

hkjz · 09-28-2021, 10:39 AM

You slightly misunderstood me.

Behavior continue to happen regardless of VPN, however under VPN i have IP numbers, without VPN i have server names.
It is NordVPN.

When VPN is UP

Code:

 
$ sudo tcpdump
[sudo] password for mx: 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:16:17.978058 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 101
17:16:17.978147 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 101
17:16:17.988310 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 96
17:16:18.030914 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 101
17:16:18.034071 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 101
17:16:18.082423 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 77
17:16:18.121412 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 77
17:16:18.862262 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 77
17:16:18.901573 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 77
17:16:19.122341 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 77
17:16:19.124301 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 422
17:16:19.124633 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 108
17:16:19.125444 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 77
17:16:19.139206 IP mx.34028 > unn-84-17-59-177.cdn77.com.1198: UDP, length 255
17:16:19.163585 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 77
17:16:19.178887 IP unn-84-17-59-177.cdn77.com.1198 > mx.34028: UDP, length 77

When VPN is DOWN

Code:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:25:03.067315 IP mx.DomainGi.35622 > 104.16.160.101.https: Flags [.], ack 3235235562, win 501, length 0
17:25:03.073764 IP 104.16.160.101.https > mx.DomainGi.35622: Flags [.], ack 1, win 69, length 0
17:25:03.077996 IP mx.DomainGi.38758 > RT-AC86U-7E00.DomainGi.domain: 22620+ PTR? 101.160.16.104.in-addr.arpa. (45)
17:25:03.089796 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.38758: 22620 NXDomain 0/1/0 (107)
17:25:03.090557 IP mx.DomainGi.40882 > RT-AC86U-7E00.DomainGi.domain: 26763+ PTR? 246.2.168.192.in-addr.arpa. (44)
17:25:03.091597 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.40882: 26763* 1/0/0 PTR mx.DomainGi. (69)
17:25:03.092024 IP mx.DomainGi.45717 > RT-AC86U-7E00.DomainGi.domain: 47094+ PTR? 1.2.168.192.in-addr.arpa. (42)
17:25:03.092848 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.45717: 47094* 1/0/0 PTR RT-AC86U-7E00.DomainGi. (78)
17:25:03.271315 IP mx.DomainGi.37392 > 104.17.50.74.https: Flags [.], ack 1622663855, win 501, length 0
17:25:03.271890 IP mx.DomainGi.60430 > RT-AC86U-7E00.DomainGi.domain: 65335+ PTR? 74.50.17.104.in-addr.arpa. (43)
17:25:03.277550 IP 104.17.50.74.https > mx.DomainGi.37392: Flags [.], ack 1, win 67, length 0
17:25:03.289697 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.60430: 65335 NXDomain 0/1/0 (105)
17:25:08.642852 IP mx.DomainGi.35552 > RT-AC86U-7E00.DomainGi.domain: 10790+ A? tiny.cc. (25)
17:25:08.643161 IP mx.DomainGi.35552 > RT-AC86U-7E00.DomainGi.domain: 26158+ AAAA? tiny.cc. (25)
17:25:08.690540 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.35552: 10790 1/2/4 A 157.245.113.153 (190)
17:25:08.690896 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.35552: 26158 0/1/0 (99)
17:25:08.692522 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [S], seq 1074152415, win 64240, options [mss 1460,sackOK,TS val 4010169358 ecr 0,nop,wscale 7], length 0
17:25:08.693530 IP mx.DomainGi.42938 > RT-AC86U-7E00.DomainGi.domain: 41180+ PTR? 153.113.245.157.in-addr.arpa. (46)
17:25:08.736500 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.42938: 41180 1/3/6 PTR c8-tiny.cc. (272)
17:25:08.797951 IP c8-tiny.cc.http > mx.DomainGi.58246: Flags [S.], seq 1324694501, ack 1074152416, win 28960, options [mss 1460,sackOK,TS val 1593113752 ecr 4010169358,nop,wscale 9], length 0
17:25:08.798005 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 4010169465 ecr 1593113752], length 0
17:25:08.798070 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [P.], seq 1:193, ack 1, win 502, options [nop,nop,TS val 4010169465 ecr 1593113752], length 192: HTTP: GET /variety-options-063 HTTP/1.1
17:25:08.903729 IP c8-tiny.cc.http > mx.DomainGi.58246: Flags [.], ack 193, win 59, options [nop,nop,TS val 1593113858 ecr 4010169465], length 0
17:25:08.903761 IP c8-tiny.cc.http > mx.DomainGi.58246: Flags [P.], seq 1:380, ack 193, win 59, options [nop,nop,TS val 1593113858 ecr 4010169465], length 379: HTTP: HTTP/1.1 301 Moved Permanently
17:25:08.903779 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [.], ack 380, win 501, options [nop,nop,TS val 4010169571 ecr 1593113858], length 0
17:25:08.906856 IP mx.DomainGi.48615 > RT-AC86U-7E00.DomainGi.domain: 31989+ A? tiny.cc. (25)
17:25:08.907181 IP mx.DomainGi.48615 > RT-AC86U-7E00.DomainGi.domain: 36348+ AAAA? tiny.cc. (25)
17:25:08.908276 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.48615: 31989 1/0/0 A 157.245.113.153 (41)
17:25:08.910325 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.48615: 36348 0/1/0 (99)
17:25:08.911959 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [S], seq 3469001550, win 64240, options [mss 1460,sackOK,TS val 4010169578 ecr 0,nop,wscale 7], length 0
17:25:09.017381 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [S.], seq 2814611549, ack 3469001551, win 28960, options [mss 1460,sackOK,TS val 1593113972 ecr 4010169578,nop,wscale 9], length 0
17:25:09.017447 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 4010169685 ecr 1593113972], length 0
17:25:09.039024 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 4010169706 ecr 1593113972], length 517
17:25:09.146366 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [.], ack 518, win 59, options [nop,nop,TS val 1593114101 ecr 4010169706], length 0
17:25:09.146756 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [P.], seq 1:4097, ack 518, win 59, options [nop,nop,TS val 1593114101 ecr 4010169706], length 4096
17:25:09.146796 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 4097, win 480, options [nop,nop,TS val 4010169814 ecr 1593114101], length 0
17:25:09.147181 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [P.], seq 4097:4572, ack 518, win 59, options [nop,nop,TS val 1593114102 ecr 4010169706], length 475
17:25:09.147202 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 4572, win 493, options [nop,nop,TS val 4010169814 ecr 1593114102], length 0
17:25:09.148107 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [P.], seq 518:598, ack 4572, win 501, options [nop,nop,TS val 4010169815 ecr 1593114102], length 80
17:25:09.148505 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [P.], seq 598:812, ack 4572, win 501, options [nop,nop,TS val 4010169816 ecr 1593114102], length 214
17:25:09.253902 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [P.], seq 4572:4843, ack 598, win 59, options [nop,nop,TS val 1593114208 ecr 4010169815], length 271
17:25:09.253939 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [P.], seq 4843:5114, ack 598, win 59, options [nop,nop,TS val 1593114208 ecr 4010169815], length 271
17:25:09.254092 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 5114, win 501, options [nop,nop,TS val 4010169921 ecr 1593114208], length 0
17:25:09.279708 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [P.], seq 5114:5850, ack 812, win 61, options [nop,nop,TS val 1593114234 ecr 4010169816], length 736
17:25:09.288884 IP mx.DomainGi.34183 > RT-AC86U-7E00.DomainGi.domain: 1860+ A? gist.githubusercontent.com. (44)
17:25:09.289234 IP mx.DomainGi.34183 > RT-AC86U-7E00.DomainGi.domain: 65101+ AAAA? gist.githubusercontent.com. (44)
17:25:09.292977 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.34183: 1860 4/8/9 A 185.199.111.133, A 185.199.108.133, A 185.199.110.133, A 185.199.109.133 (487)
17:25:09.293320 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.34183: 65101 0/1/0 (126)
17:25:09.295038 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [S], seq 339548720, win 64240, options [mss 1460,sackOK,TS val 2488934603 ecr 0,nop,wscale 7], length 0
17:25:09.295789 IP mx.DomainGi.57748 > RT-AC86U-7E00.DomainGi.domain: 31582+ PTR? 133.111.199.185.in-addr.arpa. (46)
17:25:09.315157 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [S.], seq 558708587, ack 339548721, win 65535, options [mss 1460,sackOK,TS val 2472614221 ecr 2488934603,nop,wscale 9], length 0
17:25:09.315276 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 2488934624 ecr 2472614221], length 0
17:25:09.325911 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.57748: 31582 1/4/8 PTR cdn-185-199-111-133.github.com. (355)
17:25:09.330004 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 2488934639 ecr 2472614221], length 517
17:25:09.331269 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 5850, win 501, options [nop,nop,TS val 4010169998 ecr 1593114234], length 0
17:25:09.351049 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [.], ack 518, win 285, options [nop,nop,TS val 2472614257 ecr 2488934639], length 0
17:25:09.352333 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [P.], seq 1:2889, ack 518, win 285, options [nop,nop,TS val 2472614258 ecr 2488934639], length 2888
17:25:09.352385 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [.], ack 2889, win 496, options [nop,nop,TS val 2488934662 ecr 2472614258], length 0
17:25:09.352423 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [P.], seq 2889:3830, ack 518, win 285, options [nop,nop,TS val 2472614258 ecr 2488934639], length 941
17:25:09.352444 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [.], ack 3830, win 489, options [nop,nop,TS val 2488934662 ecr 2472614258], length 0
17:25:09.353386 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [P.], seq 518:598, ack 3830, win 489, options [nop,nop,TS val 2488934663 ecr 2472614258], length 80
17:25:09.353799 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [P.], seq 598:915, ack 3830, win 489, options [nop,nop,TS val 2488934663 ecr 2472614258], length 317
17:25:09.373494 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [.], ack 598, win 285, options [nop,nop,TS val 2472614279 ecr 2488934663], length 0
17:25:09.374427 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [.], ack 915, win 287, options [nop,nop,TS val 2472614280 ecr 2488934663], length 0
17:25:09.375082 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [P.], seq 3830:5442, ack 915, win 287, options [nop,nop,TS val 2472614281 ecr 2488934663], length 1612
17:25:09.375113 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [.], ack 5442, win 499, options [nop,nop,TS val 2488934684 ecr 2472614281], length 0
17:25:09.376293 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [F.], seq 812, ack 5850, win 501, options [nop,nop,TS val 4010170043 ecr 1593114234], length 0
17:25:09.377326 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [F.], seq 915, ack 5442, win 501, options [nop,nop,TS val 2488934686 ecr 2472614281], length 0
17:25:09.378352 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [F.], seq 193, ack 380, win 501, options [nop,nop,TS val 4010170046 ecr 1593113858], length 0
17:25:09.396629 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [.], ack 916, win 287, options [nop,nop,TS val 2472614302 ecr 2488934686], length 0
17:25:09.396674 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [P.], seq 5442:5466, ack 916, win 287, options [nop,nop,TS val 2472614302 ecr 2488934686], length 24
17:25:09.396707 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [R], seq 339549636, win 0, length 0
17:25:09.396744 IP cdn-185-199-111-133.github.com.https > mx.DomainGi.57704: Flags [F.], seq 5466, ack 916, win 287, options [nop,nop,TS val 2472614302 ecr 2488934686], length 0
17:25:09.396765 IP mx.DomainGi.57704 > cdn-185-199-111-133.github.com.https: Flags [R], seq 339549636, win 0, length 0
17:25:09.481310 IP c8-tiny.cc.https > mx.DomainGi.44336: Flags [F.], seq 5850, ack 813, win 61, options [nop,nop,TS val 1593114436 ecr 4010170043], length 0
17:25:09.481364 IP mx.DomainGi.44336 > c8-tiny.cc.https: Flags [.], ack 5851, win 501, options [nop,nop,TS val 4010170149 ecr 1593114436], length 0
17:25:09.482602 IP c8-tiny.cc.http > mx.DomainGi.58246: Flags [F.], seq 380, ack 194, win 59, options [nop,nop,TS val 1593114437 ecr 4010170046], length 0
17:25:09.482637 IP mx.DomainGi.58246 > c8-tiny.cc.http: Flags [.], ack 381, win 501, options [nop,nop,TS val 4010170150 ecr 1593114437], length 0
17:25:12.114861 IP RT-AC86U-7E00.DomainGi > all-systems.mcast.net: igmp query v3
17:25:12.115321 IP mx.DomainGi.55418 > RT-AC86U-7E00.DomainGi.domain: 47713+ PTR? 1.0.0.224.in-addr.arpa. (40)
17:25:12.116208 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.55418: 47713 1/0/0 PTR all-systems.mcast.net. (75)
17:25:13.275979 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
17:25:13.276839 IP mx.DomainGi.56282 > RT-AC86U-7E00.DomainGi.domain: 30980+ PTR? 251.0.0.224.in-addr.arpa. (42)
17:25:13.280305 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.56282: 30980 NXDomain 0/1/0 (99)
17:25:13.499102 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:14.500673 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:15.072052 IP Sampo.DomainGi.mdns > 224.0.0.251.mdns: 27 [2q] PTR (QM)? _CC32E753._sub._googlecast._tcp.local. PTR (QM)? _googlecast._tcp.local. (61)
17:25:15.072918 IP mx.DomainGi.52763 > RT-AC86U-7E00.DomainGi.domain: 59606+ PTR? 211.2.168.192.in-addr.arpa. (44)
17:25:15.073870 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.52763: 59606* 1/0/0 PTR Sampo.DomainGi. (72)
17:25:16.501755 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:16.731312 IP mx.DomainGi.53654 > 104.21.20.249.https: Flags [.], ack 3561625449, win 5317, length 0
17:25:16.732194 IP mx.DomainGi.57771 > RT-AC86U-7E00.DomainGi.domain: 673+ PTR? 249.20.21.104.in-addr.arpa. (44)
17:25:16.743158 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.57771: 673 NXDomain 0/1/0 (106)
17:25:16.758380 IP 104.21.20.249.https > mx.DomainGi.53654: Flags [.], ack 1, win 69, length 0
17:25:18.267311 IP mx.DomainGi.35622 > 104.16.160.101.https: Flags [.], ack 1, win 501, length 0
17:25:18.273783 IP 104.16.160.101.https > mx.DomainGi.35622: Flags [.], ack 1, win 69, length 0
17:25:18.527260 IP mx.DomainGi.37392 > 104.17.50.74.https: Flags [.], ack 1, win 501, length 0
17:25:18.534678 IP 104.17.50.74.https > mx.DomainGi.37392: Flags [.], ack 1, win 67, length 0
17:25:20.501998 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:28.509094 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:31.835249 IP mx.DomainGi.53654 > 104.21.20.249.https: Flags [.], ack 1, win 5317, length 0
17:25:31.862839 IP 104.21.20.249.https > mx.DomainGi.53654: Flags [.], ack 1, win 69, length 0
17:25:32.134746 IP RT-AC86U-7E00.DomainGi > all-systems.mcast.net: igmp query v3
17:25:33.375313 IP mx.DomainGi.35622 > 104.16.160.101.https: Flags [.], ack 1, win 501, length 0
17:25:33.381515 IP 104.16.160.101.https > mx.DomainGi.35622: Flags [.], ack 1, win 69, length 0
17:25:33.627278 IP mx.DomainGi.37392 > 104.17.50.74.https: Flags [.], ack 1, win 501, length 0
17:25:33.633726 IP 104.17.50.74.https > mx.DomainGi.37392: Flags [.], ack 1, win 67, length 0
17:25:35.083076 IP Sampo.DomainGi.mdns > 224.0.0.251.mdns: 28 [2q] PTR (QM)? _CC32E753._sub._googlecast._tcp.local. PTR (QM)? _googlecast._tcp.local. (61)
17:25:43.637108 IP mx.DomainGi.41238 > RT-AC86U-7E00.DomainGi.domain: 46806+ A? 1.debian.pool.ntp.org. (39)
17:25:43.637427 IP mx.DomainGi.41238 > RT-AC86U-7E00.DomainGi.domain: 42976+ AAAA? 1.debian.pool.ntp.org. (39)
17:25:43.641630 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.41238: 42976 0/1/0 (94)
17:25:43.679420 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.41238: 46806 4/9/12 A 94.23.94.78, A 193.25.222.136, A 195.46.37.22, A 89.25.168.137 (445)
17:25:43.680200 IP mx.DomainGi.ntp > ntp11.kashra-server.com.ntp: NTPv4, Client, length 48
17:25:43.681378 IP mx.DomainGi.34783 > RT-AC86U-7E00.DomainGi.domain: 7379+ PTR? 78.94.23.94.in-addr.arpa. (42)
17:25:43.682366 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.34783: 7379 1/0/0 PTR ntp11.kashra-server.com. (79)
17:25:43.715996 IP ntp11.kashra-server.com.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:44.525161 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [7q] PTR (QM)? _ftp._tcp.local. PTR (QM)? _nfs._tcp.local. PTR (QM)? _afpovertcp._tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _sftp-ssh._tcp.local. PTR (QM)? _webdavs._tcp.local. PTR (QM)? _webdav._tcp.local. (118)
17:25:44.636445 IP mx.DomainGi.ntp > s.complex.net.net.ntp: NTPv4, Client, length 48
17:25:44.636892 IP mx.DomainGi.44399 > RT-AC86U-7E00.DomainGi.domain: 46742+ A? 0.debian.pool.ntp.org. (39)
17:25:44.637152 IP mx.DomainGi.44399 > RT-AC86U-7E00.DomainGi.domain: 63141+ AAAA? 0.debian.pool.ntp.org. (39)
17:25:44.637957 IP mx.DomainGi.36870 > RT-AC86U-7E00.DomainGi.domain: 23558+ PTR? 136.222.25.193.in-addr.arpa. (45)
17:25:44.641175 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.44399: 46742 4/9/12 A 149.156.70.60, A 213.199.225.30, A 94.172.186.238, A 162.159.200.123 (445)
17:25:44.641519 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.44399: 63141 0/1/0 (94)
17:25:44.642179 IP mx.DomainGi.ntp > tel50.oa.uj.edu.net.ntp: NTPv4, Client, length 48
17:25:44.687364 IP mx.DomainGi.55719 > RT-AC86U-7E00.DomainGi.domain: 21609+ PTR? 60.70.156.149.in-addr.arpa. (44)
17:25:44.688293 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.55719: 21609 1/0/0 PTR tel50.oa.uj.edu.net. (76)
17:25:45.276633 IP mx.DomainGi.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
17:25:45.636399 IP mx.DomainGi.ntp > ntp.wide-net.net.ntp: NTPv4, Client, length 48
17:25:45.636701 IP mx.DomainGi.ntp > ntp.tktelekom.net.ntp: NTPv4, Client, length 48
17:25:45.637435 IP mx.DomainGi.53787 > RT-AC86U-7E00.DomainGi.domain: 40096+ PTR? 22.37.46.195.in-addr.arpa. (43)
17:25:45.647999 IP ntp.tktelekom.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:45.650333 IP ntp.wide-net.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:45.659155 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.53787: 40096 1/2/3 PTR ntp.wide-net.net. (173)
17:25:45.659538 IP mx.DomainGi.60632 > RT-AC86U-7E00.DomainGi.domain: 17544+ PTR? 30.225.199.213.in-addr.arpa. (45)
17:25:45.670692 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.60632: 17544 1/2/2 PTR ntp.tktelekom.net. (154)
17:25:46.635743 IP mx.DomainGi.ntp > ntp.wide-net.net.ntp: NTPv4, Client, length 48
17:25:46.636994 IP mx.DomainGi.ntp > host-168-137.prnet.net.ntp: NTPv4, Client, length 48
17:25:46.637452 IP mx.DomainGi.ntp > 94-172-186-238.dynamic.chello.net.ntp: NTPv4, Client, length 48
17:25:46.637855 IP mx.DomainGi.42378 > RT-AC86U-7E00.DomainGi.domain: 10988+ A? 2.debian.pool.ntp.org. (39)
17:25:46.638104 IP mx.DomainGi.42378 > RT-AC86U-7E00.DomainGi.domain: 31755+ AAAA? 2.debian.pool.ntp.org. (39)
17:25:46.638661 IP mx.DomainGi.41877 > RT-AC86U-7E00.DomainGi.domain: 53662+ PTR? 137.168.25.89.in-addr.arpa. (44)
17:25:46.639373 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.41877: 53662 1/0/0 PTR host-168-137.prnet.net. (79)
17:25:46.639777 IP mx.DomainGi.34075 > RT-AC86U-7E00.DomainGi.domain: 49898+ PTR? 238.186.172.94.in-addr.arpa. (45)
17:25:46.640507 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.34075: 49898 1/0/0 PTR 94-172-186-238.dynamic.chello.net. (91)
17:25:46.648872 IP ntp.wide-net.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:46.655688 IP 94-172-186-238.dynamic.chello.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:46.666460 IP host-168-137.prnet.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:46.672144 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.42378: 10988 4/9/12 A 54.38.193.17, A 213.199.225.40, A 193.70.94.126, A 149.156.24.2 (445)
17:25:46.672239 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.42378: 31755 4/9/12 AAAA 2001:67c:24c:1::20, AAAA 2001:470:6e:f4::2, AAAA 2606:4700:f1::1, AAAA 2a00:d5c0:10:10::136 (493)
17:25:46.673730 IP mx.DomainGi.ntp > case.eigensystems.net.ntp: NTPv4, Client, length 48
17:25:46.674423 IP mx.DomainGi.51775 > RT-AC86U-7E00.DomainGi.domain: 55706+ PTR? 17.193.38.54.in-addr.arpa. (43)
17:25:46.682540 IP case.eigensystems.net.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:46.719036 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.51775: 55706 1/2/4 PTR case.eigensystems.net. (213)
17:25:46.939258 IP mx.DomainGi.53654 > 104.21.20.249.https: Flags [.], ack 1, win 5317, length 0
17:25:46.966276 IP 104.21.20.249.https > mx.DomainGi.53654: Flags [.], ack 1, win 69, length 0
17:25:47.636229 IP mx.DomainGi.ntp > ntp2.tktelekom.net.ntp: NTPv4, Client, length 48
17:25:47.636655 IP mx.DomainGi.52146 > RT-AC86U-7E00.DomainGi.domain: 18994+ A? 3.debian.pool.ntp.org. (39)
17:25:47.636909 IP mx.DomainGi.ntp > time.cloudflare.com.ntp: NTPv4, Client, length 48
17:25:47.637146 IP mx.DomainGi.52146 > RT-AC86U-7E00.DomainGi.domain: 22592+ AAAA? 3.debian.pool.ntp.org. (39)
17:25:47.637619 IP mx.DomainGi.34471 > RT-AC86U-7E00.DomainGi.domain: 16629+ PTR? 40.225.199.213.in-addr.arpa. (45)
17:25:47.641451 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.52146: 22592 0/1/0 (94)
17:25:47.644414 IP time.cloudflare.com.ntp > mx.DomainGi.ntp: NTPv4, Server, length 48
17:25:47.648726 IP mx.DomainGi.42081 > RT-AC86U-7E00.DomainGi.domain: 30241+ PTR? 123.200.159.162.in-addr.arpa. (46)
17:25:47.678006 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.42081: 30241 1/2/12 PTR time.cloudflare.com. (384)
17:25:47.698500 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.52146: 18994 4/9/12 A 94.154.96.7, A 162.159.200.1, A 91.212.242.20, A 194.177.4.1 (445)
17:25:47.699400 IP mx.DomainGi.ntp > 96-7.cpe.smnt.net.ntp: NTPv4, Client, length 48
17:25:47.699728 IP mx.DomainGi.59703 > RT-AC86U-7E00.DomainGi.domain: 23655+ A? 1.debian.pool.ntp.org. (39)
17:25:47.700069 IP mx.DomainGi.59703 > RT-AC86U-7E00.DomainGi.domain: 11637+ AAAA? 1.debian.pool.ntp.org. (39)
17:25:47.700515 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.59703: 23655 4/0/0 A 89.25.168.137, A 195.46.37.22, A 193.25.222.136, A 94.23.94.78 (103)
17:25:47.700739 IP mx.DomainGi.53494 > RT-AC86U-7E00.DomainGi.domain: 3456+ PTR? 7.96.154.94.in-addr.arpa. (42)
17:25:47.701443 IP RT-AC86U-7E00.DomainGi.domain > mx.DomainGi.53494: 3456 1/0/0 PTR 96-7.cpe.smnt.net. (72)