Mwan3 interfering with WAN that wasn't added to it

I have no idea what might be wrong. I have this ISP for a few years and on last weeks it stopped working.

I receive IPv4 and IPv6 from it using DHCP. Modem has been in bridge mode, I changed it back to router but got the same errors. But when I connect a laptop to it, it works fine, both in router and bridge modes.

ping gives 100% loss

# ping -c 4 -I eth2 v4.ipv6-test.com
PING v4.ipv6-test.com (51.75.78.103) from 192.168.20.16 eth2: 56(84) bytes of data.

--- v4.ipv6-test.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3040ms
pipe 4

Oddly, httping reports success

# httping -c 4 -I eth2 v4.ipv6-test.com
PING v4.ipv6-test.com:80 (/):
connected to 51.75.78.103:80 (200 bytes), seq=0 time=481.67 ms
connected to 51.75.78.103:80 (200 bytes), seq=1 time=486.84 ms
connected to 51.75.78.103:80 (200 bytes), seq=2 time=477.67 ms
connected to 51.75.78.103:80 (200 bytes), seq=3 time=510.36 ms
--- http://v4.ipv6-test.com/ ping statistics ---
4 connects, 4 ok, 0.00% failed, time 5957ms
round-trip min/avg/max = 477.7/489.1/510.4 ms

traceroute ports only 1 hop, which is WAN's IP under modem (router mode) LAN

# traceroute -i eth2 v4.ipv6-test.com
traceroute to v4.ipv6-test.com (51.75.78.103), 30 hops max, 46 byte packets
 1  192.168.20.16 (192.168.20.16)  3062.560 ms !H  3072.174 ms !H  3075.724 ms !H

curl reports host unreachable

# curl -k --interface eth2 https://v4.ipv6-test.com/api/myip.php
curl: (7) Failed to connect to v4.ipv6-test.com port 443: Host is unreachable

/etc/config/network

config interface 'wan_mrd'
	option ifname 'eth2'
	option proto 'dhcp'
	option metric '30'
	option peerdns '1'
	option dns '208.67.222.222,208.67.220.220'
	option ipv6 '1'

config interface 'wan_mrd6'
	option proto 'dhcpv6'
	option ifname 'eth2'
	option reqaddress 'try'
	option metric '40'
	option peerdns '0'
	option reqprefix '56'
# uci show network.wan_mrd
network.wan_mrd=interface
network.wan_mrd.ifname='eth2'
network.wan_mrd.proto='dhcp'
network.wan_mrd.metric='30'
network.wan_mrd.peerdns='1'
network.wan_mrd.dns='208.67.222.222,208.67.220.220'
network.wan_mrd.ipv6='1'
# ip a show
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether a0:36:9f:aa:4b:6a brd ff:ff:ff:ff:ff:ff
    inet 192.168.20.16/24 brd 192.168.20.255 scope global eth2
       valid_lft forever preferred_lft forever
    inet6 2804:14c:xxxx:5316::1001/128 scope global dynamic noprefixroute
       valid_lft 85744sec preferred_lft 85744sec
    inet6 2804:14c:xxxx:5316:a236:9fff:feaa:4b6a/64 scope global dynamic noprefixroute
       valid_lft 86390sec preferred_lft 71990sec
    inet6 2804:14c:xxxx:5316:ec9c:ec1e:8e5a:83ec/64 scope global temporary dynamic
       valid_lft 85453sec preferred_lft 71053sec
    inet6 fe80::a236:9fff:feaa:4b6a/64 scope link
       valid_lft forever preferred_lft forever
# ip route show
default via 192.168.29.1 dev eth1 proto static src 192.168.29.33
default via 179.184.120.20 dev pppoe-want proto static metric 10
default via 192.168.20.1 dev eth2 proto static src 192.168.20.16 metric 30
default via 10.1.12.1 dev pppoe-wan_exs proto static metric 50
10.1.12.1 dev pppoe-wan_exs proto kernel scope link src 100.64.13.152
179.184.120.20 dev pppoe-want proto kernel scope link src 186.213.218.154
192.168.20.0/24 dev eth2 proto static scope link metric 30
192.168.29.0/24 dev eth1 proto kernel scope link src 192.168.29.33
192.168.35.0/24 dev eth3 proto kernel scope link src 192.168.35.22
192.168.49.0/24 dev br-lan proto kernel scope link src 192.168.49.1
# ifstatus wan_mrd
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 781,
        "l3_device": "eth2",
        "proto": "dhcp",
        "device": "eth2",
        "updated": [
                "addresses",
                "routes",
                "data"
        ],
        "metric": 30,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [
                {
                        "address": "192.168.20.16",
                        "mask": 24
                }
        ],
        "ipv6-address": [

        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "0.0.0.0",
                        "mask": 0,
                        "nexthop": "192.168.20.1",
                        "source": "192.168.20.16/32"
                }
        ],
        "dns-server": [
                "181.213.132.2",
                "181.213.132.3"
        ],
        "dns-search": [

        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "leasetime": 3600
        }
}

Any idea what might be wrong?

I changed network to static and same issue happens, so it's not due to DHCP.

config interface 'wan_mrd'
	option ifname 'eth2'
#	option proto 'dhcp'
	option proto 'static'
	option ipaddr '192.168.20.16'
	option netmask '255.255.255.0'
	option gateway '192.168.20.1'
	option metric '30'
	option peerdns '1'
	option dns '208.67.222.222,208.67.220.220'
	option ipv6 '1'

#config interface 'wan_mrd6'
#	option proto 'dhcpv6'
#	option ifname 'eth2'
#	option reqaddress 'try'
#	option metric '40'
#	option peerdns '0'
#	option reqprefix '56'
# ip route show
default via 192.168.29.1 dev eth1 proto static src 192.168.29.33
default via 179.184.120.20 dev pppoe-want proto static metric 10
default via 192.168.20.1 dev eth2 proto static metric 30
default via 10.1.12.1 dev pppoe-wan_exs proto static metric 50
10.1.12.1 dev pppoe-wan_exs proto kernel scope link src 100.64.13.152
179.184.120.20 dev pppoe-want proto kernel scope link src 186.213.218.154
192.168.20.0/24 dev eth2 proto static scope link metric 30
192.168.29.0/24 dev eth1 proto kernel scope link src 192.168.29.33
192.168.35.0/24 dev eth3 proto kernel scope link src 192.168.35.22
192.168.49.0/24 dev br-lan proto kernel scope link src 192.168.49.1

It is best to isolate the issue by eliminating the possibility that its cause is on the side of the ISP.

3 Likes

tcpdump -i eth2 -evn icmp
and run again the ping.

2 Likes

Tnx a lot for the help.

# ping -c 4 -I eth2 ipv4.google.com
PING ipv4.l.google.com (172.217.162.142) from 192.168.20.16 eth2: 56(84) bytes of data.
64 bytes from gru14s19-in-f14.1e100.net (172.217.162.142): icmp_seq=4 ttl=54 time=33.3 ms

--- ipv4.l.google.com ping statistics ---
4 packets transmitted, 1 received, 75% packet loss, time 3057ms
rtt min/avg/max/mdev = 33.251/33.251/33.251/0.000 ms, pipe 3

resulted on

# tcpdump -i eth2 -evn icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
20:34:42.942094 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 33803, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 172.217.162.142: ICMP echo request, id 45400, seq 4, length 64
20:34:42.975332 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 54, id 0, offset 0, flags [none], proto ICMP (1), length 84)
    172.217.162.142 > 192.168.20.16: ICMP echo reply, id 45400, seq 4, length 64
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel

What does it mean?

And this time 1 of the attempts suceeded, this is very odd.

My best bet is that modem isn't providing proper route info, because the ISP had alrdy declared they won't comply to Internet protocols. But my laptop works on it. So, if ISP sends a tech, he'll wanna connect a PC on it directly and see it working and declare it's my router issue.

I need to either find what's wrong on my router or find proof of what exactly the modem is doing wrong.

1 Like

Try to clone the working MAC address from the laptop to the respective WAN interface of the router.

1 Like

Is it possible to set MAC on Intel i350 ports?

AFAIK, these modems on bridge mode delegate IPs to any device when only 1 is connected, on any port. To change the device we just need to turn them off for a few minutes. On router mode, they just accept any amount of devices and switches.

Do you run the tcpdump before you start the ping?

1 Like

Yes, and stopped it after ping finished :confused:

Does it work if you ping from another source interface?

Sorry, ignore that post. I had turned off the modem so it'd "forget" any MAC and forgot to turn it back on.

Sadly it was for no use, it remains not working.

# ping -c 4 -I eth2 v4.ipv6-test.com ; ping -c 4 -I eth2 ipv4.google.com ; ping -c 4 -I eth2 amazon.com
PING v4.ipv6-test.com (51.75.78.103) from 192.168.20.16 eth2: 56(84) bytes of data.
64 bytes from muscaria.t0x.net (51.75.78.103): icmp_seq=4 ttl=44 time=243 ms

--- v4.ipv6-test.com ping statistics ---
4 packets transmitted, 1 received, 75% packet loss, time 3070ms
rtt min/avg/max/mdev = 242.879/242.879/242.879/0.000 ms, pipe 3
PING ipv4.l.google.com (142.250.219.14) from 192.168.20.16 eth2: 56(84) bytes of data.

--- ipv4.l.google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3078ms
pipe 4
PING amazon.com (54.239.28.85) from 192.168.20.16 eth2: 56(84) bytes of data.

--- amazon.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3055ms
pipe 4
# tcpdump -i eth2 -evn icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
10:31:57.503010 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 5570, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 51.75.78.103: ICMP echo request, id 61150, seq 4, length 64
10:31:57.745204 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 44, id 51755, offset 0, flags [none], proto ICMP (1), length 84)
    51.75.78.103 > 192.168.20.16: ICMP echo reply, id 61150, seq 4, length 64
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel

I guess it's not a route issue because 1 package was successful. But I have no idea why the others were lost.

Here's full network config. Other 2 ISPs are working with 100% availability for a couple days.

# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option local_source 'lan'
        option mmx_mask '0x3F00'
        option ula_prefix 'ddfa::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr '192.168.49.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ip6ifaceid '::1'
        option ip6class 'local' # disable GUA leasing

config interface 'want'
        option ifname 'eth3'
        option proto 'pppoe'
        option username 'cliente@cliente'
        option password 'cliente'
        option peerdns '1'
        option dns '208.67.222.222,208.67.220.220'
        option ipv6 '1'
        option delegate '0'
        option metric '10'

config interface 'want6'
        option ifname '@want'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option peerdns '0'
        option metric '20'
        option reqprefix '56'

config interface 'modem_telefk'
        option proto 'static'
        option ifname 'eth3'
        option ipaddr '192.168.35.22'
        option netmask '255.255.255.0'

config interface 'wan_mrd'
        option ifname 'eth2'
#       option proto 'dhcp'
        option proto 'static'
        option ipaddr '192.168.20.16'
        option netmask '255.255.255.0'
        option gateway '192.168.20.1'
        option metric '30'
        option peerdns '1'
        option dns '208.67.222.222,208.67.220.220'
        option ipv6 '1'

#config interface 'wan_mrd6'
#       option proto 'dhcpv6'
#       option ifname 'eth2'
#       option reqaddress 'try'
#       option metric '40'
#       option peerdns '0'
#       option reqprefix '56'

#config interface 'modem_mrd'
#       option ifname 'eth2'
#       option proto 'static'
#       option ipaddr '192.168.20.9'
#       option netmask '255.255.255.0'

config interface 'wan_exs'
        option ifname 'eth1'
        option proto 'pppoe'
        option username 'xxxxxxxxxxxx'
        option password 'xxxxxxxxxxxxxx'
        option peerdns '1'
        option dns '208.67.222.222,208.67.220.220'
        option ipv6 '1'
        option delegate '0'
        option metric '50'

config interface 'wan_exs6'
        option ifname '@wan_exs'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option peerdns '0'
        option metric '60'
        option reqprefix '56'

config interface 'modem_exs'
        option proto 'dhcp'
        option ifname 'eth1'

I agree that it's not a routing issue and it looks very strange that only one ping is captured in tcpdump.
Can you try it like this? tcpdump -i any -evn icmp

1 Like

It's not that 1 ping is captured, it's that only 1 from 12 that succeeded. So, does it mean that the 11 pings that failed never tried to leave the router? Would they appear on the dump if they left the router and reached the modem?

I tried with any and a whole lot of data was captured, these are the last ones.

11:50:37.929479 Out ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 3, id 30601, offset 0, flags [none], proto ICMP (1), length 56)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26679, length 36
11:50:37.931681  In ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 62, id 41924, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.160.238 > 186.213.218.154: ICMP time exceeded in-transit, length 64
        (tos 0x0, id 30601, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 6d11 (->6e11)!)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26679, length 36
11:50:37.931687 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 61, id 41924, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.160.238 > 192.168.49.12: ICMP time exceeded in-transit, length 64
        (tos 0x0, id 30601, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 10cd (->11cd)!)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26679, length 36
11:50:37.931688 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 61, id 41924, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.160.238 > 192.168.49.12: ICMP time exceeded in-transit, length 64
        (tos 0x0, id 30601, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 10cd (->11cd)!)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26679, length 36
11:50:37.951573 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 14162, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 119.196.35.117: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 103, id 23742, offset 0, flags [none], proto UDP (17), length 48)
    119.196.35.117.52985 > 186.213.218.154.51414: UDP, length 20
11:50:37.979669  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 5, id 30602, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:37.979669  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 5, id 30602, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:37.979685 Out ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 4, id 30602, offset 0, flags [none], proto ICMP (1), length 56)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:38.004430  In ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 243, id 0, offset 0, flags [none], proto ICMP (1), length 56)
    84.16.8.123 > 186.213.218.154: ICMP time exceeded in-transit, length 36
        (tos 0x20, ttl 1, id 248, offset 0, flags [DF], proto ICMP (1), length 28)
    186.213.218.154 > 52.95.120.34: ICMP echo request, id 34708, seq 256, length 8
11:50:38.004602 Out ethertype IPv4 (0x0800), length 44: (tos 0x0, ttl 12, id 249, offset 0, flags [DF], proto ICMP (1), length 28)
    186.213.218.154 > 52.95.120.34: ICMP echo request, id 21108, seq 256, length 8
11:50:38.004720  In ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 59, id 52307, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.194.197 > 186.213.218.154: ICMP time exceeded in-transit, length 64
        (tos 0x0, ttl 1, id 30602, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 6c10 (->6d10)!)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:38.004725 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 58, id 52307, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.194.197 > 192.168.49.12: ICMP time exceeded in-transit, length 64
        (tos 0x0, ttl 1, id 30602, offset 0, flags [none], proto ICMP (1), length 56, bad cksum fcc (->10cc)!)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:38.004726 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 100: (tos 0xc0, ttl 58, id 52307, offset 0, flags [none], proto ICMP (1), length 84)
    152.255.194.197 > 192.168.49.12: ICMP time exceeded in-transit, length 64
        (tos 0x0, ttl 1, id 30602, offset 0, flags [none], proto ICMP (1), length 56, bad cksum fcc (->10cc)!)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26680, length 36
11:50:38.029811  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 6, id 30603, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26681, length 36
11:50:38.029811  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 6, id 30603, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26681, length 36
11:50:38.029820 Out ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 5, id 30603, offset 0, flags [none], proto ICMP (1), length 56)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26681, length 36
11:50:38.079921  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 7, id 30604, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26682, length 36
11:50:38.079921  In 1c:69:7a:01:c1:a6 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 7, id 30604, offset 0, flags [none], proto ICMP (1), length 56)
    192.168.49.12 > 69.171.250.15: ICMP echo request, id 181, seq 26682, length 36
11:50:38.079935 Out ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 6, id 30604, offset 0, flags [none], proto ICMP (1), length 56)
    186.213.218.154 > 69.171.250.15: ICMP echo request, id 181, seq 26682, length 36
^C
411 packets captured
411 packets received by filter
0 packets dropped by kernel

I see some strange entries here.
6 pings have bad checksum.
15 pings have a very low ttl value, so they most likely won't make it to their destination.
A ping leaving OpenWrt should have a value of 64. Did you make any changes to that or installed any package recently?

1 Like

I installed a few python libs, watch and today installed tcpdump.

Oh it was PingPlotter on my other PC, I kept it running. I closed it and ran tcpdump again.

13:19:09.000586 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 169: (tos 0x0, ttl 51, id 3085, offset 0, flags [none], proto ICMP (1), length 153)
    41.254.54.1 > 192.168.49.4: ICMP time exceeded in-transit, length 133
        (tos 0x0, ttl 1, id 25115, offset 0, flags [DF], proto UDP (17), length 125)
    192.168.49.4.51414 > 102.68.128.158.10205: UDP, length 97
13:19:09.000589 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 169: (tos 0x0, ttl 51, id 3085, offset 0, flags [none], proto ICMP (1), length 153)
    41.254.54.1 > 192.168.49.4: ICMP time exceeded in-transit, length 133
        (tos 0x0, ttl 1, id 25115, offset 0, flags [DF], proto UDP (17), length 125)
    192.168.49.4.51414 > 102.68.128.158.10205: UDP, length 97
13:19:09.006074  In ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 47, id 29042, offset 0, flags [none], proto ICMP (1), length 56)
    213.211.225.31 > 186.213.218.154: ICMP host 213.211.225.31 unreachable - admin prohibited filter, length 36
        (tos 0x0, ttl 46, id 29042, offset 0, flags [DF], proto UDP (17), length 125)
    186.213.218.154.51414 > 213.211.225.31.6881: UDP, length 97
13:19:09.006082 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 46, id 29042, offset 0, flags [none], proto ICMP (1), length 56)
    213.211.225.31 > 192.168.49.4: ICMP host 213.211.225.31 unreachable - admin prohibited filter, length 36
        (tos 0x0, ttl 46, id 29042, offset 0, flags [DF], proto UDP (17), length 125)
    192.168.49.4.51414 > 213.211.225.31.6881: UDP, length 97
13:19:09.006083 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 46, id 29042, offset 0, flags [none], proto ICMP (1), length 56)
    213.211.225.31 > 192.168.49.4: ICMP host 213.211.225.31 unreachable - admin prohibited filter, length 36
        (tos 0x0, ttl 46, id 29042, offset 0, flags [DF], proto UDP (17), length 125)
    192.168.49.4.51414 > 213.211.225.31.6881: UDP, length 97
13:19:09.113356 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 24212, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 129.205.165.139: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 108, id 11312, offset 0, flags [none], proto UDP (17), length 48)
    129.205.165.139.39082 > 186.213.218.154.51414: UDP, length 20
13:19:09.134641 Out ethertype IPv4 (0x0800), length 592: (tos 0xc0, ttl 64, id 11683, offset 0, flags [none], proto ICMP (1), length 576)
    186.213.218.154 > 38.91.100.129: ICMP 186.213.218.154 udp port 30187 unreachable, length 556
        (tos 0x0, ttl 51, id 1091, offset 0, flags [DF], proto UDP (17), length 1150)
    38.91.100.129.39785 > 186.213.218.154.30187: UDP, length 1122
13:19:09.181212 Out ethertype IPv4 (0x0800), length 173: (tos 0xc0, ttl 64, id 60715, offset 0, flags [none], proto ICMP (1), length 157)
    186.213.218.154 > 82.127.55.216: ICMP 186.213.218.154 udp port 51414 unreachable, length 137
        (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto UDP (17), length 129)
    82.127.55.216.11464 > 186.213.218.154.51414: UDP, length 101[|icmp]
13:19:09.239962  In ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 240, id 55449, offset 0, flags [none], proto ICMP (1), length 56)
    184.10.116.2 > 100.64.13.152: ICMP time exceeded in-transit, length 36
        (tos 0x0, ttl 1, id 2260, offset 0, flags [DF], proto UDP (17), length 86)
    100.64.13.152.25189 > 205.238.225.185.21735: UDP, length 58
13:19:09.239981 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 239, id 55449, offset 0, flags [none], proto ICMP (1), length 56)
    184.10.116.2 > 192.168.49.4: ICMP time exceeded in-transit, length 36
        (tos 0x0, ttl 1, id 2260, offset 0, flags [DF], proto UDP (17), length 86)
    192.168.49.4.51411 > 205.238.225.185.21735: UDP, length 58
13:19:09.239984 Out a0:36:9f:aa:4b:68 ethertype IPv4 (0x0800), length 72: (tos 0x0, ttl 239, id 55449, offset 0, flags [none], proto ICMP (1), length 56)
    184.10.116.2 > 192.168.49.4: ICMP time exceeded in-transit, length 36
        (tos 0x0, ttl 1, id 2260, offset 0, flags [DF], proto UDP (17), length 86)
    192.168.49.4.51411 > 205.238.225.185.21735: UDP, length 58
^C
46 packets captured
46 packets received by filter
0 packets dropped by kernel

192.168.49.4 is my server, idk what it's doing at this moment lol

186.213.218.154 is registered on LACNIC for one of my ISPs.

140.240.9.118 is registered on APNIC for some China backbone.

I noticed my old server .2 creating traffic too. Let me disable them to try to clean tcpdump.

Ok I disabled torrents and monitoring, now IDK what on the server is making these pings.

13:35:25.830241  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl 54, id 4166, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 186.213.218.154: ICMP echo reply, id 36595, seq 1, length 64
13:35:25.831381 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl 60, id 39238, offset 0, flags [DF], proto ICMP (1), length 84)
    186.213.218.154 > 172.217.29.174: ICMP echo request, id 14167, seq 1, length 64
13:35:25.967808  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 52607, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 118.157.144.49: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 108, id 62371, offset 0, flags [none], proto UDP (17), length 48)
    118.157.144.49.17376 > 192.168.49.4.51414: UDP, length 20
13:35:25.967808  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 52607, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 118.157.144.49: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 108, id 62371, offset 0, flags [none], proto UDP (17), length 48)
    118.157.144.49.17376 > 192.168.49.4.51414: UDP, length 20
13:35:25.967821 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 63, id 52607, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 118.157.144.49: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 108, id 62371, offset 0, flags [none], proto UDP (17), length 48)
    118.157.144.49.17376 > 186.213.218.154.51414: UDP, length 20
13:35:26.105199 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 9395, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 140.240.9.118: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 44, id 23870, offset 0, flags [DF], proto UDP (17), length 48)
    140.240.9.118.19296 > 186.213.218.154.51414: UDP, length 20
13:35:26.382561  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 34976, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 138.199.18.146: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 112, id 55795, offset 0, flags [none], proto UDP (17), length 48)
    138.199.18.146.36672 > 192.168.49.4.51414: UDP, length 20
13:35:26.382561  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 34976, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 138.199.18.146: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 112, id 55795, offset 0, flags [none], proto UDP (17), length 48)
    138.199.18.146.36672 > 192.168.49.4.51414: UDP, length 20
13:35:26.382602 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 63, id 34976, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 138.199.18.146: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 112, id 55795, offset 0, flags [none], proto UDP (17), length 48)
    138.199.18.146.36672 > 186.213.218.154.51414: UDP, length 20
13:35:26.444780  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 64, id 48132, offset 0, flags [none], proto ICMP (1), length 86)
    192.168.49.4 > 92.202.149.80: ICMP 192.168.49.4 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 108, id 22588, offset 0, flags [none], proto UDP (17), length 58)
    92.202.149.80.43269 > 192.168.49.4.51414: UDP, length 30
13:35:26.444780  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 64, id 48132, offset 0, flags [none], proto ICMP (1), length 86)
    192.168.49.4 > 92.202.149.80: ICMP 192.168.49.4 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 108, id 22588, offset 0, flags [none], proto UDP (17), length 58)
    92.202.149.80.43269 > 192.168.49.4.51414: UDP, length 30
13:35:26.444820 Out ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 63, id 48132, offset 0, flags [none], proto ICMP (1), length 86)
    186.213.218.154 > 92.202.149.80: ICMP 186.213.218.154 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 108, id 22588, offset 0, flags [none], proto UDP (17), length 58)
    92.202.149.80.43269 > 186.213.218.154.51414: UDP, length 30
13:35:26.605534 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 23928, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 49.77.161.174: ICMP 186.213.218.154 udp port 51411 unreachable, length 56
        (tos 0x0, ttl 44, id 40032, offset 0, flags [DF], proto UDP (17), length 48)
    49.77.161.174.27149 > 186.213.218.154.51411: UDP, length 20
13:35:26.770903 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 58742, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 1.87.247.188: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 42, id 56081, offset 0, flags [DF], proto UDP (17), length 48)
    1.87.247.188.13687 > 186.213.218.154.51414: UDP, length 20
13:35:26.850953  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 56846, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 123.181.9.27: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 106, id 29425, offset 0, flags [none], proto UDP (17), length 48)
    123.181.9.27.16388 > 192.168.49.4.51414: UDP, length 20
13:35:26.850953  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 56846, offset 0, flags [none], proto ICMP (1), length 76)
    192.168.49.4 > 123.181.9.27: ICMP 192.168.49.4 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 106, id 29425, offset 0, flags [none], proto UDP (17), length 48)
    123.181.9.27.16388 > 192.168.49.4.51414: UDP, length 20
13:35:26.850992 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 63, id 56846, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 123.181.9.27: ICMP 186.213.218.154 udp port 51414 unreachable, length 56
        (tos 0x0, ttl 106, id 29425, offset 0, flags [none], proto UDP (17), length 48)
    123.181.9.27.16388 > 186.213.218.154.51414: UDP, length 20
13:35:26.956936 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 53835, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 189.113.209.26: ICMP 186.213.218.154 udp port 51412 unreachable, length 56
        (tos 0x0, ttl 116, id 42882, offset 0, flags [none], proto UDP (17), length 48)
    189.113.209.26.13213 > 186.213.218.154.51412: UDP, length 20
13:35:26.999198  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 64, id 61476, offset 0, flags [none], proto ICMP (1), length 86)
    192.168.49.4 > 106.212.190.86: ICMP 192.168.49.4 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 106, id 30813, offset 0, flags [none], proto UDP (17), length 58)
    106.212.190.86.13505 > 192.168.49.4.51414: UDP, length 30
13:35:26.999198  In 04:d9:f5:79:bd:c0 ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 64, id 61476, offset 0, flags [none], proto ICMP (1), length 86)
    192.168.49.4 > 106.212.190.86: ICMP 192.168.49.4 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 106, id 30813, offset 0, flags [none], proto UDP (17), length 58)
    106.212.190.86.13505 > 192.168.49.4.51414: UDP, length 30
13:35:26.999211 Out ethertype IPv4 (0x0800), length 102: (tos 0xc0, ttl 63, id 61476, offset 0, flags [none], proto ICMP (1), length 86)
    186.213.218.154 > 106.212.190.86: ICMP 186.213.218.154 udp port 51414 unreachable, length 66
        (tos 0x0, ttl 106, id 30813, offset 0, flags [none], proto UDP (17), length 58)
    106.212.190.86.13505 > 186.213.218.154.51414: UDP, length 30
13:35:27.406052 Out ethertype IPv4 (0x0800), length 92: (tos 0xc0, ttl 64, id 4192, offset 0, flags [none], proto ICMP (1), length 76)
    186.213.218.154 > 46.246.122.115: ICMP 186.213.218.154 udp port 51411 unreachable, length 56
        (tos 0x0, ttl 108, id 65017, offset 0, flags [none], proto UDP (17), length 48)
    46.246.122.115.11818 > 186.213.218.154.51411: UDP, length 20
^C
90 packets captured
90 packets received by filter
0 packets dropped by kernel

Nothing interesting here.

Only the first 2 lines show a ping and a reply. Again the TTL is not the expected, as if it is coming from some other host in the lan 4 hops away.
The rest is just icmp unreachables for your torrent client.

1 Like

So, they are normal traffic on the LAN using some other WAN.

I tried eth2 again, oddly 1 of the pings succeeded, but tcpdump saw nothing.

# ping -c 4 -I eth2 v4.ipv6-test.com ; ping -c 4 -I eth2 ipv4.google.com ; ping -c 4 -I eth2 amazon.com
PING v4.ipv6-test.com (51.75.78.103) from 192.168.20.16 eth2: 56(84) bytes of data.
64 bytes from muscaria.t0x.net (51.75.78.103): icmp_seq=4 ttl=44 time=243 ms

--- v4.ipv6-test.com ping statistics ---
4 packets transmitted, 1 received, 75% packet loss, time 3070ms
rtt min/avg/max/mdev = 242.879/242.879/242.879/0.000 ms, pipe 3
PING ipv4.l.google.com (142.250.219.14) from 192.168.20.16 eth2: 56(84) bytes of data.

--- ipv4.l.google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3078ms
pipe 4
PING amazon.com (54.239.28.85) from 192.168.20.16 eth2: 56(84) bytes of data.

--- amazon.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3055ms
pipe 4
root@RyzenWRT:/usr/script# ping -c 4 -I eth2 v4.ipv6-test.com ; ping -c 4 -I eth2 ipv4.google.com ; ping -c 4 -I eth2 amazon.com
PING v4.ipv6-test.com (51.75.78.103) from 192.168.20.16 eth2: 56(84) bytes of data.

--- v4.ipv6-test.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3059ms
pipe 4
PING ipv4.l.google.com (142.250.79.14) from 192.168.20.16 eth2: 56(84) bytes of data.

--- ipv4.l.google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3054ms
pipe 4
PING amazon.com (205.251.242.103) from 192.168.20.16 eth2: 56(84) bytes of data.

--- amazon.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3064ms
pipe 4
# tcpdump -i eth2 -evn icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

A few hours ago I received a call from ISP ombudsman answering the complaint I did a week ago, and she scheduled a visit for tomorrow.

If I can show it's ISP's fault they must solve it, but of course they're gonna blame my router as my laptop is able to connect to Internet. I'll show the other 2 ISPs working and explain that any network device connected to their modem must reach Internet, but they won't accept it.

Pinging the modem.

# ping -c 4 -I eth2 192.168.20.1
PING 192.168.20.1 (192.168.20.1) from 192.168.20.16 eth2: 56(84) bytes of data.
64 bytes from 192.168.20.1: icmp_seq=1 ttl=64 time=0.373 ms
64 bytes from 192.168.20.1: icmp_seq=2 ttl=64 time=0.317 ms
64 bytes from 192.168.20.1: icmp_seq=3 ttl=64 time=0.855 ms
64 bytes from 192.168.20.1: icmp_seq=4 ttl=64 time=0.426 ms

--- 192.168.20.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3038ms
rtt min/avg/max/mdev = 0.317/0.492/0.855/0.212 ms
# tcpdump -i eth2 -evn icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
14:04:55.936098 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 2808, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 192.168.20.1: ICMP echo request, id 50796, seq 1, length 64
14:04:55.936438 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14483, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.20.1 > 192.168.20.16: ICMP echo reply, id 50796, seq 1, length 64
14:04:56.935948 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 3055, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 192.168.20.1: ICMP echo request, id 50796, seq 2, length 64
14:04:56.936248 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14600, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.20.1 > 192.168.20.16: ICMP echo reply, id 50796, seq 2, length 64
14:04:57.950274 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 3261, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 192.168.20.1: ICMP echo request, id 50796, seq 3, length 64
14:04:57.951093 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14716, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.20.1 > 192.168.20.16: ICMP echo reply, id 50796, seq 3, length 64
14:04:58.973953 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 3339, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 192.168.20.1: ICMP echo request, id 50796, seq 4, length 64
14:04:58.974350 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14819, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.20.1 > 192.168.20.16: ICMP echo reply, id 50796, seq 4, length 64
^C
8 packets captured
8 packets received by filter
0 packets dropped by kernel

So, eth2 interface is working and 192.168.20.0 is reachable. Internet doesn't even leave the router. This makes me believe again it's some routing issue.

I tried stopping mwan3 a few days ago and that stopped whole access to internet. How could I disable mwan3 as if it wasn't installed? Maybe it's messing iptables?

I added the interface to mwan3, this is mwan3 pinging. Now, if mwan3 is able to ping, why isn't ping itself able to?

# tcpdump -i eth2 -evn icmp
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
14:14:19.676037 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 60, id 23371, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 72.14.198.181: ICMP echo request, id 57303, seq 1, length 64
14:14:19.712160 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 50, id 41113, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 192.168.20.16: ICMP echo reply, id 57303, seq 1, length 64
14:14:25.714932 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 60, id 23778, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 72.14.198.181: ICMP echo request, id 46287, seq 1, length 64
14:14:25.748956 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 50, id 41327, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 192.168.20.16: ICMP echo reply, id 46287, seq 1, length 64
14:14:31.751506 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 60, id 24705, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 72.14.198.181: ICMP echo request, id 55558, seq 1, length 64
14:14:31.786200 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 50, id 42058, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 192.168.20.16: ICMP echo reply, id 55558, seq 1, length 64
14:14:37.788591 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 60, id 24721, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 72.14.198.181: ICMP echo request, id 24389, seq 1, length 64
14:14:37.822191 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 50, id 42540, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 192.168.20.16: ICMP echo reply, id 24389, seq 1, length 64
14:14:43.825104 a0:36:9f:aa:4b:6a > 94:2c:b3:47:1f:07, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 60, id 25992, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.20.16 > 72.14.198.181: ICMP echo request, id 11116, seq 1, length 64
14:14:43.862587 94:2c:b3:47:1f:07 > a0:36:9f:aa:4b:6a, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 50, id 42982, offset 0, flags [none], proto ICMP (1), length 84)
    72.14.198.181 > 192.168.20.16: ICMP echo reply, id 11116, seq 1, length 64
^C
10 packets captured
10 packets received by filter
0 packets dropped by kernel