Subject: Re: abusive traffic from inter-touch router
From: Jun-ichiro itojun Hagino <[email-masked]>
To: [email-masked], [email-masked], [email-masked], [email-masked]
Date: Sun, 01 Sep 2002 21:05:15 +0900

>	i'm now staying at Stamford hotel near Sydney airport, and using
>	your internet connectivity service.  the first-hop router (61.8.9.254)
>	is sending malicious TCP traffic (SYN attempt to port 6000).
>	could you let me know (1) if it is intentional or not, and (2) if
>	intentional, let me know under what kind of ground you are portscanning
>	your customer.
>	if you do not respond in 24 hours, i'll make this matter public.

	evidence.  notice that all of the exchanges follow this pattern:
	- SYN from first-hop router
	- SYN ACK from my device to respond to SYN
	- retransmission of SYN ACK
	- first-hop router's connecting socket goes away
	apparently your device is attempt to portscan, it is not a normal TCP
	connection attempt.

21:01:22.956696 61.8.9.254.2230 > 10.5.0.59.6000: S [tcp sum ok] 3369191721:3369191721(0) win 32120 <mss 1460,sackOK,timestamp 114694089 0,nop,wscale 0> (DF) (ttl 64, id 26579, len 60)
21:01:22.956807 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114694089> (DF) (ttl 64, id 2221, len 60)
21:01:25.950019 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114694089> (DF) (ttl 64, id 2225, len 60)
21:01:31.950019 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694089> (DF) (ttl 64, id 2234, len 60)
21:01:31.950208 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2230 unreachable for 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694089> (DF) (ttl 64, id 2234, len 60) [tos 0xc0]  (ttl 255, id 28827, len 88)

itojun

21:01:10.770027 10.5.0.59.6000 > 61.8.9.254.2165: S [tcp sum ok] 1362306318:1362306318(0) ack 3297062144 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688370> (DF) (ttl 64, id 2193, len 60)
21:01:10.770229 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2165 unreachable for 10.5.0.59.6000 > 61.8.9.254.2165: S [tcp sum ok] 1362306318:1362306318(0) ack 3297062144 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688370> (DF) (ttl 64, id 2193, len 60) [tos 0xc0]  (ttl 255, id 23398, len 88)
21:01:10.840020 10.5.0.59.6000 > 61.8.9.254.2193: S [tcp sum ok] 2305049407:2305049407(0) ack 3319980853 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114690778> (DF) (ttl 64, id 2194, len 60)
21:01:10.840207 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2193 unreachable for 10.5.0.59.6000 > 61.8.9.254.2193: S [tcp sum ok] 2305049407:2305049407(0) ack 3319980853 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114690778> (DF) (ttl 64, id 2194, len 60) [tos 0xc0]  (ttl 255, id 23399, len 88)
21:01:10.880018 10.5.0.59.6000 > 61.8.9.254.2209: S [tcp sum ok] 2791062982:2791062982(0) ack 3364151368 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 17 114691982> (DF) (ttl 64, id 2195, len 60)
21:01:10.880226 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2209 unreachable for 10.5.0.59.6000 > 61.8.9.254.2209: S [tcp sum ok] 2791062982:2791062982(0) ack 3364151368 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 17 114691982> (DF) (ttl 64, id 2195, len 60) [tos 0xc0]  (ttl 255, id 23477, len 88)
21:01:10.900018 10.5.0.59.6000 > 61.8.9.254.2215: S [tcp sum ok] 3022910103:3022910103(0) ack 3355180547 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114692584> (DF) (ttl 64, id 2196, len 60)
21:01:10.917339 61.8.9.254.2218 > 10.5.0.59.6000: S [tcp sum ok] 3363987998:3363987998(0) win 32120 <mss 1460,sackOK,timestamp 114692885 0,nop,wscale 0> (DF) (ttl 64, id 23495, len 60)
21:01:10.917446 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114692885> (DF) (ttl 64, id 2197, len 60)
21:01:13.770056 10.5.0.59.6000 > 61.8.9.254.2170: S [tcp sum ok] 1480638465:1480638465(0) ack 3299682667 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688671> (DF) (ttl 64, id 2202, len 60)
21:01:13.770282 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2170 unreachable for 10.5.0.59.6000 > 61.8.9.254.2170: S [tcp sum ok] 1480638465:1480638465(0) ack 3299682667 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688671> (DF) (ttl 64, id 2202, len 60) [tos 0xc0]  (ttl 255, id 24100, len 88)
21:01:13.850026 10.5.0.59.6000 > 61.8.9.254.2196: S [tcp sum ok] 2425924406:2425924406(0) ack 3322128029 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691079> (DF) (ttl 64, id 2203, len 60)
21:01:13.850215 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2196 unreachable for 10.5.0.59.6000 > 61.8.9.254.2196: S [tcp sum ok] 2425924406:2425924406(0) ack 3322128029 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691079> (DF) (ttl 64, id 2203, len 60) [tos 0xc0]  (ttl 255, id 24101, len 88)
21:01:13.890078 10.5.0.59.6000 > 61.8.9.254.2212: S [tcp sum ok] 2906391716:2906391716(0) ack 3359609674 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692283> (DF) (ttl 64, id 2204, len 60)
21:01:13.890291 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2212 unreachable for 10.5.0.59.6000 > 61.8.9.254.2212: S [tcp sum ok] 2906391716:2906391716(0) ack 3359609674 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692283> (DF) (ttl 64, id 2204, len 60) [tos 0xc0]  (ttl 255, id 24102, len 88)
21:01:13.910018 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114692885> (DF) (ttl 64, id 2205, len 60)
21:01:13.927121 61.8.9.254.2221 > 10.5.0.59.6000: S [tcp sum ok] 3362918362:3362918362(0) win 32120 <mss 1460,sackOK,timestamp 114693186 0,nop,wscale 0> (DF) (ttl 64, id 24174, len 60)
21:01:13.927240 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114693186> (DF) (ttl 64, id 2206, len 60)
21:01:16.780056 10.5.0.59.6000 > 61.8.9.254.2173: S [tcp sum ok] 1601076202:1601076202(0) ack 3309103971 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688972> (DF) (ttl 64, id 2207, len 60)
21:01:16.780276 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2173 unreachable for 10.5.0.59.6000 > 61.8.9.254.2173: S [tcp sum ok] 1601076202:1601076202(0) ack 3309103971 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114688972> (DF) (ttl 64, id 2207, len 60) [tos 0xc0]  (ttl 255, id 24816, len 88)
21:01:16.860026 10.5.0.59.6000 > 61.8.9.254.2200: S [tcp sum ok] 2539605517:2539605517(0) ack 3332561559 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691380> (DF) (ttl 64, id 2208, len 60)
21:01:16.860222 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2200 unreachable for 10.5.0.59.6000 > 61.8.9.254.2200: S [tcp sum ok] 2539605517:2539605517(0) ack 3332561559 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691380> (DF) (ttl 64, id 2208, len 60) [tos 0xc0]  (ttl 255, id 24817, len 88)
21:01:16.900028 10.5.0.59.6000 > 61.8.9.254.2215: S [tcp sum ok] 3022910103:3022910103(0) ack 3355180547 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692584> (DF) (ttl 64, id 2209, len 60)
21:01:16.900220 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2215 unreachable for 10.5.0.59.6000 > 61.8.9.254.2215: S [tcp sum ok] 3022910103:3022910103(0) ack 3355180547 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692584> (DF) (ttl 64, id 2209, len 60) [tos 0xc0]  (ttl 255, id 24818, len 88)
21:01:16.920018 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114693186> (DF) (ttl 64, id 2210, len 60)
21:01:16.937224 61.8.9.254.2224 > 10.5.0.59.6000: S [tcp sum ok] 3376951871:3376951871(0) win 32120 <mss 1460,sackOK,timestamp 114693487 0,nop,wscale 0> (DF) (ttl 64, id 24835, len 60)
21:01:16.937342 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114693487> (DF) (ttl 64, id 2211, len 60)
21:01:19.790045 10.5.0.59.6000 > 61.8.9.254.2176: S [tcp sum ok] 1722475480:1722475480(0) ack 3313628311 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689273> (DF) (ttl 64, id 2212, len 60)
21:01:19.790274 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2176 unreachable for 10.5.0.59.6000 > 61.8.9.254.2176: S [tcp sum ok] 1722475480:1722475480(0) ack 3313628311 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689273> (DF) (ttl 64, id 2212, len 60) [tos 0xc0]  (ttl 255, id 25629, len 88)
21:01:19.870018 10.5.0.59.6000 > 61.8.9.254.2206: S [tcp sum ok] 2666805951:2666805951(0) ack 3357257092 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691681> (DF) (ttl 64, id 2213, len 60)
21:01:19.870251 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2206 unreachable for 10.5.0.59.6000 > 61.8.9.254.2206: S [tcp sum ok] 2666805951:2666805951(0) ack 3357257092 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114691681> (DF) (ttl 64, id 2213, len 60) [tos 0xc0]  (ttl 255, id 25855, len 88)
21:01:19.910020 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692885> (DF) (ttl 64, id 2214, len 60)
21:01:19.910223 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2218 unreachable for 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114692885> (DF) (ttl 64, id 2214, len 60) [tos 0xc0]  (ttl 255, id 25875, len 88)
21:01:19.930020 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114693487> (DF) (ttl 64, id 2215, len 60)
21:01:19.946888 61.8.9.254.2227 > 10.5.0.59.6000: S [tcp sum ok] 3366600089:3366600089(0) win 32120 <mss 1460,sackOK,timestamp 114693788 0,nop,wscale 0> (DF) (ttl 64, id 25915, len 60)
21:01:19.946994 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114693788> (DF) (ttl 64, id 2216, len 60)
21:01:21.774859 arp who-has 10.5.0.59 tell 61.8.9.254
21:01:21.774919 arp reply 10.5.0.59 is-at 0:90:27:96:1c:e1
21:01:22.800059 10.5.0.59.6000 > 61.8.9.254.2181: S [tcp sum ok] 1840397416:1840397416(0) ack 3321389961 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689574> (DF) (ttl 64, id 2217, len 60)
21:01:22.800284 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2181 unreachable for 10.5.0.59.6000 > 61.8.9.254.2181: S [tcp sum ok] 1840397416:1840397416(0) ack 3321389961 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689574> (DF) (ttl 64, id 2217, len 60) [tos 0xc0]  (ttl 255, id 26304, len 88)
21:01:22.880018 10.5.0.59.6000 > 61.8.9.254.2209: S [tcp sum ok] 2791062982:2791062982(0) ack 3364151368 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 41 114691982> (DF) (ttl 64, id 2218, len 60)
21:01:22.880208 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2209 unreachable for 10.5.0.59.6000 > 61.8.9.254.2209: S [tcp sum ok] 2791062982:2791062982(0) ack 3364151368 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 41 114691982> (DF) (ttl 64, id 2218, len 60) [tos 0xc0]  (ttl 255, id 26305, len 88)
21:01:22.920019 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693186> (DF) (ttl 64, id 2219, len 60)
21:01:22.920223 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2221 unreachable for 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693186> (DF) (ttl 64, id 2219, len 60) [tos 0xc0]  (ttl 255, id 26344, len 88)
21:01:22.940018 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114693788> (DF) (ttl 64, id 2220, len 60)
21:01:22.956696 61.8.9.254.2230 > 10.5.0.59.6000: S [tcp sum ok] 3369191721:3369191721(0) win 32120 <mss 1460,sackOK,timestamp 114694089 0,nop,wscale 0> (DF) (ttl 64, id 26579, len 60)
21:01:22.956807 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114694089> (DF) (ttl 64, id 2221, len 60)
21:01:25.820052 10.5.0.59.6000 > 61.8.9.254.2184: S [tcp sum ok] 1958165081:1958165081(0) ack 3313660310 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689875> (DF) (ttl 64, id 2222, len 60)
21:01:25.820276 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2184 unreachable for 10.5.0.59.6000 > 61.8.9.254.2184: S [tcp sum ok] 1958165081:1958165081(0) ack 3313660310 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114689875> (DF) (ttl 64, id 2222, len 60) [tos 0xc0]  (ttl 255, id 27012, len 88)
21:01:25.890020 10.5.0.59.6000 > 61.8.9.254.2212: S [tcp sum ok] 2906391716:2906391716(0) ack 3359609674 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692283> (DF) (ttl 64, id 2223, len 60)
21:01:25.890209 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2212 unreachable for 10.5.0.59.6000 > 61.8.9.254.2212: S [tcp sum ok] 2906391716:2906391716(0) ack 3359609674 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692283> (DF) (ttl 64, id 2223, len 60) [tos 0xc0]  (ttl 255, id 27013, len 88)
21:01:25.930018 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693487> (DF) (ttl 64, id 2224, len 60)
21:01:25.930207 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2224 unreachable for 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693487> (DF) (ttl 64, id 2224, len 60) [tos 0xc0]  (ttl 255, id 27014, len 88)
21:01:25.950019 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114694089> (DF) (ttl 64, id 2225, len 60)
21:01:25.966500 61.8.9.254.2233 > 10.5.0.59.6000: S [tcp sum ok] 3385773414:3385773414(0) win 32120 <mss 1460,sackOK,timestamp 114694390 0,nop,wscale 0> (DF) (ttl 64, id 27031, len 60)
21:01:25.966625 10.5.0.59.6000 > 61.8.9.254.2233: S [tcp sum ok] 3734331068:3734331068(0) ack 3385773415 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114694390> (DF) (ttl 64, id 2226, len 60)
21:01:28.820056 10.5.0.59.6000 > 61.8.9.254.2187: S [tcp sum ok] 2071500136:2071500136(0) ack 3313291004 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690176> (DF) (ttl 64, id 2227, len 60)
21:01:28.820282 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2187 unreachable for 10.5.0.59.6000 > 61.8.9.254.2187: S [tcp sum ok] 2071500136:2071500136(0) ack 3313291004 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690176> (DF) (ttl 64, id 2227, len 60) [tos 0xc0]  (ttl 255, id 28116, len 88)
21:01:28.900062 10.5.0.59.6000 > 61.8.9.254.2215: S [tcp sum ok] 3022910103:3022910103(0) ack 3355180547 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692584> (DF) (ttl 64, id 2228, len 60)
21:01:28.900257 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2215 unreachable for 10.5.0.59.6000 > 61.8.9.254.2215: S [tcp sum ok] 3022910103:3022910103(0) ack 3355180547 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692584> (DF) (ttl 64, id 2228, len 60) [tos 0xc0]  (ttl 255, id 28117, len 88)
21:01:28.940054 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693788> (DF) (ttl 64, id 2229, len 60)
21:01:28.940252 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2227 unreachable for 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114693788> (DF) (ttl 64, id 2229, len 60) [tos 0xc0]  (ttl 255, id 28118, len 88)
21:01:28.960043 10.5.0.59.6000 > 61.8.9.254.2233: S [tcp sum ok] 3734331068:3734331068(0) ack 3385773415 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114694390> (DF) (ttl 64, id 2230, len 60)
21:01:28.976329 61.8.9.254.2238 > 10.5.0.59.6000: S [tcp sum ok] 3391032315:3391032315(0) win 32120 <mss 1460,sackOK,timestamp 114694691 0,nop,wscale 0> (DF) (ttl 64, id 28135, len 60)
21:01:28.976465 10.5.0.59.6000 > 61.8.9.254.2238: S [tcp sum ok] 3852081702:3852081702(0) ack 3391032316 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114694691> (DF) (ttl 64, id 2231, len 60)
21:01:31.830057 10.5.0.59.6000 > 61.8.9.254.2190: S [tcp sum ok] 2185187497:2185187497(0) ack 3316742150 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690477> (DF) (ttl 64, id 2232, len 60)
21:01:31.830275 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2190 unreachable for 10.5.0.59.6000 > 61.8.9.254.2190: S [tcp sum ok] 2185187497:2185187497(0) ack 3316742150 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690477> (DF) (ttl 64, id 2232, len 60) [tos 0xc0]  (ttl 255, id 28779, len 88)
21:01:31.910020 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692885> (DF) (ttl 64, id 2233, len 60)
21:01:31.910229 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2218 unreachable for 10.5.0.59.6000 > 61.8.9.254.2218: S [tcp sum ok] 3142843198:3142843198(0) ack 3363987999 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114692885> (DF) (ttl 64, id 2233, len 60) [tos 0xc0]  (ttl 255, id 28826, len 88)
21:01:31.950019 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694089> (DF) (ttl 64, id 2234, len 60)
21:01:31.950208 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2230 unreachable for 10.5.0.59.6000 > 61.8.9.254.2230: S [tcp sum ok] 3618006200:3618006200(0) ack 3369191722 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694089> (DF) (ttl 64, id 2234, len 60) [tos 0xc0]  (ttl 255, id 28827, len 88)
21:01:31.970018 10.5.0.59.6000 > 61.8.9.254.2238: S [tcp sum ok] 3852081702:3852081702(0) ack 3391032316 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114694691> (DF) (ttl 64, id 2235, len 60)
21:01:31.986121 61.8.9.254.2241 > 10.5.0.59.6000: S [tcp sum ok] 3381168299:3381168299(0) win 32120 <mss 1460,sackOK,timestamp 114694992 0,nop,wscale 0> (DF) (ttl 64, id 28844, len 60)
21:01:31.986237 10.5.0.59.6000 > 61.8.9.254.2241: S [tcp sum ok] 3966969233:3966969233(0) ack 3381168300 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114694992> (DF) (ttl 64, id 2236, len 60)
21:01:34.840053 10.5.0.59.6000 > 61.8.9.254.2193: S [tcp sum ok] 2305049407:2305049407(0) ack 3319980853 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690778> (DF) (ttl 64, id 2237, len 60)
21:01:34.840275 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2193 unreachable for 10.5.0.59.6000 > 61.8.9.254.2193: S [tcp sum ok] 2305049407:2305049407(0) ack 3319980853 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114690778> (DF) (ttl 64, id 2237, len 60) [tos 0xc0]  (ttl 255, id 29483, len 88)
21:01:34.920021 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693186> (DF) (ttl 64, id 2238, len 60)
21:01:34.920231 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2221 unreachable for 10.5.0.59.6000 > 61.8.9.254.2221: S [tcp sum ok] 3264459351:3264459351(0) ack 3362918363 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693186> (DF) (ttl 64, id 2238, len 60) [tos 0xc0]  (ttl 255, id 29528, len 88)
21:01:34.960030 10.5.0.59.6000 > 61.8.9.254.2233: S [tcp sum ok] 3734331068:3734331068(0) ack 3385773415 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694390> (DF) (ttl 64, id 2239, len 60)
21:01:34.960224 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2233 unreachable for 10.5.0.59.6000 > 61.8.9.254.2233: S [tcp sum ok] 3734331068:3734331068(0) ack 3385773415 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694390> (DF) (ttl 64, id 2239, len 60) [tos 0xc0]  (ttl 255, id 29531, len 88)
21:01:34.980018 10.5.0.59.6000 > 61.8.9.254.2241: S [tcp sum ok] 3966969233:3966969233(0) ack 3381168300 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114694992> (DF) (ttl 64, id 2240, len 60)
21:01:34.995970 61.8.9.254.2244 > 10.5.0.59.6000: S [tcp sum ok] 3396864498:3396864498(0) win 32120 <mss 1460,sackOK,timestamp 114695293 0,nop,wscale 0> (DF) (ttl 64, id 29548, len 60)
21:01:34.996084 10.5.0.59.6000 > 61.8.9.254.2244: S [tcp sum ok] 4087725898:4087725898(0) ack 3396864499 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114695293> (DF) (ttl 64, id 2241, len 60)
21:01:37.850054 10.5.0.59.6000 > 61.8.9.254.2196: S [tcp sum ok] 2425924406:2425924406(0) ack 3322128029 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114691079> (DF) (ttl 64, id 2242, len 60)
21:01:37.850265 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2196 unreachable for 10.5.0.59.6000 > 61.8.9.254.2196: S [tcp sum ok] 2425924406:2425924406(0) ack 3322128029 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114691079> (DF) (ttl 64, id 2242, len 60) [tos 0xc0]  (ttl 255, id 30197, len 88)
21:01:37.930025 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693487> (DF) (ttl 64, id 2243, len 60)
21:01:37.930215 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2224 unreachable for 10.5.0.59.6000 > 61.8.9.254.2224: S [tcp sum ok] 3383143250:3383143250(0) ack 3376951872 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693487> (DF) (ttl 64, id 2243, len 60) [tos 0xc0]  (ttl 255, id 30198, len 88)
21:01:37.970021 10.5.0.59.6000 > 61.8.9.254.2238: S [tcp sum ok] 3852081702:3852081702(0) ack 3391032316 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694691> (DF) (ttl 64, id 2244, len 60)
21:01:37.970230 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2238 unreachable for 10.5.0.59.6000 > 61.8.9.254.2238: S [tcp sum ok] 3852081702:3852081702(0) ack 3391032316 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694691> (DF) (ttl 64, id 2244, len 60) [tos 0xc0]  (ttl 255, id 30243, len 88)
21:01:37.990018 10.5.0.59.6000 > 61.8.9.254.2244: S [tcp sum ok] 4087725898:4087725898(0) ack 3396864499 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114695293> (DF) (ttl 64, id 2245, len 60)
21:01:38.005799 61.8.9.254.2247 > 10.5.0.59.6000: S [tcp sum ok] 3390579740:3390579740(0) win 32120 <mss 1460,sackOK,timestamp 114695594 0,nop,wscale 0> (DF) (ttl 64, id 30262, len 60)
21:01:38.005908 10.5.0.59.6000 > 61.8.9.254.2247: S [tcp sum ok] 4204199569:4204199569(0) ack 3390579741 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114695594> (DF) (ttl 64, id 2246, len 60)
21:01:40.860122 10.5.0.59.6000 > 61.8.9.254.2200: S [tcp sum ok] 2539605517:2539605517(0) ack 3332561559 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114691380> (DF) (ttl 64, id 2247, len 60)
21:01:40.860347 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2200 unreachable for 10.5.0.59.6000 > 61.8.9.254.2200: S [tcp sum ok] 2539605517:2539605517(0) ack 3332561559 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 90 114691380> (DF) (ttl 64, id 2247, len 60) [tos 0xc0]  (ttl 255, id 31268, len 88)
21:01:40.940093 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693788> (DF) (ttl 64, id 2248, len 60)
21:01:40.940282 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2227 unreachable for 10.5.0.59.6000 > 61.8.9.254.2227: S [tcp sum ok] 3500317741:3500317741(0) ack 3366600090 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 42 114693788> (DF) (ttl 64, id 2248, len 60) [tos 0xc0]  (ttl 255, id 31269, len 88)
21:01:40.980039 10.5.0.59.6000 > 61.8.9.254.2241: S [tcp sum ok] 3966969233:3966969233(0) ack 3381168300 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694992> (DF) (ttl 64, id 2249, len 60)
21:01:40.980230 61.8.9.254 > 10.5.0.59: icmp: 61.8.9.254 tcp port 2241 unreachable for 10.5.0.59.6000 > 61.8.9.254.2241: S [tcp sum ok] 3966969233:3966969233(0) ack 3381168300 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 18 114694992> (DF) (ttl 64, id 2249, len 60) [tos 0xc0]  (ttl 255, id 31270, len 88)
21:01:41.000021 10.5.0.59.6000 > 61.8.9.254.2247: S [tcp sum ok] 4204199569:4204199569(0) ack 3390579741 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 6 114695594> (DF) (ttl 64, id 2250, len 60)
21:01:41.015601 61.8.9.254.2250 > 10.5.0.59.6000: S [tcp sum ok] 3397108330:3397108330(0) win 32120 <mss 1460,sackOK,timestamp 114695895 0,nop,wscale 0> (DF) (ttl 64, id 31287, len 60)
21:01:41.015711 10.5.0.59.6000 > 61.8.9.254.2250: S [tcp sum ok] 19941014:19941014(0) ack 3397108331 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 114695895> (DF) (ttl 64, id 2251, len 60)