Announcement

Collapse
No announcement yet.

Firewall causing video lag in Hangouts

Collapse
This topic is closed.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Firewall causing video lag in Hangouts

    It's taken me some time to narrow down what's going on here. At first I thought outgoing video was being blocked altogether but it turns out that is not the case.

    I have a quad core 3GHz PC with 8GB of RAM, with Kubuntu 12.04, running iptables, acting as my firewall/router. Eth1 connects to the bresnanoptimumcharter modem, where I have an 18/2 connection. Eth0 connects to a 100mb, unmanaged switch. From there are two wireless routers acting as straight-up access points, at either end of the house. The problem occurs whether connected via wireless or ethernet. I did however, connect my PC directly to eth0 via ethernet cable, removing the rest of the network, and the problem was still there. When connecting my PC directly to the modem, the problem is gone.

    What happens is, I can connect to google hangouts, I can see my own video in the small box at the bottom, I can see other people's video fine but no one can see my video. Chat, audio and plugins all work fine, I just can't send video. This problem is not restricted to just my PC however. I've tried this on every PC in the house, on different google accounts, as well as on my thrive android tablet and two droid razr phones. Always the same, video will not send out. If I remove the droids from the wireless and connect over the 4G, video sends out fine, all is well.

    Something else I noticed, when at work, I route all of my browser traffic to my home, through an ssh tunnel and hangouts works flawlessly there, video and audio. That is still going through my firewall and out eth1 on the firewall PC however, the difference is that it's not passing through eth0. I'm not sure how that helps me but I'm sure it's significant.

    All this time I thought that outgoing video was being blocked somehow but last night I discovered that what's actually happening is that it's severely lagging. If I join a hangout and wait for a few minutes, a single frame from my webcam will come up on the main screen. Although in the smaller bar at the bottom, where you see everyone's video, mine is showing up at normal speed. What everyone else sees though, is just that one frame. I hope that made sense. So it appears that the video is going through but is extremely laggy.

    I've watched top and some monitoring widgets in KDE and while using hangouts, there are no significant spikes in network, CPU or memory usage. They all seem to stay at normal levels. So it seems that something on my firewall is throttling the connection down somehow, or something like that, I'm not really sure. Again, incoming video, from the other hangout participants, works fine. It's just my outgoing video that lags.

    Would anyone have any idea where I could look to figure out what's causing this?

    Thanks!

    Output of 'iptables --list', in case it might be helpful:
    Code:
    Chain INPUT (policy DROP)
    target     prot opt source               destination
    DROP       tcp  --  anywhere             anywhere             state NEW recent: UPDATE seconds: 15 name: DEFAULT side: source tcp dpt:ssh
    ACCEPT     tcp  --  anywhere             anywhere             state NEW recent: SET name: DEFAULT side: source tcp dpt:ssh
    ACCEPT     all  --  anywhere             anywhere
    bad_packets  all  --  anywhere             anywhere
    ACCEPT     all  --  192.168.58.0/24      anywhere
    ACCEPT     all  --  anywhere             192.168.58.255
    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
    tcp_inbound  tcp  --  anywhere             anywhere
    udp_inbound  udp  --  anywhere             anywhere
    icmp_packets  icmp --  anywhere             anywhere
    DROP       all  --  anywhere             anywhere             PKTTYPE = broadcast
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 3 LOG level warning prefix "INPUT packet died: "
    DROP       all  --  anywhere             anywhere             state INVALID
    ACCEPT     all  --  192.168.57.0/24      anywhere
    ACCEPT     all  --  anywhere             192.168.57.255
    ACCEPT     all  --  192.168.59.0/24      anywhere
    ACCEPT     all  --  anywhere             192.168.59.255
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination
    bad_packets  all  --  anywhere             anywhere
    tcp_outbound  tcp  --  anywhere             anywhere
    udp_outbound  udp  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 3 LOG level warning prefix "FORWARD packet died: "
    ACCEPT     all  --  anywhere             anywhere
    DROP       all  --  anywhere             anywhere             state INVALID
    tcp_outbound  tcp  --  anywhere             anywhere
    udp_outbound  udp  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    tcp_outbound  tcp  --  anywhere             anywhere
    udp_outbound  udp  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    
    Chain OUTPUT (policy DROP)
    target     prot opt source               destination
    ACCEPT     all  --  aragorn              anywhere
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  home                 anywhere
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 3 LOG level warning prefix "OUTPUT packet died: "
    DROP       all  --  anywhere             anywhere             state INVALID
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    
    Chain bad_packets (2 references)
    target     prot opt source               destination
    LOG        all  --  192.168.58.0/24      anywhere             LOG level warning prefix "Illegal source: "
    DROP       all  --  192.168.58.0/24      anywhere
    LOG        all  --  anywhere             anywhere             state INVALID LOG level info prefix "Invalid packet: "
    DROP       all  --  anywhere             anywhere             state INVALID
    bad_tcp_packets  tcp  --  anywhere             anywhere
    RETURN     all  --  anywhere             anywhere
    
    Chain bad_tcp_packets (1 references)
    target     prot opt source               destination
    RETURN     tcp  --  anywhere             anywhere
    LOG        tcp  --  anywhere             anywhere             tcpflags:! FIN,SYN,RST,ACK/SYN state NEW LOG level warning prefix "New not syn: "
    DROP       tcp  --  anywhere             anywhere             tcpflags:! FIN,SYN,RST,ACK/SYN state NEW
    LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE
    LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
    LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
    LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
    LOG        tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST
    LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN LOG level warning prefix "Stealth scan: "
    DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN
    RETURN     tcp  --  anywhere             anywhere
    RETURN     tcp  --  anywhere             anywhere
    RETURN     tcp  --  anywhere             anywhere
    
    Chain icmp_packets (1 references)
    target     prot opt source               destination
    LOG        icmp -f  anywhere             anywhere             LOG level warning prefix "ICMP Fragment: "
    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
    ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
    RETURN     icmp --  anywhere             anywhere
    
    Chain tcp_inbound (1 references)
    target     prot opt source               destination
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:openvpn
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:1723
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:3030
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:3031
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:5121
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:xmpp-client:5224
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:5900
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:8000
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:9293
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:9987
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:webmin
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10001
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10008
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10009
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:10010
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:10070:amanda
    ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:19305:19309
    RETURN     tcp  --  anywhere             anywhere
    
    Chain tcp_outbound (3 references)
    target     prot opt source               destination
    ACCEPT     tcp  --  anywhere             anywhere
    
    Chain udp_inbound (1 references)
    target     prot opt source               destination
    DROP       udp  --  anywhere             anywhere             udp dpt:netbios-ns
    DROP       udp  --  anywhere             anywhere             udp dpt:netbios-dgm
    ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:https
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:1723
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:3030
    ACCEPT     udp  --  anywhere             anywhere             udp dpts:3478:3479
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:3658
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10070
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:5121
    ACCEPT     udp  --  anywhere             anywhere             udp dpts:xmpp-client:5224
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:8000
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:9987
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10000
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10001
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10008
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10009
    ACCEPT     udp  --  anywhere             anywhere             udp dpt:10010
    ACCEPT     udp  --  anywhere             anywhere             udp dpts:19305:19309
    RETURN     udp  --  anywhere             anywhere
    
    Chain udp_outbound (3 references)
    target     prot opt source               destination
    ACCEPT     udp  --  anywhere             anywhere
    Last edited by deadtom; Sep 05, 2013, 03:31 PM. Reason: added in iptables --list output

    #2
    Here is the problem:


    Code:
    Sep  5 20:53:52 srv1 kernel: [17316.362778] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:53:53 srv1 kernel: [17316.613384] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:53:53 srv1 kernel: [17317.137580] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:53:54 srv1 kernel: [17318.180523] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:53:55 srv1 kernel: [17319.046480] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46769 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:53:56 srv1 kernel: [17320.268026] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:54:00 srv1 kernel: [17324.440652] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0
    Sep  5 20:54:09 srv1 kernel: [17332.781812] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:54:25 srv1 kernel: [17349.455201] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46768 WINDOW=0 RES=0x00 RST URGP=0 
    Sep  5 20:54:29 srv1 kernel: [17352.974417] Invalid packet: IN=eth1 OUT= MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.161.13 DST=<My IP> LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=46769 WINDOW=0 RES=0x00 RST URGP=0
    Every time I start a hangout, syslog gets flooded with these. That IP is a Google IP. So the question is, why are these packets being classified as invalid? MTU problem?

    Comment


      #3
      These are RST packets. My suspicion is that they're arriving late. Conntrack can't match them against any established sessions so it marks the packets as invalid. You do have a drop rule, but I'm a little suspicious of these two lines in your INPUT chain:
      Code:
      Chain INPUT (policy DROP)
      target     prot opt source               destination
      ...
      [B]ACCEPT     all  --  anywhere             anywhere
      bad_packets  all  --  anywhere             anywhere[/B]
      ...
      You might be accepting those invalid packets rather than dropping them. Let's do a little more debugging, and increase verbosity to see which interfaces the rules are attached to. Please show the output of:
      Code:
      iptables -n -L -v
      
      iptables -t nat -n -L -v
      
      iptables -t mangle -n -L -v
      Also, let's make conntrack a little chattier and have it tell us why those packets are invalid:
      Code:
      echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid
      After the above, what's in your syslog?

      Comment


        #4
        Thank you very much for your help.

        Here are the outputs you asked for.


        iptables -n -L -v:

        Code:
        Chain INPUT (policy DROP 1 packets, 44 bytes)
         pkts bytes target     prot opt in     out     source               destination         
            0     0 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state NEW recent: UPDATE seconds: 15 name: DEFAULT side: source tcp dpt:22
            0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state NEW recent: SET name: DEFAULT side: source tcp dpt:22
            0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
        17016   26M bad_packets  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
        17014   26M ACCEPT     all  --  eth0   *       192.168.58.0/24      0.0.0.0/0           
            0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            192.168.58.255      
            0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
            0     0 tcp_inbound  tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
            2   355 udp_inbound  udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
            0     0 icmp_packets  icmp --  eth1   *       0.0.0.0/0            0.0.0.0/0           
            0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = broadcast
            1    44 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 3 LOG flags 0 level 6 prefix "INPUT packet died: "
            0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
            0     0 ACCEPT     all  --  tap0   *       192.168.57.0/24      0.0.0.0/0           
            0     0 ACCEPT     all  --  tap0   *       0.0.0.0/0            192.168.57.255      
            0     0 ACCEPT     all  --  ppp+   *       192.168.59.0/24      0.0.0.0/0           
            0     0 ACCEPT     all  --  ppp+   *       0.0.0.0/0            192.168.59.255      
        
        Chain FORWARD (policy DROP 0 packets, 0 bytes)
         pkts bytes target     prot opt in     out     source               destination         
          802  692K bad_packets  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
            9   569 tcp_outbound  tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
          301  170K udp_outbound  udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
            0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
          492  522K ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
            0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 3 LOG flags 0 level 6 prefix "FORWARD packet died: "                              
            0     0 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0                                                                                                       
            0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID                                                                              
            0     0 tcp_outbound  tcp  --  tap0   *       0.0.0.0/0            0.0.0.0/0                                                                                                    
            0     0 udp_outbound  udp  --  tap0   *       0.0.0.0/0            0.0.0.0/0                                                                                                    
            0     0 ACCEPT     all  --  tap0   *       0.0.0.0/0            0.0.0.0/0                                                                                                       
            0     0 tcp_outbound  tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0                                                                                                    
            0     0 udp_outbound  udp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0                                                                                                    
            0     0 ACCEPT     all  --  ppp+   *       0.0.0.0/0            0.0.0.0/0                                                                                                       
                                                                                                                                                                                            
        Chain OUTPUT (policy DROP 0 packets, 0 bytes)                                                                                                                                       
         pkts bytes target     prot opt in     out     source               destination                                                                                                     
            0     0 ACCEPT     all  --  *      *       127.0.0.1            0.0.0.0/0                                                                                                       
            0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0                                                                                                       
         8677  461K ACCEPT     all  --  *      *       192.168.58.1         0.0.0.0/0                                                                                                       
            0     0 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0                                                                                                       
            0     0 ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0                                                                                                       
            0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 3 LOG flags 0 level 6 prefix "OUTPUT packet died: "                 
            0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID                                                                              
            0     0 ACCEPT     all  --  *      tap0    0.0.0.0/0            0.0.0.0/0                                                                                                       
            0     0 ACCEPT     all  --  *      ppp+    0.0.0.0/0            0.0.0.0/0                                                                                                       
                                                                                                                                                                                            
        Chain bad_packets (2 references)                                                                                                                                                    
         pkts bytes target     prot opt in     out     source               destination         
            0     0 LOG        all  --  eth1   *       192.168.58.0/24      0.0.0.0/0            LOG flags 0 level 4 prefix "Illegal source: "
            0     0 DROP       all  --  eth1   *       192.168.58.0/24      0.0.0.0/0           
            0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "
            0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
        17027   26M bad_tcp_packets  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
        17818   26M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
        
        Chain bad_tcp_packets (1 references)
         pkts bytes target     prot opt in     out     source               destination         
        17021   26M RETURN     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags:! 0x17/0x02 state NEW LOG flags 0 level 4 prefix "New not syn: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags:! 0x17/0x02 state NEW
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x00 LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x00
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x3F LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x3F
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x29 LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x29
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x37 LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x37
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x06 LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x06
            0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x03/0x03 LOG flags 0 level 4 prefix "Stealth scan: "
            0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x03/0x03
            6   682 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
            0     0 RETURN     tcp  --  tap0   *       0.0.0.0/0            0.0.0.0/0           
            0     0 RETURN     tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           
        
        Chain icmp_packets (1 references)
         pkts bytes target     prot opt in     out     source               destination         
            0     0 LOG        icmp -f  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "ICMP Fragment: "
            0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
            0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
            0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
        
        Chain tcp_inbound (1 references)
         pkts bytes target     prot opt in     out     source               destination         
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
            0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1194
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3030
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3031
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5121
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:5222:5224
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5900
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8000
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9293
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9987
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10000
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10001
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10008
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10009
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10010
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:10070:10080
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:19305:19309
            0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:27979
            0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
        
        Chain tcp_outbound (3 references)
         pkts bytes target     prot opt in     out     source               destination         
            9   569 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
        
        Chain udp_inbound (1 references)
         pkts bytes target     prot opt in     out     source               destination         
            0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
            0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
            1   311 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
            0     0 ACCEPT     udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:80
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1723
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3030
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:3478:3479
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3658
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10070
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5121
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:5222:5224
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:8000
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:9987
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10000
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10001
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10008
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10009
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10010
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:19305:19309
            0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:27979
            1    44 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           
        
        Chain udp_outbound (3 references)
         pkts bytes target     prot opt in     out     source               destination         
          301  170K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0
        iptables -t nat -n -L -v:

        Code:
        Chain PREROUTING (policy ACCEPT 325 packets, 109K bytes)
         pkts bytes target     prot opt in     out     source               destination         
            4   240 REDIRECT   tcp  --  *      *       192.168.58.20        0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.23        0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.3         0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.19        0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.7         0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.40        0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 REDIRECT   tcp  --  *      *       192.168.58.24        0.0.0.0/0            tcp dpt:80 redir ports 8118
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9293 to:192.168.58.37:9293
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8000 to:192.168.58.1:8000
            0     0 DNAT       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:8000 to:192.168.58.1:8000
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10008 to:192.168.58.1:80
            0     0 DNAT       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:10008 to:192.168.58.1:80
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10009 to:192.168.58.26:80
            0     0 DNAT       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:10009 to:192.168.58.26:80
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10010 to:192.168.58.17:22
            0     0 DNAT       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:10010 to:192.168.58.17:22
            0     0 DNAT       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:27978 to:192.168.58.11:27977
            0     0 DNAT       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            udp dpt:27978 to:192.168.58.11:27977
        
        Chain INPUT (policy ACCEPT 8 packets, 508 bytes)
         pkts bytes target     prot opt in     out     source               destination         
        
        Chain OUTPUT (policy ACCEPT 17 packets, 1136 bytes)
         pkts bytes target     prot opt in     out     source               destination         
        
        Chain POSTROUTING (policy ACCEPT 9 packets, 570 bytes)
         pkts bytes target     prot opt in     out     source               destination         
           10   686 MASQUERADE  all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
            0     0 MASQUERADE  all  --  *      eth1    192.168.58.0/24      0.0.0.0/0
        sudo iptables -t mangle -n -L -v:

        Code:
        Chain PREROUTING (policy ACCEPT 211K packets, 305M bytes)
         pkts bytes target     prot opt in     out     source               destination         
        
        Chain INPUT (policy ACCEPT 202K packets, 300M bytes)
         pkts bytes target     prot opt in     out     source               destination         
        
        Chain FORWARD (policy ACCEPT 8509 packets, 5238K bytes)
         pkts bytes target     prot opt in     out     source               destination         
           58  3480 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU
        
        Chain OUTPUT (policy ACCEPT 106K packets, 8346K bytes)
         pkts bytes target     prot opt in     out     source               destination         
        
        Chain POSTROUTING (policy ACCEPT 114K packets, 14M bytes)
         pkts bytes target     prot opt in     out     source               destination
        I tried to run "echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid" but I get a "permission denied". With or without sudo.

        Comment


          #5
          I managed to set it using "sysctl -w net.netfilter.nf_conntrack_log_invalid=255".

          However, for some reason today, miraculously, I'm no longer seeing invalid packets coming from google when I join a hangout. Video still isn't sending out though.

          Now I'm even more stumped.

          Comment


            #6
            I temporarily opened my firewall up, wide open, to test it out.

            sudo iptables -L -n:

            Code:
            Chain INPUT (policy ACCEPT)
            target     prot opt source               destination         
            ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1:65535
            ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpts:1:65535
            ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
            DROP       all  --  0.0.0.0/0            0.0.0.0/0           
            
            Chain FORWARD (policy DROP)
            target     prot opt source               destination         
            ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
            ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
            LOG        all  --  0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4
            
            Chain OUTPUT (policy ACCEPT)
            target     prot opt source               destination         
            ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1:65535
            ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpts:1:65535
            Hangouts still isn't working properly.

            Comment


              #7
              With the added flags, the command output now tells us enough to know that the earlier bolded rule isn't overriding the second, because they apply to different interfaces:
              Code:
              Chain INPUT (policy DROP 1 packets, 44 bytes)
               pkts bytes target     prot opt in     out     source               destination         
              ...
              [B]    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
              17016   26M bad_packets  all  --  *      *       0.0.0.0/0            0.0.0.0/0[/B]
              ...
              Interestingly, bad_packets has seen 26 MB of traffic. But according to the chain info, no invalid packets are getting dropped:
              Code:
              Chain bad_packets (2 references)                                                                                                                                                    
               pkts bytes target     prot opt in     out     source               destination         
              ...
                  0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "
                  0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
              17027   26M bad_tcp_packets  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
              17818   26M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
              Instead, it's all being handled by bad_tcp_packets:
              Code:
              Chain bad_tcp_packets (1 references)
               pkts bytes target     prot opt in     out     source               destination         
              17021   26M RETURN     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0
              ...
              Why is your RETURN statement at the top here?


              For obtaining the extra conntrack logging, I should have provided the correct sudoized version. But sysctl is another route. It's unfortunate you aren't getting any more invalid packets...I'd be interested in seeing conntrack's reasons for its decision.


              Are you able to send video if you disable iptables completely? If so, capture a packet trace. Then re-enable iptables, try video while capturing another packet trace, and compare the results. I really think you're going to have to get down to (or, ah, onto, heh) the wire here.

              Comment


                #8
                Why is your RETURN statement at the top here?
                Honestly, I have no idea. I'm assuming it should be further down someplace? I'm not exactly fluent in iptables.

                Are you able to send video if you disable iptables completely?
                If I do that, no traffic will pass through the machine from the internet to my network, or vice versa. So unfortunately, that won't be any help.

                What I did do was strip all but the most basic rules out of iptables so that the firewall is wide open, allowing all traffic through, unless I'm mistaken. Still, that made no difference. Video still wasn't working properly in hangouts.

                I'll do that again tonight and try to make some hangouts connections, then post the output of iptables -L -n -v, and see if that reveals anything interesting.

                Thanks again for your help!

                Comment


                  #9
                  Ok, I did a sudo sysctl -w net.netfilter.nf_conntrack_log_invalid=255, opened the firewall wide open and tried a video hangout.

                  Output of iptables -L -n -v:

                  Code:
                  Chain INPUT (policy ACCEPT 4 packets, 120 bytes)
                   pkts bytes target     prot opt in     out     source               destination
                      0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "
                      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
                  77267  115M bad_packets  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
                  77182  115M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:1:65535
                     81 11193 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:1:65535
                      0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
                      0     0 DROP       all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
                  
                  Chain FORWARD (policy DROP 0 packets, 0 bytes)
                   pkts bytes target     prot opt in     out     source               destination
                   6859 3885K ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
                   4897 2257K ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0           
                      0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "
                      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
                  
                  Chain OUTPUT (policy ACCEPT 15 packets, 6234 bytes)
                   pkts bytes target     prot opt in     out     source               destination
                  40661 2183K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:1:65535
                     72 18719 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:1:65535
                      0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "                                
                      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID                                                                              
                                                                                                                                                                                                      
                  Chain bad_packets (1 references)                                                                                                                                                    
                   pkts bytes target     prot opt in     out     source               destination                                                                                                     
                      0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 0 level 6 prefix "Invalid packet: "                                
                      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID                                                                              
                  77182  115M bad_tcp_packets  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                                 
                                                                                                                                                                                                      
                  Chain bad_tcp_packets (1 references)                                                                                                                                                
                   pkts bytes target     prot opt in     out     source               destination
                  Again, no dropped or invalid packets showing in the log.

                  Here is a chunk of the traffic going to and from my PCs IP address:

                  Code:
                  Sep 10 22:20:47 aragorn kernel: [367507.137506] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=202.229.98.85 DST=192.168.58.17 LEN=114 TOS=0x00 PREC=0x00 TTL=103 ID=13381 PROTO=UDP SPT=38983 DPT=37488 LEN=94 
                  Sep 10 22:20:47 aragorn kernel: [367507.150780] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60371 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.151249] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60372 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.151282] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60373 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.151754] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60374 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.152051] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1162 TOS=0x00 PREC=0x00 TTL=43 ID=60375 PROTO=UDP SPT=19305 DPT=51629 LEN=1142 
                  Sep 10 22:20:47 aragorn kernel: [367507.152755] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60376 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.152786] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1162 TOS=0x00 PREC=0x00 TTL=43 ID=60377 PROTO=UDP SPT=19305 DPT=51629 LEN=1142 
                  Sep 10 22:20:47 aragorn kernel: [367507.152991] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1163 TOS=0x00 PREC=0x00 TTL=43 ID=60378 PROTO=UDP SPT=19305 DPT=51629 LEN=1143 
                  Sep 10 22:20:47 aragorn kernel: [367507.153015] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1162 TOS=0x00 PREC=0x00 TTL=43 ID=60379 PROTO=UDP SPT=19305 DPT=51629 LEN=1142 
                  Sep 10 22:20:47 aragorn kernel: [367507.161010] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=84 TOS=0x00 PREC=0x00 TTL=43 ID=2389 PROTO=UDP SPT=19305 DPT=42314 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.161559] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=96 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=42314 DPT=19305 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.163309] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=67 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=47 
                  Sep 10 22:20:47 aragorn kernel: [367507.167743] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=84 TOS=0x00 PREC=0x00 TTL=43 ID=60380 PROTO=UDP SPT=19305 DPT=51629 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.168057] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=96 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=51629 DPT=19305 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.173062] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=91.157.213.90 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=61689 PROTO=UDP SPT=37488 DPT=6130 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.173248] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=81 TOS=0x00 PREC=0x00 TTL=43 ID=61503 PROTO=UDP SPT=19305 DPT=56836 LEN=61 
                  Sep 10 22:20:47 aragorn kernel: [367507.192297] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=186 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=166 
                  Sep 10 22:20:47 aragorn kernel: [367507.195476] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=78 TOS=0x00 PREC=0x00 TTL=43 ID=61504 PROTO=UDP SPT=19305 DPT=56836 LEN=58 
                  Sep 10 22:20:47 aragorn kernel: [367507.222787] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=171 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=151 
                  Sep 10 22:20:47 aragorn kernel: [367507.223212] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26021 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:47 aragorn kernel: [367507.223454] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=78 TOS=0x00 PREC=0x00 TTL=43 ID=61505 PROTO=UDP SPT=19305 DPT=56836 LEN=58 
                  Sep 10 22:20:47 aragorn kernel: [367507.225216] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=96 TOS=0x00 PREC=0x00 TTL=43 ID=61506 PROTO=UDP SPT=19305 DPT=56836 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.230457] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=66 TOS=0x00 PREC=0x00 TTL=43 ID=60381 PROTO=UDP SPT=19305 DPT=51629 LEN=46 
                  Sep 10 22:20:47 aragorn kernel: [367507.230699] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=74 TOS=0x00 PREC=0x00 TTL=43 ID=60382 PROTO=UDP SPT=19305 DPT=51629 LEN=54 
                  Sep 10 22:20:47 aragorn kernel: [367507.231950] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26022 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:47 aragorn kernel: [367507.238707] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=61507 PROTO=UDP SPT=19305 DPT=56836 LEN=44 
                  Sep 10 22:20:47 aragorn kernel: [367507.251235] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1168 TOS=0x00 PREC=0x00 TTL=43 ID=60383 PROTO=UDP SPT=19305 DPT=51629 LEN=1148 
                  Sep 10 22:20:47 aragorn kernel: [367507.252195] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1167 TOS=0x00 PREC=0x00 TTL=43 ID=60384 PROTO=UDP SPT=19305 DPT=51629 LEN=1147 
                  Sep 10 22:20:47 aragorn kernel: [367507.252783] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=202.229.98.85 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=40152 PROTO=UDP SPT=37488 DPT=38983 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.253259] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=69.17.255.216 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=27922 LEN=28 
                  Sep 10 22:20:47 aragorn kernel: [367507.253504] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=138 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=118 
                  Sep 10 22:20:47 aragorn kernel: [367507.280443] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1137 TOS=0x00 PREC=0x00 TTL=43 ID=60385 PROTO=UDP SPT=19305 DPT=51629 LEN=1117 
                  Sep 10 22:20:47 aragorn kernel: [367507.280934] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1136 TOS=0x00 PREC=0x00 TTL=43 ID=60386 PROTO=UDP SPT=19305 DPT=51629 LEN=1116 
                  Sep 10 22:20:47 aragorn kernel: [367507.281424] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1137 TOS=0x00 PREC=0x00 TTL=43 ID=60387 PROTO=UDP SPT=19305 DPT=51629 LEN=1117 
                  Sep 10 22:20:47 aragorn kernel: [367507.281448] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1136 TOS=0x00 PREC=0x00 TTL=43 ID=60388 PROTO=UDP SPT=19305 DPT=51629 LEN=1116 
                  Sep 10 22:20:47 aragorn kernel: [367507.284492] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=131 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=111 
                  Sep 10 22:20:47 aragorn kernel: [367507.290484] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=42314 DPT=19305 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.290675] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=61508 PROTO=UDP SPT=19305 DPT=56836 LEN=44 
                  Sep 10 22:20:47 aragorn kernel: [367507.294378] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=84 TOS=0x00 PREC=0x00 TTL=43 ID=61509 PROTO=UDP SPT=19305 DPT=56836 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.295237] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=96 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.296752] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=51629 DPT=19305 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.299174] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=69.17.255.216 DST=192.168.58.17 LEN=1259 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=27922 DPT=37488 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.312230] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=124 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=104 
                  Sep 10 22:20:47 aragorn kernel: [367507.325181] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=91.157.213.90 DST=192.168.58.17 LEN=209 TOS=0x00 PREC=0x00 TTL=100 ID=479 PROTO=UDP SPT=6130 DPT=37488 LEN=189 
                  Sep 10 22:20:47 aragorn kernel: [367507.327036] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=223.135.96.166 LEN=49 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=26658 LEN=29 
                  Sep 10 22:20:47 aragorn kernel: [367507.329926] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=61510 PROTO=UDP SPT=19305 DPT=56836 LEN=44 
                  Sep 10 22:20:47 aragorn kernel: [367507.335042] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=202.229.98.85 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=40153 PROTO=UDP SPT=37488 DPT=38983 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.338655] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=71.231.201.50 DST=192.168.58.17 LEN=47 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=39478 DPT=37488 LEN=27 
                  Sep 10 22:20:47 aragorn kernel: [367507.342716] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=119 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=99 
                  Sep 10 22:20:47 aragorn kernel: [367507.364388] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=69.17.255.216 DST=192.168.58.17 LEN=1259 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=27922 DPT=37488 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.372700] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=67 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=47 
                  Sep 10 22:20:47 aragorn kernel: [367507.373136] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=96 TOS=0x00 PREC=0x00 TTL=43 ID=60389 PROTO=UDP SPT=19305 DPT=51629 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.373172] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=96 TOS=0x00 PREC=0x00 TTL=43 ID=2390 PROTO=UDP SPT=19305 DPT=42314 LEN=76 
                  Sep 10 22:20:47 aragorn kernel: [367507.388379] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=59 TOS=0x00 PREC=0x00 TTL=43 ID=61511 PROTO=UDP SPT=19305 DPT=56836 LEN=39 
                  Sep 10 22:20:47 aragorn kernel: [367507.418687] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=69.17.255.216 LEN=1191 TOS=0x00 PREC=0x00 TTL=63 ID=7412 PROTO=UDP SPT=37488 DPT=27922 LEN=1171 
                  Sep 10 22:20:47 aragorn kernel: [367507.418857] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=988 TOS=0x00 PREC=0x00 TTL=43 ID=60390 PROTO=UDP SPT=19305 DPT=51629 LEN=968 
                  Sep 10 22:20:47 aragorn kernel: [367507.419338] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=988 TOS=0x00 PREC=0x00 TTL=43 ID=60391 PROTO=UDP SPT=19305 DPT=51629 LEN=968 
                  Sep 10 22:20:47 aragorn kernel: [367507.419360] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=988 TOS=0x00 PREC=0x00 TTL=43 ID=60392 PROTO=UDP SPT=19305 DPT=51629 LEN=968 
                  Sep 10 22:20:47 aragorn kernel: [367507.419381] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=988 TOS=0x00 PREC=0x00 TTL=43 ID=60393 PROTO=UDP SPT=19305 DPT=51629 LEN=968 
                  Sep 10 22:20:47 aragorn kernel: [367507.419839] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=988 TOS=0x00 PREC=0x00 TTL=43 ID=60394 PROTO=UDP SPT=19305 DPT=51629 LEN=968 
                  Sep 10 22:20:47 aragorn kernel: [367507.435599] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=74 TOS=0x00 PREC=0x00 TTL=43 ID=60395 PROTO=UDP SPT=19305 DPT=51629 LEN=54 
                  Sep 10 22:20:47 aragorn kernel: [367507.435624] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=98 TOS=0x00 PREC=0x00 TTL=43 ID=60396 PROTO=UDP SPT=19305 DPT=51629 LEN=78 
                  Sep 10 22:20:47 aragorn kernel: [367507.443094] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=74.125.132.125 DST=192.168.58.17 LEN=52 TOS=0x00 PREC=0x00 TTL=40 ID=48525 PROTO=TCP SPT=5222 DPT=39570 WINDOW=975 RES=0x00 ACK URGP=0 
                  Sep 10 22:20:47 aragorn kernel: [367507.443403] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=74.125.132.125 LEN=166 TOS=0x00 PREC=0x00 TTL=63 ID=39519 DF PROTO=TCP SPT=39570 DPT=5222 WINDOW=115 RES=0x00 ACK PSH URGP=0 
                  Sep 10 22:20:47 aragorn kernel: [367507.444836] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=59 TOS=0x00 PREC=0x00 TTL=43 ID=61512 PROTO=UDP SPT=19305 DPT=56836 LEN=39 
                  Sep 10 22:20:47 aragorn kernel: [367507.449081] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1155 TOS=0x00 PREC=0x00 TTL=43 ID=60397 PROTO=UDP SPT=19305 DPT=51629 LEN=1135 
                  Sep 10 22:20:47 aragorn kernel: [367507.449107] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1155 TOS=0x00 PREC=0x00 TTL=43 ID=60398 PROTO=UDP SPT=19305 DPT=51629 LEN=1135 
                  Sep 10 22:20:47 aragorn kernel: [367507.449573] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1155 TOS=0x00 PREC=0x00 TTL=43 ID=60399 PROTO=UDP SPT=19305 DPT=51629 LEN=1135 
                  Sep 10 22:20:47 aragorn kernel: [367507.450322] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1155 TOS=0x00 PREC=0x00 TTL=43 ID=60400 PROTO=UDP SPT=19305 DPT=51629 LEN=1135 
                  Sep 10 22:20:47 aragorn kernel: [367507.450573] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1154 TOS=0x00 PREC=0x00 TTL=43 ID=60401 PROTO=UDP SPT=19305 DPT=51629 LEN=1134 
                  Sep 10 22:20:47 aragorn kernel: [367507.460896] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=67 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=47 
                  Sep 10 22:20:47 aragorn kernel: [367507.478820] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=202.229.98.85 DST=192.168.58.17 LEN=48 TOS=0x00 PREC=0x00 TTL=103 ID=13859 PROTO=UDP SPT=38983 DPT=37488 LEN=28 
                  Sep 10 22:20:47 aragorn kernel: [367507.488131] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=122 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=51629 DPT=19305 LEN=102 
                  Sep 10 22:20:47 aragorn kernel: [367507.496372] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=64 
                  Sep 10 22:20:47 aragorn kernel: [367507.501050] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26023 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:47 aragorn kernel: [367507.501295] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26024 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:47 aragorn kernel: [367507.509623] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=202.229.98.85 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=40154 PROTO=UDP SPT=37488 DPT=38983 LEN=1239 
                  Sep 10 22:20:47 aragorn kernel: [367507.509653] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=141.2.108.194 LEN=48 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=8436 LEN=28 
                  Sep 10 22:20:47 aragorn kernel: [367507.513300] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=963 TOS=0x00 PREC=0x00 TTL=43 ID=60402 PROTO=UDP SPT=19305 DPT=51629 LEN=943 
                  Sep 10 22:20:47 aragorn kernel: [367507.513336] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=963 TOS=0x00 PREC=0x00 TTL=43 ID=60403 PROTO=UDP SPT=19305 DPT=51629 LEN=943 
                  Sep 10 22:20:47 aragorn kernel: [367507.514539] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=963 TOS=0x00 PREC=0x00 TTL=43 ID=60404 PROTO=UDP SPT=19305 DPT=51629 LEN=943 
                  Sep 10 22:20:47 aragorn kernel: [367507.524112] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=160 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=140 
                  Sep 10 22:20:47 aragorn kernel: [367507.528360] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=91.157.213.90 LEN=47 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=6130 LEN=27 
                  Sep 10 22:20:47 aragorn kernel: [367507.536285] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26025 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:47 aragorn kernel: [367507.537777] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=59 TOS=0x00 PREC=0x00 TTL=43 ID=61513 PROTO=UDP SPT=19305 DPT=56836 LEN=39 
                  Sep 10 22:20:48 aragorn kernel: [367507.554085] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=143 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=123 
                  Sep 10 22:20:48 aragorn kernel: [367507.562779] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=123.198.165.104 DST=192.168.58.17 LEN=111 TOS=0x00 PREC=0x00 TTL=102 ID=19549 PROTO=UDP SPT=45725 DPT=37488 LEN=91 
                  Sep 10 22:20:48 aragorn kernel: [367507.570261] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1191 TOS=0x00 PREC=0x00 TTL=43 ID=60405 PROTO=UDP SPT=19305 DPT=51629 LEN=1171 
                  Sep 10 22:20:48 aragorn kernel: [367507.570505] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1192 TOS=0x00 PREC=0x00 TTL=43 ID=60406 PROTO=UDP SPT=19305 DPT=51629 LEN=1172 
                  Sep 10 22:20:48 aragorn kernel: [367507.570527] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1191 TOS=0x00 PREC=0x00 TTL=43 ID=60407 PROTO=UDP SPT=19305 DPT=51629 LEN=1171 
                  Sep 10 22:20:48 aragorn kernel: [367507.578262] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26026 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:48 aragorn kernel: [367507.581071] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=130 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=110 
                  Sep 10 22:20:48 aragorn kernel: [367507.592080] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=223.135.96.166 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=27296 PROTO=UDP SPT=37488 DPT=26658 LEN=1239 
                  Sep 10 22:20:48 aragorn kernel: [367507.592112] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=108.238.240.254 LEN=47 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=35862 LEN=27 
                  Sep 10 22:20:48 aragorn kernel: [367507.598243] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26027 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:48 aragorn kernel: [367507.613048] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=131 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=111 
                  Sep 10 22:20:48 aragorn kernel: [367507.629482] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=91.157.213.90 DST=192.168.58.17 LEN=1136 TOS=0x00 PREC=0x00 TTL=100 ID=526 PROTO=UDP SPT=6130 DPT=37488 LEN=1116 
                  Sep 10 22:20:48 aragorn kernel: [367507.646034] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=149 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=129 
                  Sep 10 22:20:48 aragorn kernel: [367507.651278] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=74 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=51629 DPT=19305 LEN=54 
                  Sep 10 22:20:48 aragorn kernel: [367507.656482] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=70 TOS=0x00 PREC=0x00 TTL=43 ID=60408 PROTO=UDP SPT=19305 DPT=51629 LEN=50 
                  Sep 10 22:20:48 aragorn kernel: [367507.666019] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=82 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=51629 DPT=19305 LEN=62 
                  Sep 10 22:20:48 aragorn kernel: [367507.670203] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=123.198.165.104 DST=192.168.58.17 LEN=64 TOS=0x00 PREC=0x00 TTL=102 ID=19622 PROTO=UDP SPT=45725 DPT=37488 LEN=44 
                  Sep 10 22:20:48 aragorn kernel: [367507.672279] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=144 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=124 
                  Sep 10 22:20:48 aragorn kernel: [367507.673267] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=141.2.108.194 LEN=65 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=37488 DPT=8436 LEN=45 
                  Sep 10 22:20:48 aragorn kernel: [367507.675279] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=223.135.96.166 LEN=1259 TOS=0x00 PREC=0x00 TTL=63 ID=27297 PROTO=UDP SPT=37488 DPT=26658 LEN=1239 
                  Sep 10 22:20:48 aragorn kernel: [367507.677451] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=59 TOS=0x00 PREC=0x00 TTL=43 ID=61514 PROTO=UDP SPT=19305 DPT=56836 LEN=39 
                  Sep 10 22:20:48 aragorn kernel: [367507.702509] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.79.127 LEN=156 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=56836 DPT=19305 LEN=136 
                  Sep 10 22:20:48 aragorn kernel: [367507.718434] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=223.135.96.166 DST=192.168.58.17 LEN=1260 TOS=0x00 PREC=0x00 TTL=102 ID=26028 PROTO=UDP SPT=26658 DPT=37488 LEN=1240 
                  Sep 10 22:20:48 aragorn kernel: [367507.723175] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=202.229.98.85 DST=192.168.58.17 LEN=48 TOS=0x00 PREC=0x00 TTL=103 ID=14146 PROTO=UDP SPT=38983 DPT=37488 LEN=28 
                  Sep 10 22:20:48 aragorn kernel: [367507.723416] IN=eth1 OUT=eth0 MAC=00:14:22:1a:b7:3c:00:13:5f:01:66:3f:08:00 SRC=173.194.79.127 DST=192.168.58.17 LEN=1081 TOS=0x00 PREC=0x00 TTL=43 ID=60409 PROTO=UDP SPT=19305 DPT=51629 LEN=1061 
                  Sep 10 22:20:48 aragorn kernel: [367507.723494] IN=eth0 OUT=eth1 MAC=00:14:22:1a:b7:3b:00:24:21:26:61:1f:08:00 SRC=192.168.58.17 DST=173.194.33.34 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=58330 DPT=443 WINDOW=0 RES=0x00 RST URGP=0

                  Comment


                    #10
                    Is video working in the above?

                    Comment


                      #11
                      Originally posted by SteveRiley View Post
                      Is video working in the above?
                      Nope.

                      Comment


                        #12
                        Then I'm stumped. According to both your logs and the output of the iptables list command, nothing is getting dropped.

                        You wrote that video functions properly if you connect your PC directly to your modem. Perhaps you could try the following. Set up your PC that way, start tcpdump, start a video, and capture the traffic of a successful connection. Then reconnect your PC behind your firewall, start tcpdump, start a video, and capture the traffic of a failed connection. Compare the two captures. If the raw output of tcpdump is not to your liking, try the experiment using Wireshark instead (install from the Ubuntu repository).

                        Comment


                          #13
                          Originally posted by SteveRiley View Post
                          According to both your logs and the output of the iptables list command, nothing is getting dropped.
                          Video does work if I wait long enough, it's just REALLY slow. As in, one or two frames every couple of minutes slow.

                          Originally posted by SteveRiley View Post
                          You wrote that video functions properly if you connect your PC directly to your modem. Perhaps you could try the following. Set up your PC that way, start tcpdump, start a video, and capture the traffic of a successful connection. Then reconnect your PC behind your firewall, start tcpdump, start a video, and capture the traffic of a failed connection. Compare the two captures. If the raw output of tcpdump is not to your liking, try the experiment using Wireshark instead (install from the Ubuntu repository).
                          I'll try that but I really have no idea what to look for.

                          Just the same, I do appreciate your trying to help. Thanks again.

                          Comment

                          Working...
                          X