As a workaround I simply decreased the MTU to 1492 on my Fedora PC so that MSS clamping shouldn't trigger anymore for these packets. Andddd, success! I can finally login 
Not sure if this is a bug, and if so, where this is located. If anybody more knowledgeable than me would be able to chime in, I can make sure that this is reported as a bug in the proper place. For now I am simply happy I can enjoy LoL under Linux. Marking this as solved
I think MSS clamping was supposed to take care of this. Are you curious enough to capture packets on the router from your Windows and Linux clients and compare them? I wonder if wine sets the no fragmentation flag.
There must be some difference in the packet to explain the behaviour you are observing.
I'll dive into that now. Just to be sure, the packet capture should be done on Windows and on Linux with the non-working config, correct? I'll share the capture in a few minutes. By the way, thank you very much for pointing me in the right direction 
You can do that on the router for both and use WireShark to filter by source IP to find the right packets, although ideally it is to be done on the clients and the router. This way you will have all the data to follow each packet.
You could start with the router only if access to the windows box is restricted. WireShark can also do packet capture on Linux and Windows.
Yes, non working config on Linux.
Okay, I made the two requested captures on the router with all packets to/from the two known IP addresses of their login queue server. If you need any additional information, please let me know Had to split my message into two, due to the character limit.
Linux non-working config:
root@LEDE:~# tcpdump -i pppoe-wan -vv -nn src 104.16.20.24 or src 104.16.21.24 o
r dst 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:52:27.489531 IP (tos 0x0, ttl 63, id 34512, offset 0, flags [none], proto TCP (6), length 60)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [S], cksum 0x7fe5 (correct), seq 2853164923, win 29200, options [mss 1452,sackOK,TS val 3646073866 ecr 0,nop,wscale 7], length 0
12:52:27.494310 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [S.], cksum 0x7e5c (correct), seq 2327585567, ack 2853164924, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:52:27.494598 IP (tos 0x0, ttl 63, id 34513, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x305d (correct), seq 1, ack 1, win 229, length 0
12:52:27.495107 IP (tos 0x0, ttl 63, id 34514, offset 0, flags [none], proto TCP (6), length 557)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0x9dd3 (correct), seq 1:518, ack 1, win 229, length 517
12:52:27.499896 IP (tos 0x0, ttl 61, id 55480, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0x2f1f (correct), seq 1, ack 518, win 30, length 0
12:52:27.502757 IP (tos 0x0, ttl 61, id 55481, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0x3de6 (correct), seq 1:1453, ack 518, win 30, length 1452
12:52:27.502843 IP (tos 0x0, ttl 61, id 22714, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xf0fe (correct), seq 1453:2905, ack 518, win 30, length 1452
12:52:27.502893 IP (tos 0x0, ttl 61, id 22715, offset 0, flags [DF], proto TCP (6), length 285)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0x7dd6 (correct), seq 2905:3150, ack 518, win 30, length 245
12:52:27.503175 IP (tos 0x0, ttl 63, id 34521, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x2896 (correct), seq 518, ack 1453, win 251, length 0
12:52:27.503249 IP (tos 0x0, ttl 63, id 34522, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x21da (correct), seq 518, ack 3150, win 278, length 0
12:52:27.505500 IP (tos 0x0, ttl 63, id 34523, offset 0, flags [none], proto TCP (6), length 125)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0x0d3e (correct), seq 518:603, ack 3150, win 278, length 85
12:52:27.510817 IP (tos 0x0, ttl 61, id 55484, offset 0, flags [DF], proto TCP (6), length 83)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0x30f1 (correct), seq 3150:3193, ack 603, win 30, length 43
12:52:27.512085 IP (tos 0x0, ttl 63, id 34525, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.512161 IP (tos 0x0, ttl 63, id 34525, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:27.512195 IP (tos 0x0, ttl 63, id 34526, offset 0, flags [none], proto TCP (6), length 1271)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0xe582 (correct), seq 2063:3294, ack 3193, win 278, length 1231
12:52:27.516953 IP (tos 0x0, ttl 61, id 55485, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xd434 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
12:52:27.522763 IP (tos 0x0, ttl 63, id 34534, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.522818 IP (tos 0x0, ttl 63, id 34534, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:27.733815 IP (tos 0x0, ttl 63, id 34590, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.733883 IP (tos 0x0, ttl 63, id 34590, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:28.149822 IP (tos 0x0, ttl 63, id 34877, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:28.149882 IP (tos 0x0, ttl 63, id 34877, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:29.022794 IP (tos 0x0, ttl 63, id 35067, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:29.022842 IP (tos 0x0, ttl 63, id 35067, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:30.685839 IP (tos 0x0, ttl 63, id 35691, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:30.685904 IP (tos 0x0, ttl 63, id 35691, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:34.014843 IP (tos 0x0, ttl 63, id 38087, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:34.014921 IP (tos 0x0, ttl 63, id 38087, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:37.483807 IP (tos 0x0, ttl 63, id 39234, offset 0, flags [none], proto TCP (6), length 63)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [FP.], cksum 0x5924 (correct), seq 3294:3317, ack 3193, win 278, length 23
12:52:37.488741 IP (tos 0x0, ttl 61, id 55486, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xd41a (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:37.489012 IP (tos 0x0, ttl 63, id 39237, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:37.489051 IP (tos 0x0, ttl 63, id 39237, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:37.701843 IP (tos 0x0, ttl 63, id 39422, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:37.701902 IP (tos 0x0, ttl 63, id 39422, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.117816 IP (tos 0x0, ttl 63, id 39499, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.117882 IP (tos 0x0, ttl 63, id 39499, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.474124 IP (tos 0x0, ttl 63, id 39612, offset 0, flags [none], proto TCP (6), length 60)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [S], cksum 0xa676 (correct), seq 1519179134, win 29200, options [mss 1452,sackOK,TS val 3646084851 ecr 0,nop,wscale 7], length 0
12:52:38.481158 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [S.], cksum 0x18b1 (correct), seq 4087181667, ack 1519179135, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:52:38.481455 IP (tos 0x0, ttl 63, id 39614, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], cksum 0xcab1 (correct), seq 1, ack 1, win 229, length 0
12:52:38.482002 IP (tos 0x0, ttl 63, id 39615, offset 0, flags [none], proto TCP (6), length 557)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0x4f76 (correct), seq 1:518, ack 1, win 229, length 517
12:52:38.488852 IP (tos 0x0, ttl 61, id 32645, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xc973 (correct), seq 1, ack 518, win 30, length 0
12:52:38.491624 IP (tos 0x0, ttl 61, id 32646, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xc6d4 (correct), seq 1:1453, ack 518, win 30, length 1452
12:52:38.491722 IP (tos 0x0, ttl 61, id 32647, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xaacb (correct), seq 1453:2905, ack 518, win 30, length 1452
12:52:38.491770 IP (tos 0x0, ttl 61, id 32648, offset 0, flags [DF], proto TCP (6), length 285)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0xcef3 (correct), seq 2905:3150, ack 518, win 30, length 245
12:52:38.492023 IP (tos 0x0, ttl 63, id 39620, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], cksum 0xbc2e (correct), seq 518, ack 3150, win 278, length 0
12:52:38.494278 IP (tos 0x0, ttl 63, id 39622, offset 0, flags [none], proto TCP (6), length 125)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0x365d (correct), seq 518:603, ack 3150, win 278, length 85
12:52:38.501274 IP (tos 0x0, ttl 61, id 32649, offset 0, flags [DF], proto TCP (6), length 83)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0x5070 (correct), seq 3150:3193, ack 603, win 30, length 43
12:52:38.503299 IP (tos 0x0, ttl 63, id 39628, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.503369 IP (tos 0x0, ttl 63, id 39628, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.503399 IP (tos 0x0, ttl 63, id 39629, offset 0, flags [none], proto TCP (6), length 1271)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0xe4ad (correct), seq 2063:3294, ack 3193, win 278, length 1231
12:52:38.510549 IP (tos 0x0, ttl 61, id 32650, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0x118a (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
12:52:38.516780 IP (tos 0x0, ttl 63, id 39631, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.516847 IP (tos 0x0, ttl 63, id 39631, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.725809 IP (tos 0x0, ttl 63, id 39662, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.725880 IP (tos 0x0, ttl 63, id 39662, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:39.005861 IP (tos 0x0, ttl 63, id 39676, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:39.005930 IP (tos 0x0, ttl 63, id 39676, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:39.149816 IP (tos 0x0, ttl 63, id 39739, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:39.149873 IP (tos 0x0, ttl 63, id 39739, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:40.030808 IP (tos 0x0, ttl 63, id 40425, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:40.030862 IP (tos 0x0, ttl 63, id 40425, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:40.669897 IP (tos 0x0, ttl 63, id 40484, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:40.669977 IP (tos 0x0, ttl 63, id 40484, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:41.757823 IP (tos 0x0, ttl 63, id 40765, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:41.757883 IP (tos 0x0, ttl 63, id 40765, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:42.499390 IP (tos 0x0, ttl 61, id 55487, offset 0, flags [DF], proto TCP (6), length 75)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0xb210 (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
12:52:42.499491 IP (tos 0x0, ttl 61, id 55488, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [F.], cksum 0xd402 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:42.499679 IP (tos 0x0, ttl 63, id 40930, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [R], cksum 0xdcd0 (correct), seq 2853165526, win 0, length 0
12:52:42.499751 IP (tos 0x0, ttl 63, id 40931, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [R], cksum 0xdcd0 (correct), seq 2853165526, win 0, length 0
12:52:45.149882 IP (tos 0x0, ttl 63, id 42480, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:45.149933 IP (tos 0x0, ttl 63, id 42480, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:48.483203 IP (tos 0x0, ttl 63, id 42790, offset 0, flags [none], proto TCP (6), length 63)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [FP.], cksum 0x319e (correct), seq 3294:3317, ack 3193, win 278, length 23
12:52:48.490301 IP (tos 0x0, ttl 61, id 32651, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0x1170 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:48.490610 IP (tos 0x0, ttl 63, id 42797, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:48.490650 IP (tos 0x0, ttl 63, id 42797, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:48.701801 IP (tos 0x0, ttl 63, id 42951, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:48.701855 IP (tos 0x0, ttl 63, id 42951, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:49.125822 IP (tos 0x0, ttl 63, id 43092, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:49.125881 IP (tos 0x0, ttl 63, id 43092, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:50.014814 IP (tos 0x0, ttl 63, id 43679, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:50.014875 IP (tos 0x0, ttl 63, id 43679, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:51.741951 IP (tos 0x0, ttl 63, id 44363, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:51.742001 IP (tos 0x0, ttl 63, id 44363, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:53.488166 IP (tos 0x0, ttl 61, id 32652, offset 0, flags [DF], proto TCP (6), length 75)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0x5a08 (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
12:52:53.488291 IP (tos 0x0, ttl 61, id 32653, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [F.], cksum 0x1158 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:53.488470 IP (tos 0x0, ttl 63, id 45986, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [R], cksum 0x2e4b (correct), seq 1519179737, win 0, length 0
12:52:53.488530 IP (tos 0x0, ttl 63, id 45987, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [R], cksum 0x2e4b (correct), seq 1519179737, win 0, length 0
12:52:58.018500 IP (tos 0xc0, ttl 61, id 41751, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 34534, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.018504 IP (tos 0xc0, ttl 61, id 41752, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 34590, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.018507 IP (tos 0xc0, ttl 61, id 41753, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 34525, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.530445 IP (tos 0xc0, ttl 61, id 42200, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 34877, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:59.042840 IP (tos 0xc0, ttl 61, id 42465, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 35067, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:01.090953 IP (tos 0xc0, ttl 61, id 44013, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 35691, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:04.162624 IP (tos 0xc0, ttl 61, id 44111, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 38087, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:07.746519 IP (tos 0xc0, ttl 61, id 45529, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39422, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:07.746632 IP (tos 0xc0, ttl 61, id 45528, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39237, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.258588 IP (tos 0xc0, ttl 61, id 45746, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39499, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771469 IP (tos 0xc0, ttl 61, id 45970, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39662, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771473 IP (tos 0xc0, ttl 61, id 45971, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39631, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771476 IP (tos 0xc0, ttl 61, id 45972, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39628, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:09.282967 IP (tos 0xc0, ttl 61, id 46117, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 39739, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:10.306870 IP (tos 0xc0, ttl 61, id 46991, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 40425, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:10.818855 IP (tos 0xc0, ttl 61, id 47263, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 40484, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:11.842620 IP (tos 0xc0, ttl 61, id 47594, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 40765, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:15.426667 IP (tos 0xc0, ttl 61, id 48685, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 42480, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:18.498647 IP (tos 0xc0, ttl 61, id 49860, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 42797, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:19.011831 IP (tos 0xc0, ttl 61, id 50140, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 42951, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:19.522527 IP (tos 0xc0, ttl 61, id 50242, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 43092, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:20.034677 IP (tos 0xc0, ttl 61, id 50665, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 43679, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:22.082733 IP (tos 0xc0, ttl 61, id 51634, offset 0, flags [none], proto ICMP (1), length 576)
104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 44363, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
Windows:
root@LEDE:~# tcpdump -i pppoe-wan -vv -nn src 104.16.20.24 or src 104.16.21.24 or dst 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:57:29.010481 IP (tos 0x0, ttl 127, id 15848, offset 0, flags [DF], proto TCP (6), length 52)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [S], cksum 0x96fe (correct), seq 4106328206, win 64240, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
12:57:29.015259 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [S.], cksum 0xc143 (correct), seq 1191450492, ack 4106328207, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:57:29.015744 IP (tos 0x0, ttl 127, id 15849, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x7329 (correct), seq 1, ack 1, win 256, length 0
12:57:29.016013 IP (tos 0x0, ttl 127, id 15850, offset 0, flags [DF], proto TCP (6), length 557)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0xbb24 (correct), seq 1:518, ack 1, win 256, length 517
12:57:29.020792 IP (tos 0x0, ttl 61, id 25322, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x7206 (correct), seq 1, ack 518, win 30, length 0
12:57:29.024439 IP (tos 0x0, ttl 61, id 25323, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x9317 (correct), seq 1:1453, ack 518, win 30, length 1452
12:57:29.024444 IP (tos 0x0, ttl 61, id 25324, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x8ed9 (correct), seq 1453:2905, ack 518, win 30, length 1452
12:57:29.024547 IP (tos 0x0, ttl 61, id 25325, offset 0, flags [DF], proto TCP (6), length 285)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x8bbf (correct), seq 2905:3150, ack 518, win 30, length 245
12:57:29.024843 IP (tos 0x0, ttl 127, id 15852, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x64d7 (correct), seq 518, ack 3150, win 256, length 0
12:57:29.025992 IP (tos 0x0, ttl 127, id 15853, offset 0, flags [DF], proto TCP (6), length 125)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0xfa97 (correct), seq 518:603, ack 3150, win 256, length 85
12:57:29.031060 IP (tos 0x0, ttl 61, id 25326, offset 0, flags [DF], proto TCP (6), length 83)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x5287 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:29.244681 IP (tos 0x0, ttl 61, id 25327, offset 0, flags [DF], proto TCP (6), length 83)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x5287 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:29.244936 IP (tos 0x0, ttl 127, id 15857, offset 0, flags [DF], proto TCP (6), length 52)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4df5 (correct), seq 3294, ack 3193, win 256, options [nop,nop,sack 1 {3150:3193}], length 0
12:57:29.332761 IP (tos 0x0, ttl 127, id 15858, offset 0, flags [DF], proto TCP (6), length 1492)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x1c03 (correct), seq 603:2055, ack 3193, win 256, length 1452
12:57:29.377794 IP (tos 0x0, ttl 61, id 25328, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x5f8a (correct), seq 3193, ack 2055, win 33, length 0
12:57:29.378234 IP (tos 0x0, ttl 127, id 15859, offset 0, flags [DF], proto TCP (6), length 1279)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0x2a68 (correct), seq 2055:3294, ack 3193, win 256, length 1239
12:57:29.383049 IP (tos 0x0, ttl 61, id 25329, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x5ab0 (correct), seq 3193, ack 3294, win 36, length 0
12:57:29.410401 IP (tos 0x0, ttl 61, id 25330, offset 0, flags [DF], proto TCP (6), length 1430)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x97a6 (correct), seq 3193:4583, ack 3294, win 36, length 1390
12:57:29.410511 IP (tos 0x0, ttl 61, id 25331, offset 0, flags [DF], proto TCP (6), length 1430)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0xfe0e (correct), seq 4583:5973, ack 3294, win 36, length 1390
12:57:29.410516 IP (tos 0x0, ttl 61, id 25332, offset 0, flags [DF], proto TCP (6), length 158)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0xb908 (correct), seq 5973:6091, ack 3294, win 36, length 118
12:57:29.410519 IP (tos 0x0, ttl 61, id 25333, offset 0, flags [DF], proto TCP (6), length 76)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x14d3 (correct), seq 6091:6127, ack 3294, win 36, length 36
12:57:29.410523 IP (tos 0x0, ttl 61, id 25334, offset 0, flags [DF], proto TCP (6), length 66)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x82a7 (correct), seq 6127:6153, ack 3294, win 36, length 26
12:57:29.410815 IP (tos 0x0, ttl 127, id 15860, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e82 (correct), seq 3294, ack 6091, win 256, length 0
12:57:29.411265 IP (tos 0x0, ttl 127, id 15861, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e44 (correct), seq 3294, ack 6153, win 256, length 0
12:57:29.974984 IP (tos 0x0, ttl 127, id 15867, offset 0, flags [DF], proto TCP (6), length 52)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [S], cksum 0x7e2e (correct), seq 2321946471, win 65340, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
12:57:29.982634 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [S.], cksum 0x2d2c (correct), seq 3330414481, ack 2321946472, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:57:29.982966 IP (tos 0x0, ttl 127, id 15869, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xdf0d (correct), seq 1, ack 1, win 260, length 0
12:57:29.983622 IP (tos 0x0, ttl 127, id 15870, offset 0, flags [DF], proto TCP (6), length 557)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x21c0 (correct), seq 1:518, ack 1, win 260, length 517
12:57:29.990922 IP (tos 0x0, ttl 61, id 9488, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xddee (correct), seq 1, ack 518, win 30, length 0
12:57:29.993261 IP (tos 0x0, ttl 61, id 9489, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xdc30 (correct), seq 1:1453, ack 518, win 30, length 1452
12:57:29.993342 IP (tos 0x0, ttl 61, id 9490, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xaa71 (correct), seq 1453:2905, ack 518, win 30, length 1452
12:57:29.993347 IP (tos 0x0, ttl 61, id 9491, offset 0, flags [DF], proto TCP (6), length 285)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0x7cca (correct), seq 2905:3150, ack 518, win 30, length 245
12:57:29.993556 IP (tos 0x0, ttl 127, id 15871, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xd1b0 (correct), seq 518, ack 2905, win 260, length 0
12:57:29.994681 IP (tos 0x0, ttl 127, id 15872, offset 0, flags [DF], proto TCP (6), length 125)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x57ec (correct), seq 518:603, ack 3150, win 259, length 85
12:57:30.001944 IP (tos 0x0, ttl 61, id 9492, offset 0, flags [DF], proto TCP (6), length 83)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xa273 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:30.002781 IP (tos 0x0, ttl 127, id 15873, offset 0, flags [DF], proto TCP (6), length 837)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x15e9 (correct), seq 603:1400, ack 3193, win 259, length 797
12:57:30.034458 IP (tos 0x0, ttl 61, id 9493, offset 0, flags [DF], proto TCP (6), length 599)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xf7fc (correct), seq 3193:3752, ack 1400, win 32, length 559
12:57:30.075040 IP (tos 0x0, ttl 127, id 15874, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xcaf2 (correct), seq 1400, ack 3752, win 257, length 0
12:57:30.443963 IP (tos 0x0, ttl 127, id 15876, offset 0, flags [DF], proto TCP (6), length 837)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0xa76c (correct), seq 1400:2197, ack 3752, win 257, length 797
12:57:30.492519 IP (tos 0x0, ttl 61, id 9494, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xc8b5 (correct), seq 3752, ack 2197, win 33, length 0
12:57:30.520119 IP (tos 0x0, ttl 61, id 9495, offset 0, flags [DF], proto TCP (6), length 599)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0x4740 (correct), seq 3752:4311, ack 2197, win 33, length 559
12:57:30.560933 IP (tos 0x0, ttl 127, id 15877, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xc5a8 (correct), seq 2197, ack 4311, win 255, length 0
12:57:31.794005 IP (tos 0x0, ttl 127, id 15887, offset 0, flags [DF], proto TCP (6), length 63)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0x351f (correct), seq 3294:3317, ack 6153, win 256, length 23
12:57:31.794117 IP (tos 0x0, ttl 127, id 15888, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [F.], cksum 0x4e2c (correct), seq 3317, ack 6153, win 256, length 0
12:57:31.798910 IP (tos 0x0, ttl 61, id 25335, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [F.], cksum 0x4f07 (correct), seq 6153, ack 3318, win 36, length 0
12:57:31.799343 IP (tos 0x0, ttl 127, id 15890, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e2b (correct), seq 3318, ack 6154, win 256, length 0
12:57:33.587428 IP (tos 0x0, ttl 127, id 15893, offset 0, flags [DF], proto TCP (6), length 837)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0xe574 (correct), seq 2197:2994, ack 4311, win 255, length 797
12:57:33.594403 IP (tos 0x0, ttl 61, id 9496, offset 0, flags [DF], proto TCP (6), length 40)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xc367 (correct), seq 4311, ack 2994, win 35, length 0
12:57:33.654937 IP (tos 0x0, ttl 61, id 9497, offset 0, flags [DF], proto TCP (6), length 599)
104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xa327 (correct), seq 4311:4870, ack 2994, win 35, length 559
12:57:33.699997 IP (tos 0x0, ttl 127, id 15894, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xc057 (correct), seq 2994, ack 4870, win 260, length 0
Don’t Fragment flag is set. This is why it is failing. Why woul wine do that?
No idea. I will file a bug report on Wine's bug tracker.
Hold on, it was on a reply packet. I need to compare on a bigger monitor: a small screen is getting in the way.
No rush I'll wait before submitting the bug report.
Edit: Maybe I will have to run a capture on the LAN bridge on the Lede router as well? Since the LAN bridge has a 1500 mtu, while the pppoe-wan interface has a 1492 mtu. So the capture on the wan interface might already be missing packets from the LoL client that were too large. Let me verify my hypothesis.
Lan Bridge Capture:
root@LEDE:~# tcpdump -i br-lan -vv -nn src 104.16.20.24 or src 104.16.21.24 or d
st 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on br-lan, link-type EN10MB (Ethernet), capture size 262144 bytes
13:30:24.696479 IP (tos 0x0, ttl 64, id 54177, offset 0, flags [none], proto TCP (6), length 60)
192.168.1.153.47542 > 104.16.21.24.443: Flags [S], cksum 0xbb46 (correct), seq 1859009807, win 29200, options [mss 1460,sackOK,TS val 1988623720 ecr 0,nop,wscale 7], length 0
13:30:24.701845 IP (tos 0x0, ttl 60, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47542: Flags [S.], cksum 0x3749 (correct), seq 1053941785, ack 1859009808, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:24.701926 IP (tos 0x0, ttl 64, id 54182, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe949 (correct), seq 1, ack 1, win 229, length 0
13:30:24.702660 IP (tos 0x0, ttl 64, id 54183, offset 0, flags [none], proto TCP (6), length 557)
192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x860b (correct), seq 1:518, ack 1, win 229, length 517
13:30:24.707847 IP (tos 0x0, ttl 60, id 51191, offset 0, flags [DF], proto TCP (6), length 40)
104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0xe80b (correct), seq 1, ack 518, win 30, length 0
13:30:24.714741 IP (tos 0x0, ttl 60, id 51192, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x6287 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:24.714839 IP (tos 0x0, ttl 60, id 18425, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x76d2 (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:24.715002 IP (tos 0x0, ttl 64, id 54191, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe182 (correct), seq 518, ack 1453, win 251, length 0
13:30:24.715102 IP (tos 0x0, ttl 60, id 18426, offset 0, flags [DF], proto TCP (6), length 285)
104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0x41db (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:24.715008 IP (tos 0x0, ttl 64, id 54192, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xdbbf (correct), seq 518, ack 2905, win 274, length 0
13:30:24.715380 IP (tos 0x0, ttl 64, id 54193, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xdab3 (correct), seq 518, ack 3150, win 297, length 0
13:30:24.717246 IP (tos 0x0, ttl 64, id 54194, offset 0, flags [none], proto TCP (6), length 125)
192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x54fc (correct), seq 518:603, ack 3150, win 297, length 85
13:30:24.722625 IP (tos 0x0, ttl 60, id 51195, offset 0, flags [DF], proto TCP (6), length 83)
104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0xe5e9 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:24.726230 IP (tos 0x0, ttl 64, id 54197, offset 0, flags [none], proto TCP (6), length 2731)
192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x4a07 (incorrect -> 0x1f3c), seq 603:3294, ack 3193, win 297, length 2691
13:30:24.731698 IP (tos 0x0, ttl 60, id 51196, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x387d (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:24.736774 IP (tos 0x0, ttl 64, id 54204, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:24.945802 IP (tos 0x0, ttl 64, id 54283, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:25.361797 IP (tos 0x0, ttl 64, id 54358, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:26.217810 IP (tos 0x0, ttl 64, id 54491, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:27.881806 IP (tos 0x0, ttl 64, id 54789, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:31.209819 IP (tos 0x0, ttl 64, id 56617, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:34.688964 IP (tos 0x0, ttl 64, id 58615, offset 0, flags [none], proto TCP (6), length 63)
192.168.1.153.47542 > 104.16.21.24.443: Flags [FP.], cksum 0x3ef6 (correct), seq 3294:3317, ack 3193, win 297, length 23
13:30:34.694028 IP (tos 0x0, ttl 60, id 51197, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x3863 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:34.694155 IP (tos 0x0, ttl 64, id 58619, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:34.760402 IP (tos 0x0, ttl 64, id 58626, offset 0, flags [none], proto TCP (6), length 60)
192.168.1.153.47546 > 104.16.21.24.443: Flags [S], cksum 0x83a4 (correct), seq 1780240912, win 29200, options [mss 1460,sackOK,TS val 1988633783 ecr 0,nop,wscale 7], length 0
13:30:34.765669 IP (tos 0x0, ttl 60, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47546: Flags [S.], cksum 0xadd2 (correct), seq 2916280891, ack 1780240913, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:34.765778 IP (tos 0x0, ttl 64, id 58632, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x5fd3 (correct), seq 1, ack 1, win 229, length 0
13:30:34.766210 IP (tos 0x0, ttl 64, id 58633, offset 0, flags [none], proto TCP (6), length 557)
192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0xd061 (correct), seq 1:518, ack 1, win 229, length 517
13:30:34.771532 IP (tos 0x0, ttl 60, id 1139, offset 0, flags [DF], proto TCP (6), length 40)
104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x5e95 (correct), seq 1, ack 518, win 30, length 0
13:30:34.775825 IP (tos 0x0, ttl 60, id 1140, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x4523 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:34.775912 IP (tos 0x0, ttl 60, id 1141, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0xabde (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:34.775963 IP (tos 0x0, ttl 60, id 1142, offset 0, flags [DF], proto TCP (6), length 285)
104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x0075 (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:34.776099 IP (tos 0x0, ttl 64, id 58634, offset 0, flags [none], proto TCP (6), length 40)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x5150 (correct), seq 518, ack 3150, win 278, length 0
13:30:34.778029 IP (tos 0x0, ttl 64, id 58636, offset 0, flags [none], proto TCP (6), length 125)
192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0x1efc (correct), seq 518:603, ack 3150, win 278, length 85
13:30:34.783882 IP (tos 0x0, ttl 60, id 1143, offset 0, flags [DF], proto TCP (6), length 83)
104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x14e4 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:34.785597 IP (tos 0x0, ttl 64, id 58643, offset 0, flags [none], proto TCP (6), length 2731)
192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0x4a07 (incorrect -> 0x4d62), seq 603:3294, ack 3193, win 278, length 2691
13:30:34.791039 IP (tos 0x0, ttl 60, id 1144, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x8e68 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:34.795802 IP (tos 0x0, ttl 64, id 58648, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:34.905826 IP (tos 0x0, ttl 64, id 58661, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:35.009835 IP (tos 0x0, ttl 64, id 58691, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:35.321851 IP (tos 0x0, ttl 64, id 58979, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:35.425823 IP (tos 0x0, ttl 64, id 59022, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:36.201838 IP (tos 0x0, ttl 64, id 59391, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:36.265813 IP (tos 0x0, ttl 64, id 59418, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:37.865836 IP (tos 0x0, ttl 64, id 60948, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:37.929852 IP (tos 0x0, ttl 64, id 60974, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:39.706148 IP (tos 0x0, ttl 60, id 51198, offset 0, flags [DF], proto TCP (6), length 75)
104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0x852b (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:39.706232 IP (tos 0x0, ttl 60, id 51199, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47542: Flags [F.], cksum 0x384b (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:39.706283 IP (tos 0x0, ttl 64, id 62161, offset 0, flags [DF], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [R], cksum 0x06cd (correct), seq 1859010410, win 0, length 0
13:30:39.706290 IP (tos 0x0, ttl 64, id 62162, offset 0, flags [DF], proto TCP (6), length 40)
192.168.1.153.47542 > 104.16.21.24.443: Flags [R], cksum 0x06cd (correct), seq 1859010410, win 0, length 0
13:30:41.257857 IP (tos 0x0, ttl 64, id 63397, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:44.769872 IP (tos 0x0, ttl 64, id 789, offset 0, flags [none], proto TCP (6), length 63)
192.168.1.153.47546 > 104.16.21.24.443: Flags [FP.], cksum 0x742c (correct), seq 3294:3317, ack 3193, win 278, length 23
13:30:44.775029 IP (tos 0x0, ttl 60, id 1145, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x8e4e (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:44.775180 IP (tos 0x0, ttl 64, id 794, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:44.986848 IP (tos 0x0, ttl 64, id 1001, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:45.401872 IP (tos 0x0, ttl 64, id 1320, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:46.249886 IP (tos 0x0, ttl 64, id 1583, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:47.913905 IP (tos 0x0, ttl 64, id 2235, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:49.773963 IP (tos 0x0, ttl 60, id 1146, offset 0, flags [DF], proto TCP (6), length 75)
104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x984e (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:49.774061 IP (tos 0x0, ttl 60, id 1147, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > 192.168.1.153.47546: Flags [F.], cksum 0x8e36 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:49.774559 IP (tos 0x0, ttl 64, id 3630, offset 0, flags [DF], proto TCP (6), length 40)
192.168.1.153.47546 > 104.16.21.24.443: Flags [R], cksum 0xf679 (correct), seq 1780241515, win 0, length 0
13:30:49.774575 IP (tos 0x0, ttl 64, id 3631, offset 0, flags [DF], proto TCP (6), length 40)
192.168.1.153.47546 > 104.16.21.24.443: Flags [R], cksum 0xf679 (correct), seq 1780241515, win 0, length 0
^C
62 packets captured
62 packets received by filter
0 packets dropped by kernel
Wan interface capture:
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:30:24.696663 IP (tos 0x0, ttl 63, id 54177, offset 0, flags [none], proto TCP (6), length 60)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [S], cksum 0x6efe (correct), seq 1859009807, win 29200, options [mss 1452,sackOK,TS val 1988623720 ecr 0,nop,wscale 7], length 0
13:30:24.701756 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [S.], cksum 0xeaf8 (correct), seq 1053941785, ack 1859009808, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:24.701996 IP (tos 0x0, ttl 63, id 54182, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x9cf9 (correct), seq 1, ack 1, win 229, length 0
13:30:24.702761 IP (tos 0x0, ttl 63, id 54183, offset 0, flags [none], proto TCP (6), length 557)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0x39bb (correct), seq 1:518, ack 1, win 229, length 517
13:30:24.707783 IP (tos 0x0, ttl 61, id 51191, offset 0, flags [DF], proto TCP (6), length 40)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x9bbb (correct), seq 1, ack 518, win 30, length 0
13:30:24.714674 IP (tos 0x0, ttl 61, id 51192, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x1637 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:24.714785 IP (tos 0x0, ttl 61, id 18425, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x2a82 (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:24.715043 IP (tos 0x0, ttl 61, id 18426, offset 0, flags [DF], proto TCP (6), length 285)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0xf58a (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:24.715104 IP (tos 0x0, ttl 63, id 54191, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x9532 (correct), seq 518, ack 1453, win 251, length 0
13:30:24.715196 IP (tos 0x0, ttl 63, id 54192, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x8f6f (correct), seq 518, ack 2905, win 274, length 0
13:30:24.715505 IP (tos 0x0, ttl 63, id 54193, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x8e63 (correct), seq 518, ack 3150, win 297, length 0
13:30:24.717344 IP (tos 0x0, ttl 63, id 54194, offset 0, flags [none], proto TCP (6), length 125)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0x08ac (correct), seq 518:603, ack 3150, win 297, length 85
13:30:24.722544 IP (tos 0x0, ttl 61, id 51195, offset 0, flags [DF], proto TCP (6), length 83)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0x9999 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:24.726394 IP (tos 0x0, ttl 63, id 54197, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.726470 IP (tos 0x0, ttl 63, id 54197, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:24.726503 IP (tos 0x0, ttl 63, id 54198, offset 0, flags [none], proto TCP (6), length 1271)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0xc28e (correct), seq 2063:3294, ack 3193, win 297, length 1231
13:30:24.731603 IP (tos 0x0, ttl 61, id 51196, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0xec2c (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:24.736890 IP (tos 0x0, ttl 63, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.736949 IP (tos 0x0, ttl 63, id 54204, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:24.945919 IP (tos 0x0, ttl 63, id 54283, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.945974 IP (tos 0x0, ttl 63, id 54283, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:25.361942 IP (tos 0x0, ttl 63, id 54358, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:25.362003 IP (tos 0x0, ttl 63, id 54358, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:26.217975 IP (tos 0x0, ttl 63, id 54491, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:26.218049 IP (tos 0x0, ttl 63, id 54491, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:27.881937 IP (tos 0x0, ttl 63, id 54789, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:27.881995 IP (tos 0x0, ttl 63, id 54789, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:31.209911 IP (tos 0x0, ttl 63, id 56617, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:31.209963 IP (tos 0x0, ttl 63, id 56617, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.689071 IP (tos 0x0, ttl 63, id 58615, offset 0, flags [none], proto TCP (6), length 63)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [FP.], cksum 0xf2a5 (correct), seq 3294:3317, ack 3193, win 297, length 23
13:30:34.693949 IP (tos 0x0, ttl 61, id 51197, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0xec12 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:34.694235 IP (tos 0x0, ttl 63, id 58619, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:34.694283 IP (tos 0x0, ttl 63, id 58619, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.760645 IP (tos 0x0, ttl 63, id 58626, offset 0, flags [none], proto TCP (6), length 60)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [S], cksum 0x375c (correct), seq 1780240912, win 29200, options [mss 1452,sackOK,TS val 1988633783 ecr 0,nop,wscale 7], length 0
13:30:34.765573 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [S.], cksum 0x6182 (correct), seq 2916280891, ack 1780240913, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:34.765847 IP (tos 0x0, ttl 63, id 58632, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], cksum 0x1383 (correct), seq 1, ack 1, win 229, length 0
13:30:34.766309 IP (tos 0x0, ttl 63, id 58633, offset 0, flags [none], proto TCP (6), length 557)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0x8411 (correct), seq 1:518, ack 1, win 229, length 517
13:30:34.771476 IP (tos 0x0, ttl 61, id 1139, offset 0, flags [DF], proto TCP (6), length 40)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x1245 (correct), seq 1, ack 518, win 30, length 0
13:30:34.775744 IP (tos 0x0, ttl 61, id 1140, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0xf8d2 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:34.775748 IP (tos 0x0, ttl 61, id 1141, offset 0, flags [DF], proto TCP (6), length 1492)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x5f8e (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:34.775751 IP (tos 0x0, ttl 61, id 1142, offset 0, flags [DF], proto TCP (6), length 285)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0xb424 (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:34.776192 IP (tos 0x0, ttl 63, id 58634, offset 0, flags [none], proto TCP (6), length 40)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], cksum 0x0500 (correct), seq 518, ack 3150, win 278, length 0
13:30:34.778198 IP (tos 0x0, ttl 63, id 58636, offset 0, flags [none], proto TCP (6), length 125)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0xd2ab (correct), seq 518:603, ack 3150, win 278, length 85
13:30:34.783816 IP (tos 0x0, ttl 61, id 1143, offset 0, flags [DF], proto TCP (6), length 83)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0xc893 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:34.785804 IP (tos 0x0, ttl 63, id 58643, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:34.785888 IP (tos 0x0, ttl 63, id 58643, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.785921 IP (tos 0x0, ttl 63, id 58644, offset 0, flags [none], proto TCP (6), length 1271)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0x4635 (correct), seq 2063:3294, ack 3193, win 278, length 1231
13:30:34.790966 IP (tos 0x0, ttl 61, id 1144, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x4218 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:34.795922 IP (tos 0x0, ttl 63, id 58648, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:34.795999 IP (tos 0x0, ttl 63, id 58648, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.905982 IP (tos 0x0, ttl 63, id 58661, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:34.906069 IP (tos 0x0, ttl 63, id 58661, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.009980 IP (tos 0x0, ttl 63, id 58691, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:35.010054 IP (tos 0x0, ttl 63, id 58691, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.322013 IP (tos 0x0, ttl 63, id 58979, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:35.322100 IP (tos 0x0, ttl 63, id 58979, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.425977 IP (tos 0x0, ttl 63, id 59022, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:35.426061 IP (tos 0x0, ttl 63, id 59022, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:36.201939 IP (tos 0x0, ttl 63, id 59391, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:36.201986 IP (tos 0x0, ttl 63, id 59391, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:36.265917 IP (tos 0x0, ttl 63, id 59418, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:36.265977 IP (tos 0x0, ttl 63, id 59418, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:37.865950 IP (tos 0x0, ttl 63, id 60948, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:37.866011 IP (tos 0x0, ttl 63, id 60948, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:37.930009 IP (tos 0x0, ttl 63, id 60974, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:37.930091 IP (tos 0x0, ttl 63, id 60974, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:39.706085 IP (tos 0x0, ttl 61, id 51198, offset 0, flags [DF], proto TCP (6), length 75)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0x38db (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:39.706090 IP (tos 0x0, ttl 61, id 51199, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [F.], cksum 0xebfa (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:39.706353 IP (tos 0x0, ttl 63, id 62161, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [R], cksum 0xba7c (correct), seq 1859010410, win 0, length 0
13:30:39.706432 IP (tos 0x0, ttl 63, id 62162, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [R], cksum 0xba7c (correct), seq 1859010410, win 0, length 0
13:30:41.257994 IP (tos 0x0, ttl 63, id 63397, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:41.258049 IP (tos 0x0, ttl 63, id 63397, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:44.769978 IP (tos 0x0, ttl 63, id 789, offset 0, flags [none], proto TCP (6), length 63)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [FP.], cksum 0x27dc (correct), seq 3294:3317, ack 3193, win 278, length 23
13:30:44.774951 IP (tos 0x0, ttl 61, id 1145, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x41fe (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:44.775286 IP (tos 0x0, ttl 63, id 794, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:44.775345 IP (tos 0x0, ttl 63, id 794, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:44.986951 IP (tos 0x0, ttl 63, id 1001, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:44.987011 IP (tos 0x0, ttl 63, id 1001, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:45.402005 IP (tos 0x0, ttl 63, id 1320, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:45.402075 IP (tos 0x0, ttl 63, id 1320, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:46.249976 IP (tos 0x0, ttl 63, id 1583, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:46.250030 IP (tos 0x0, ttl 63, id 1583, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:47.914051 IP (tos 0x0, ttl 63, id 2235, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:47.914122 IP (tos 0x0, ttl 63, id 2235, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:49.773868 IP (tos 0x0, ttl 61, id 1146, offset 0, flags [DF], proto TCP (6), length 75)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0x4bfe (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:49.773873 IP (tos 0x0, ttl 61, id 1147, offset 0, flags [DF], proto TCP (6), length 52)
104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [F.], cksum 0x41e6 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:49.774696 IP (tos 0x0, ttl 63, id 3630, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [R], cksum 0xaa29 (correct), seq 1780241515, win 0, length 0
13:30:49.774809 IP (tos 0x0, ttl 63, id 3631, offset 0, flags [DF], proto TCP (6), length 40)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [R], cksum 0xaa29 (correct), seq 1780241515, win 0, length 0
13:30:55.003920 IP (tos 0xc0, ttl 61, id 25656, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.003925 IP (tos 0xc0, ttl 61, id 25657, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54283, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.004051 IP (tos 0xc0, ttl 61, id 25658, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54197, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.515023 IP (tos 0xc0, ttl 61, id 25672, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54358, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:56.539940 IP (tos 0xc0, ttl 61, id 26137, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54491, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:58.076038 IP (tos 0xc0, ttl 61, id 26459, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54789, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:01.658850 IP (tos 0xc0, ttl 61, id 28487, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 56617, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:04.730913 IP (tos 0xc0, ttl 61, id 31345, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58619, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.243145 IP (tos 0xc0, ttl 61, id 31477, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58661, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.243150 IP (tos 0xc0, ttl 61, id 31478, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58648, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.243153 IP (tos 0xc0, ttl 61, id 31479, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58643, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.243301 IP (tos 0xc0, ttl 61, id 31476, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58691, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.754884 IP (tos 0xc0, ttl 61, id 31956, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 58979, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.755931 IP (tos 0xc0, ttl 61, id 31957, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 59022, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:06.267892 IP (tos 0xc0, ttl 61, id 32189, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 59391, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:06.778869 IP (tos 0xc0, ttl 61, id 32656, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 59418, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:08.314861 IP (tos 0xc0, ttl 61, id 33509, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 60948, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:08.314865 IP (tos 0xc0, ttl 61, id 33508, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 60974, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:11.387014 IP (tos 0xc0, ttl 61, id 36082, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 63397, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:14.970876 IP (tos 0xc0, ttl 61, id 37770, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 794, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:15.483999 IP (tos 0xc0, ttl 61, id 38096, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 1320, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:15.484326 IP (tos 0xc0, ttl 61, id 38097, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 1001, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:16.507783 IP (tos 0xc0, ttl 61, id 38302, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 1583, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:18.043034 IP (tos 0xc0, ttl 61, id 39101, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 2235, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
^C
112 packets captured
113 packets received by filter
0 packets dropped by kernel
I am not really sure what to make of the fact that more packets were captured on the WAN interface with identical filters. They ran in parallel for the exact same duration.
A LAN packet arrives: length 1500
13:30:24.736774 IP (tos 0x0, ttl 64, id 54204, offset 0, flags [none], proto TCP (6), length 1500)
192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
It is properly split and sent out:
13:30:24.736890 IP (tos 0x0, ttl 63, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.736949 IP (tos 0x0, ttl 63, id 54204, offset 1472, flags [none], proto TCP (6), length 28)
xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
The game server replies that is does not like it (is it possible that they just do not want to deal with fragmented packets for performance reasons?):
13:30:55.003920 IP (tos 0xc0, ttl 61, id 25656, offset 0, flags [none], proto ICMP (1), length 576)
104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
IP (tos 0x0, ttl 60, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
What I am not seeing is the packet id 25656 on the LAN side forwarded to the originating host. You can add ICMP packets to your capture on LAN to see if these get forwarded to your Linux host (use the id field to trace the path of the packet). In theory, your Linux box should adjust the MTU down for this connection upon receiving this reply (it is called MTU Path Discovery).
BTW, do you have your Linux firewall set to drop ICMP requests? Can you ping that machine from the router?
Or, the MTU probing is simply disabled on Linux by default:
cat /proc/sys/net/ipv4/tcp_mtu_probing
0
The firewall is disabled completely on the Fedora machine.
But in that case it should also not like the packets from the Windows machine, right?
Good catch! This would be on my Fedora machine, correct? I am not at home at the moment, but will definitely check this when I am.
You can check it by doing another LAN/WAN capture and see if Windows even sends packets of 1,500 bytes. If it does not, then it was able to dynamically adjust MTU to the proper size (or its MTU is already at 1,492; you can check that as well by googling the proper commands).
Either way, you got all the tools and info you need to zero in on the source of the problem: your Linux client/machine does not adjust the MTU properly. It now depends on how deep into this hole you want to go to figure out what exactly is happening.
Affirmative, but I never tried it myself. I am also on a PPPoE connection and what I actually do is set the DHCP server on the router to advertise MTU=1,492, even though not every client actually takes that into consideration. Other clients I force to use MTU=1,492. This does lower the LAN throughput a bit, but it does avoid the fragmentation overhead as well as the issues like you have experienced. I also set all LAN interfaces to use MTU=1,492.
Look at it this way as well: MSS Clamping is not free and takes resources (CPU and bandwidth), which are limited.
Got it. Thank you very much for pointing me in the right direction Will dive deeper into this as soon as I am home. Because multiple other people were struggling with this issue, so it would be good to have a general solution available.
I should probably download a master branch firmware and use baby jumbo frames for my WAN interface, and use 1500 MTU everywhere. Probably the cleanest fix for my situation.
Okay, so was able to track down the issue, but I am still not sure what is causing it. When I login via my Windows PC I can see the following packets on my LAN bridge:
08:40:57.628062 IP (tos 0xc0, ttl 64, id 59635, offset 0, flags [none], proto ICMP (1), length 576)
192.168.1.1 > 192.168.1.154: ICMP 104.16.21.24 unreachable - need to frag (mtu 1492), length 556
Which means the router is correctly telling my PC that it needs to use a MTU of 1492. However, no such packets can be seen when my Linux PC tries to login as it endlessly retries with 1500 MTU packets (see previous captures on LAN bridge). Note that I do see ICMP messages regarding MTU for other connections, so path MTU discovery is working fine on my Linux PC. Just for this particular server the router refuses to let the PC know it needs a lower MTU. And I am not sure why.
I can see one packet that triggered said message on the Windows PC:
08:40:57.627787 IP (tos 0x0, ttl 128, id 13958, offset 0, flags [DF], proto TCP (6), length 2731)
192.168.1.154.49972 > 104.16.21.24.443: Flags [P.], cksum 0x4a08 (incorrect -> 0xa8db), seq 603:3294, ack 3193, win 255, length 2691
08:40:57.628062 IP (tos 0xc0, ttl 64, id 59635, offset 0, flags [none], proto ICMP (1), length 576)
192.168.1.1 > 192.168.1.154: ICMP 104.16.21.24 unreachable - need to frag (mtu 1492), length 556
IP (tos 0x0, ttl 128, id 13958, offset 0, flags [DF], proto TCP (6), length 2731)
I see a similar packet going out on the Linux PC, but no such ICMP message is generated by the router:
08:54:48.047494 IP (tos 0x0, ttl 64, id 45537, offset 0, flags [none], proto TCP (6), length 2731)
192.168.1.153.56746 > 104.16.20.24.443: Flags [P.], cksum 0x4907 (incorrect -> 0x2378), seq 603:3294, ack 3193, win 278, length 2691
Why the different behavior? And more importantly, how to fix this?
Edit: Ahhh, I finally understand! On the Windows PC the large packet has the Don't Fragment flag (DF) set, and hence the router sends out an ICMP package to tell the PC to tone down the MTU, as it cannot be send in its current state. On the Linux PC, however, the large packet does not have this flag, so the router happily fragments it without sending back a ICMP package. And the server somehow doesn't like fragmented packets.
Changing Riot's server to accept fragmented packets isn't really something we can do, of course. But where is the bug located you think? Linux's TCP stack seems fine, since I have seen ICMP packets for path MTU discovery before, and they work just fine. So this is most likely a bug with Wine. I will fine a bug report on Wine's bug tracker.
Another venue could be to start another thread here to understand why the router does not forward the original ICMP message to your Linux PC. Notice, that for Windows the router replies with need to fragment, but the game server sends something else and the router drops it.
To me it read as if the small packet got lost/ignored and the reply indicated that the server exceeded some timeout waiting for all packets to arrive. I am not sure if the message is really supposed to be dropped.