This is capture from MX --- Start Of Stream --- tcpdump: listening on wan0_sniff, link-type EN10MB (Ethernet), capture size 262144 bytes 21:18:39.008602 IP (tos 0x0, ttl 200, id 1491, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1491, length 64 21:18:39.015503 IP (tos 0x0, ttl 254, id 1491, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1491, length 64 21:18:42.012602 IP (tos 0x0, ttl 200, id 1492, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1492, length 64 21:18:42.015627 IP (tos 0x0, ttl 254, id 1492, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1492, length 64 21:18:45.016602 IP (tos 0x0, ttl 200, id 1493, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1493, length 64 21:18:45.019585 IP (tos 0x0, ttl 254, id 1493, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1493, length 64 21:18:45.527085 IP (tos 0xc0, ttl 2, id 28770, offset 0, flags [DF], proto TCP (6), length 44) 10.5.6.1.46450 > 10.5.3.14.179: Flags [S], cksum 0x343b (correct), seq 3531898408, win 16384, options [mss 1460], length 0 21:18:45.527124 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 44) 10.5.3.14.179 > 10.5.6.1.46450: Flags [S.], cksum 0x2f57 (correct), seq 1159302569, ack 3531898409, win 29200, options [mss 1460], length 0 21:18:45.527507 IP (tos 0xc0, ttl 2, id 28771, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.46450 > 10.5.3.14.179: Flags [.], cksum 0x7924 (correct), seq 1, ack 1, win 16384, length 0 21:18:45.527574 IP (tos 0xc0, ttl 255, id 48558, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.46450: Flags [F.], cksum 0x4713 (correct), seq 1, ack 1, win 29200, length 0 21:18:45.527779 IP (tos 0xc0, ttl 2, id 28772, offset 0, flags [DF], proto TCP (6), length 97) 10.5.6.1.46450 > 10.5.3.14.179: Flags [P.], cksum 0x5a00 (correct), seq 1:58, ack 1, win 16384, length 57: BGP Open Message (1), length: 57 Version 4, my AS 64984, Holdtime 180s, ID 10.1.3.6 Optional parameters, length: 28 Option Capabilities Advertisement (2), length: 6 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) 0x0000: 0001 0001 Option Capabilities Advertisement (2), length: 2 Route Refresh (Cisco) (128), length: 0 Option Capabilities Advertisement (2), length: 2 Route Refresh (2), length: 0 Option Capabilities Advertisement (2), length: 2 Enhanced Route Refresh (70), length: 0 no decoder for Capability 70 Option Capabilities Advertisement (2), length: 6 32-Bit AS Number (65), length: 4 4 Byte AS 64984 0x0000: 0000 fdd8 21:18:45.527798 IP (tos 0xc0, ttl 64, id 19177, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.46450: Flags [R], cksum 0x09df (correct), seq 1159302570, win 0, length 0 21:18:45.527892 IP (tos 0xc0, ttl 2, id 28773, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.46450 > 10.5.3.14.179: Flags [.], cksum 0x78ea (correct), seq 58, ack 2, win 16384, length 0 21:18:45.527903 IP (tos 0xc0, ttl 64, id 19178, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.46450: Flags [R], cksum 0x09de (correct), seq 1159302571, win 0, length 0 21:18:45.528233 IP (tos 0xc0, ttl 2, id 28774, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.46450 > 10.5.3.14.179: Flags [FP.], cksum 0x78e1 (correct), seq 58, ack 2, win 16384, length 0 21:18:45.528245 IP (tos 0xc0, ttl 64, id 19179, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.46450: Flags [R], cksum 0x09de (correct), seq 1159302571, win 0, length 0 21:18:45.528339 IP (tos 0xc0, ttl 2, id 28775, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.46450 > 10.5.3.14.179: Flags [.], cksum 0x78e9 (correct), seq 59, ack 2, win 16384, length 0 21:18:45.528349 IP (tos 0xc0, ttl 64, id 19180, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.46450: Flags [R], cksum 0x09de (correct), seq 1159302571, win 0, length 0 21:18:48.016602 IP (tos 0x0, ttl 200, id 1494, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1494, length 64 21:18:48.019635 IP (tos 0x0, ttl 254, id 1494, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1494, length 64 21:18:51.020603 IP (tos 0x0, ttl 200, id 1495, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1495, length 64 21:18:51.023513 IP (tos 0x0, ttl 254, id 1495, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1495, length 64 21:18:54.024603 IP (tos 0x0, ttl 200, id 1496, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1496, length 64 21:18:54.027548 IP (tos 0x0, ttl 254, id 1496, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1496, length 64 21:18:57.024603 IP (tos 0x0, ttl 200, id 1497, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1497, length 64 21:18:57.031496 IP (tos 0x0, ttl 254, id 1497, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1497, length 64 21:18:59.864853 IP (tos 0xc0, ttl 2, id 52585, offset 0, flags [DF], proto TCP (6), length 44) 10.5.6.1.30784 > 10.5.3.14.179: Flags [S], cksum 0x9b58 (correct), seq 2819194552, win 16384, options [mss 1460], length 0 21:18:59.864918 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 44) 10.5.3.14.179 > 10.5.6.1.30784: Flags [S.], cksum 0x5b27 (correct), seq 3235663155, ack 2819194553, win 29200, options [mss 1460], length 0 21:18:59.865310 IP (tos 0xc0, ttl 2, id 52586, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.30784 > 10.5.3.14.179: Flags [.], cksum 0xa4f4 (correct), seq 1, ack 1, win 16384, length 0 21:18:59.865399 IP (tos 0xc0, ttl 255, id 29488, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.30784: Flags [F.], cksum 0x72e3 (correct), seq 1, ack 1, win 29200, length 0 21:18:59.865626 IP (tos 0xc0, ttl 2, id 52587, offset 0, flags [DF], proto TCP (6), length 97) 10.5.6.1.30784 > 10.5.3.14.179: Flags [P.], cksum 0x85d0 (correct), seq 1:58, ack 1, win 16384, length 57: BGP Open Message (1), length: 57 Version 4, my AS 64984, Holdtime 180s, ID 10.1.3.6 Optional parameters, length: 28 Option Capabilities Advertisement (2), length: 6 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) 0x0000: 0001 0001 Option Capabilities Advertisement (2), length: 2 Route Refresh (Cisco) (128), length: 0 Option Capabilities Advertisement (2), length: 2 Route Refresh (2), length: 0 Option Capabilities Advertisement (2), length: 2 Enhanced Route Refresh (70), length: 0 no decoder for Capability 70 Option Capabilities Advertisement (2), length: 6 32-Bit AS Number (65), length: 4 4 Byte AS 64984 0x0000: 0000 fdd8 21:18:59.865668 IP (tos 0xc0, ttl 64, id 20706, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.30784: Flags [R], cksum 0x0bc4 (correct), seq 3235663156, win 0, length 0 21:18:59.865865 IP (tos 0xc0, ttl 2, id 52588, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.30784 > 10.5.3.14.179: Flags [.], cksum 0xa4ba (correct), seq 58, ack 2, win 16384, length 0 21:18:59.865893 IP (tos 0xc0, ttl 64, id 20707, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.30784: Flags [R], cksum 0x0bc3 (correct), seq 3235663157, win 0, length 0 21:18:59.866069 IP (tos 0xc0, ttl 2, id 52589, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.30784 > 10.5.3.14.179: Flags [FP.], cksum 0xa4b1 (correct), seq 58, ack 2, win 16384, length 0 21:18:59.866078 IP (tos 0xc0, ttl 64, id 20708, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.30784: Flags [R], cksum 0x0bc3 (correct), seq 3235663157, win 0, length 0 21:18:59.866633 IP (tos 0xc0, ttl 2, id 52590, offset 0, flags [DF], proto TCP (6), length 40) 10.5.6.1.30784 > 10.5.3.14.179: Flags [.], cksum 0xa4b9 (correct), seq 59, ack 2, win 16384, length 0 21:18:59.866717 IP (tos 0xc0, ttl 64, id 20709, offset 0, flags [DF], proto TCP (6), length 40) 10.5.3.14.179 > 10.5.6.1.30784: Flags [R], cksum 0x0bc3 (correct), seq 3235663157, win 0, length 0 21:19:00.028603 IP (tos 0x0, ttl 200, id 1498, offset 0, flags [none], proto ICMP (1), length 84) 10.5.3.14 > 10.5.6.1: ICMP echo request, id 39906, seq 1498, length 64 21:19:00.031605 IP (tos 0x0, ttl 254, id 1498, offset 0, flags [none], proto ICMP (1), length 84) 10.5.6.1 > 10.5.3.14: ICMP echo reply, id 39906, seq 1498, length 64 --- End Of Stream ---
... View more