[SOLVED] Strange Wine + League of Legends + Lede bug

Installing and Using OpenWrt
1

I am running into a really weird issue where League of Legends isn't able to connect to the login queue server while running League of Legends under Wine behind a Lede router:

  1. Same computer + League of Legends under Windows behind Lede router = fine
  2. Same computer + League of Legends under Wine behind ISP router = fine
  3. Same computer + League of Legends under Wine behind Lede router = cannot connect to login queue.

In case 3), the internet connection itself seems fine. Because connecting to the authentication server is fine. If I use an incorrect password, I get an error message. If I use the correct password it then tries to connect to the login server (The authentication server and login queue server are two separate servers apparently ), the login process hangs for a while and then the connection times out. I am not even sure where to begin debugging this issue. Does anyone have a clue where I should be looking to solve this issue? A more elaborate description of other people experiencing the exact same issue can be found here: https://bugs.winehq.org/show_bug.cgi?id=44895

2

just a guess, but try (temporarily) disabling ipv6 on your linux/wine computer:
# sysctl -w net.ipv6.conf.all.disable_ipv6=1
(before starting the launcher/game)

3

Unfortunately, that doesn't work :frowning:

4

unfortunately the riotgames site tells users to forward a lot of ports (including 80 and 443 wtf???) have you tried with no forwardings?

a packet capture would probably provide some insight.
you could run # tcpdump -npi <networkdevice> -w <filename> on your desktop.
make sure to minimize all network traffic (close browser, etc) while capturing the failure and send the file to their support

5

I am not using any forwardings, as they are not needed on Windows either.

Support is unwilling to help, because Linux isn't supported Officially, and League of Legends runs fine under Windows.

6

There could be some hints in the packet capture. Just make sure password is not there in open text.

Close all apps, start capture, start game, reproduce the issue, close game, stop capture. Use WireShark to open the file and look for your user name and password. Delete those packets if found.

7

You're right. I am seeing tens of TCP Retransmission packets in the logs to Riot's login queue server, which means either the packets themselves aren't reaching Riots login queue server, or the Acks aren't getting back to my PC. I can ping said server fine however, so the connection to that server is fine.

Any ideas why this problem would show in one particular configuration, but not others as described in my first post? I have shutdown Fedora's firewall and enabled logging on Lede's firewall. Lede's firewall isn't dropping any packets coming from Riot's servers, so I believe it isn't a firewall issue.

Edit: I am also seeing plenty of RST packets, from my PC to Riot's servers. Could these be involved in the issue?

8

Have you confirmed that the packets are reaching the router? Might take running a parallel tcpdump on it.
I would also try disabling router’s firewall as there maybe some rouge rule.

9

Getting some more interesting information from the tcpdump on my router.

Riot's servers are returning "ICMP ip reassembly time exceeded" packets back to me.

Also, I am seeing packets like this:

11:38:04.843550 IP (tos 0x0, ttl 63, id 65422, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6

Is ip-proto-6 related to IPv6 by any chance? Because if so, it is strange packets using the IPv6 protocol are being send from/to IPv4 addresses. If ip-proto-6 is something else entirely, then please disregard this stupid comment :wink:

Edit: I can ping Riot's servers with packets much larger than 1460 bytes just fine, meaning fragmentation/reassembly does work in that case.

Edit 2: Could MSS clamping be to blame by any chance? My ISP router uses baby jumbo frames (1508 MTU), giving an effective MTU of 1500 after pppoe's overhead. Lede is using a 1500 MTU, so an effective 1492 MTU after PPPOE overhead. I cannot really test without MSS clamping, since I need it for my connection to work properly. But the master branch does support Baby jumbo frames for my router. If this is worth trying, I could flash a master branch build, use baby jumbo frames and disable MSS clamping. Just thinking out loud here.

10

As a workaround I simply decreased the MTU to 1492 on my Fedora PC so that MSS clamping shouldn't trigger anymore for these packets. Andddd, success! I can finally login :slight_smile: Not sure if this is a bug, and if so, where this is located. If anybody more knowledgeable than me would be able to chime in, I can make sure that this is reported as a bug in the proper place. For now I am simply happy I can enjoy LoL under Linux. Marking this as solved :slight_smile:

11

I think MSS clamping was supposed to take care of this. Are you curious enough to capture packets on the router from your Windows and Linux clients and compare them? I wonder if wine sets the no fragmentation flag.
There must be some difference in the packet to explain the behaviour you are observing.

12

I'll dive into that now. Just to be sure, the packet capture should be done on Windows and on Linux with the non-working config, correct? I'll share the capture in a few minutes. By the way, thank you very much for pointing me in the right direction :slight_smile:

13

You can do that on the router for both and use WireShark to filter by source IP to find the right packets, although ideally it is to be done on the clients and the router. This way you will have all the data to follow each packet.
You could start with the router only if access to the windows box is restricted. WireShark can also do packet capture on Linux and Windows.

Yes, non working config on Linux.

14

Okay, I made the two requested captures on the router with all packets to/from the two known IP addresses of their login queue server. If you need any additional information, please let me know :slight_smile: Had to split my message into two, due to the character limit.

Linux non-working config:

root@LEDE:~# tcpdump -i pppoe-wan -vv -nn src 104.16.20.24 or src 104.16.21.24 o
r dst 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:52:27.489531 IP (tos 0x0, ttl 63, id 34512, offset 0, flags [none], proto TCP (6), length 60)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [S], cksum 0x7fe5 (correct), seq 2853164923, win 29200, options [mss 1452,sackOK,TS val 3646073866 ecr 0,nop,wscale 7], length 0
12:52:27.494310 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [S.], cksum 0x7e5c (correct), seq 2327585567, ack 2853164924, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:52:27.494598 IP (tos 0x0, ttl 63, id 34513, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x305d (correct), seq 1, ack 1, win 229, length 0
12:52:27.495107 IP (tos 0x0, ttl 63, id 34514, offset 0, flags [none], proto TCP (6), length 557)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0x9dd3 (correct), seq 1:518, ack 1, win 229, length 517
12:52:27.499896 IP (tos 0x0, ttl 61, id 55480, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0x2f1f (correct), seq 1, ack 518, win 30, length 0
12:52:27.502757 IP (tos 0x0, ttl 61, id 55481, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0x3de6 (correct), seq 1:1453, ack 518, win 30, length 1452
12:52:27.502843 IP (tos 0x0, ttl 61, id 22714, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xf0fe (correct), seq 1453:2905, ack 518, win 30, length 1452
12:52:27.502893 IP (tos 0x0, ttl 61, id 22715, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0x7dd6 (correct), seq 2905:3150, ack 518, win 30, length 245
12:52:27.503175 IP (tos 0x0, ttl 63, id 34521, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x2896 (correct), seq 518, ack 1453, win 251, length 0
12:52:27.503249 IP (tos 0x0, ttl 63, id 34522, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], cksum 0x21da (correct), seq 518, ack 3150, win 278, length 0
12:52:27.505500 IP (tos 0x0, ttl 63, id 34523, offset 0, flags [none], proto TCP (6), length 125)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0x0d3e (correct), seq 518:603, ack 3150, win 278, length 85
12:52:27.510817 IP (tos 0x0, ttl 61, id 55484, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0x30f1 (correct), seq 3150:3193, ack 603, win 30, length 43
12:52:27.512085 IP (tos 0x0, ttl 63, id 34525, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.512161 IP (tos 0x0, ttl 63, id 34525, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:27.512195 IP (tos 0x0, ttl 63, id 34526, offset 0, flags [none], proto TCP (6), length 1271)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [P.], cksum 0xe582 (correct), seq 2063:3294, ack 3193, win 278, length 1231
12:52:27.516953 IP (tos 0x0, ttl 61, id 55485, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xd434 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
12:52:27.522763 IP (tos 0x0, ttl 63, id 34534, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.522818 IP (tos 0x0, ttl 63, id 34534, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:27.733815 IP (tos 0x0, ttl 63, id 34590, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:27.733883 IP (tos 0x0, ttl 63, id 34590, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:28.149822 IP (tos 0x0, ttl 63, id 34877, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:28.149882 IP (tos 0x0, ttl 63, id 34877, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:29.022794 IP (tos 0x0, ttl 63, id 35067, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:29.022842 IP (tos 0x0, ttl 63, id 35067, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:30.685839 IP (tos 0x0, ttl 63, id 35691, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:30.685904 IP (tos 0x0, ttl 63, id 35691, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:34.014843 IP (tos 0x0, ttl 63, id 38087, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:34.014921 IP (tos 0x0, ttl 63, id 38087, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:37.483807 IP (tos 0x0, ttl 63, id 39234, offset 0, flags [none], proto TCP (6), length 63)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [FP.], cksum 0x5924 (correct), seq 3294:3317, ack 3193, win 278, length 23
12:52:37.488741 IP (tos 0x0, ttl 61, id 55486, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [.], cksum 0xd41a (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:37.489012 IP (tos 0x0, ttl 63, id 39237, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:37.489051 IP (tos 0x0, ttl 63, id 39237, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:37.701843 IP (tos 0x0, ttl 63, id 39422, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:37.701902 IP (tos 0x0, ttl 63, id 39422, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.117816 IP (tos 0x0, ttl 63, id 39499, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.117882 IP (tos 0x0, ttl 63, id 39499, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.474124 IP (tos 0x0, ttl 63, id 39612, offset 0, flags [none], proto TCP (6), length 60)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [S], cksum 0xa676 (correct), seq 1519179134, win 29200, options [mss 1452,sackOK,TS val 3646084851 ecr 0,nop,wscale 7], length 0
12:52:38.481158 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [S.], cksum 0x18b1 (correct), seq 4087181667, ack 1519179135, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:52:38.481455 IP (tos 0x0, ttl 63, id 39614, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], cksum 0xcab1 (correct), seq 1, ack 1, win 229, length 0
12:52:38.482002 IP (tos 0x0, ttl 63, id 39615, offset 0, flags [none], proto TCP (6), length 557)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0x4f76 (correct), seq 1:518, ack 1, win 229, length 517
12:52:38.488852 IP (tos 0x0, ttl 61, id 32645, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xc973 (correct), seq 1, ack 518, win 30, length 0
12:52:38.491624 IP (tos 0x0, ttl 61, id 32646, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xc6d4 (correct), seq 1:1453, ack 518, win 30, length 1452
12:52:38.491722 IP (tos 0x0, ttl 61, id 32647, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0xaacb (correct), seq 1453:2905, ack 518, win 30, length 1452
12:52:38.491770 IP (tos 0x0, ttl 61, id 32648, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0xcef3 (correct), seq 2905:3150, ack 518, win 30, length 245
12:52:38.492023 IP (tos 0x0, ttl 63, id 39620, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], cksum 0xbc2e (correct), seq 518, ack 3150, win 278, length 0
12:52:38.494278 IP (tos 0x0, ttl 63, id 39622, offset 0, flags [none], proto TCP (6), length 125)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0x365d (correct), seq 518:603, ack 3150, win 278, length 85
12:52:38.501274 IP (tos 0x0, ttl 61, id 32649, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0x5070 (correct), seq 3150:3193, ack 603, win 30, length 43
12:52:38.503299 IP (tos 0x0, ttl 63, id 39628, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.503369 IP (tos 0x0, ttl 63, id 39628, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.503399 IP (tos 0x0, ttl 63, id 39629, offset 0, flags [none], proto TCP (6), length 1271)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [P.], cksum 0xe4ad (correct), seq 2063:3294, ack 3193, win 278, length 1231
12:52:38.510549 IP (tos 0x0, ttl 61, id 32650, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0x118a (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
12:52:38.516780 IP (tos 0x0, ttl 63, id 39631, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.516847 IP (tos 0x0, ttl 63, id 39631, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:38.725809 IP (tos 0x0, ttl 63, id 39662, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:38.725880 IP (tos 0x0, ttl 63, id 39662, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:39.005861 IP (tos 0x0, ttl 63, id 39676, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:39.005930 IP (tos 0x0, ttl 63, id 39676, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:39.149816 IP (tos 0x0, ttl 63, id 39739, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:39.149873 IP (tos 0x0, ttl 63, id 39739, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:40.030808 IP (tos 0x0, ttl 63, id 40425, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:40.030862 IP (tos 0x0, ttl 63, id 40425, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:40.669897 IP (tos 0x0, ttl 63, id 40484, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:40.669977 IP (tos 0x0, ttl 63, id 40484, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:41.757823 IP (tos 0x0, ttl 63, id 40765, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:41.757883 IP (tos 0x0, ttl 63, id 40765, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:42.499390 IP (tos 0x0, ttl 61, id 55487, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [P.], cksum 0xb210 (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
12:52:42.499491 IP (tos 0x0, ttl 61, id 55488, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49844: Flags [F.], cksum 0xd402 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:42.499679 IP (tos 0x0, ttl 63, id 40930, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [R], cksum 0xdcd0 (correct), seq 2853165526, win 0, length 0
12:52:42.499751 IP (tos 0x0, ttl 63, id 40931, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [R], cksum 0xdcd0 (correct), seq 2853165526, win 0, length 0
12:52:45.149882 IP (tos 0x0, ttl 63, id 42480, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:45.149933 IP (tos 0x0, ttl 63, id 42480, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:48.483203 IP (tos 0x0, ttl 63, id 42790, offset 0, flags [none], proto TCP (6), length 63)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [FP.], cksum 0x319e (correct), seq 3294:3317, ack 3193, win 278, length 23
12:52:48.490301 IP (tos 0x0, ttl 61, id 32651, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [.], cksum 0x1170 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:48.490610 IP (tos 0x0, ttl 63, id 42797, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:48.490650 IP (tos 0x0, ttl 63, id 42797, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:48.701801 IP (tos 0x0, ttl 63, id 42951, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:48.701855 IP (tos 0x0, ttl 63, id 42951, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:49.125822 IP (tos 0x0, ttl 63, id 43092, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:49.125881 IP (tos 0x0, ttl 63, id 43092, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:50.014814 IP (tos 0x0, ttl 63, id 43679, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:50.014875 IP (tos 0x0, ttl 63, id 43679, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:51.741951 IP (tos 0x0, ttl 63, id 44363, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:51.742001 IP (tos 0x0, ttl 63, id 44363, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.20.24: ip-proto-6
12:52:53.488166 IP (tos 0x0, ttl 61, id 32652, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [P.], cksum 0x5a08 (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
12:52:53.488291 IP (tos 0x0, ttl 61, id 32653, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.49850: Flags [F.], cksum 0x1158 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
12:52:53.488470 IP (tos 0x0, ttl 63, id 45986, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [R], cksum 0x2e4b (correct), seq 1519179737, win 0, length 0
12:52:53.488530 IP (tos 0x0, ttl 63, id 45987, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [R], cksum 0x2e4b (correct), seq 1519179737, win 0, length 0
12:52:58.018500 IP (tos 0xc0, ttl 61, id 41751, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 34534, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.018504 IP (tos 0xc0, ttl 61, id 41752, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 34590, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.018507 IP (tos 0xc0, ttl 61, id 41753, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 34525, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:58.530445 IP (tos 0xc0, ttl 61, id 42200, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 34877, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:52:59.042840 IP (tos 0xc0, ttl 61, id 42465, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 35067, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:01.090953 IP (tos 0xc0, ttl 61, id 44013, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 35691, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:04.162624 IP (tos 0xc0, ttl 61, id 44111, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 38087, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:07.746519 IP (tos 0xc0, ttl 61, id 45529, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39422, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:07.746632 IP (tos 0xc0, ttl 61, id 45528, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39237, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.258588 IP (tos 0xc0, ttl 61, id 45746, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39499, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771469 IP (tos 0xc0, ttl 61, id 45970, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39662, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771473 IP (tos 0xc0, ttl 61, id 45971, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39631, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:08.771476 IP (tos 0xc0, ttl 61, id 45972, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39628, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:09.282967 IP (tos 0xc0, ttl 61, id 46117, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 39739, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:10.306870 IP (tos 0xc0, ttl 61, id 46991, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 40425, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:10.818855 IP (tos 0xc0, ttl 61, id 47263, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 40484, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49844 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:11.842620 IP (tos 0xc0, ttl 61, id 47594, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 40765, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:15.426667 IP (tos 0xc0, ttl 61, id 48685, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 42480, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:18.498647 IP (tos 0xc0, ttl 61, id 49860, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 42797, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:19.011831 IP (tos 0xc0, ttl 61, id 50140, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 42951, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:19.522527 IP (tos 0xc0, ttl 61, id 50242, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 43092, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:20.034677 IP (tos 0xc0, ttl 61, id 50665, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 43679, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
12:53:22.082733 IP (tos 0xc0, ttl 61, id 51634, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 44363, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.49850 > 104.16.20.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
16

Windows:

root@LEDE:~# tcpdump -i pppoe-wan -vv -nn src 104.16.20.24 or src 104.16.21.24 or dst 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:57:29.010481 IP (tos 0x0, ttl 127, id 15848, offset 0, flags [DF], proto TCP (6), length 52)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [S], cksum 0x96fe (correct), seq 4106328206, win 64240, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
12:57:29.015259 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [S.], cksum 0xc143 (correct), seq 1191450492, ack 4106328207, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:57:29.015744 IP (tos 0x0, ttl 127, id 15849, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x7329 (correct), seq 1, ack 1, win 256, length 0
12:57:29.016013 IP (tos 0x0, ttl 127, id 15850, offset 0, flags [DF], proto TCP (6), length 557)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0xbb24 (correct), seq 1:518, ack 1, win 256, length 517
12:57:29.020792 IP (tos 0x0, ttl 61, id 25322, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x7206 (correct), seq 1, ack 518, win 30, length 0
12:57:29.024439 IP (tos 0x0, ttl 61, id 25323, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x9317 (correct), seq 1:1453, ack 518, win 30, length 1452
12:57:29.024444 IP (tos 0x0, ttl 61, id 25324, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x8ed9 (correct), seq 1453:2905, ack 518, win 30, length 1452
12:57:29.024547 IP (tos 0x0, ttl 61, id 25325, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x8bbf (correct), seq 2905:3150, ack 518, win 30, length 245
12:57:29.024843 IP (tos 0x0, ttl 127, id 15852, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x64d7 (correct), seq 518, ack 3150, win 256, length 0
12:57:29.025992 IP (tos 0x0, ttl 127, id 15853, offset 0, flags [DF], proto TCP (6), length 125)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0xfa97 (correct), seq 518:603, ack 3150, win 256, length 85
12:57:29.031060 IP (tos 0x0, ttl 61, id 25326, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x5287 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:29.244681 IP (tos 0x0, ttl 61, id 25327, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x5287 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:29.244936 IP (tos 0x0, ttl 127, id 15857, offset 0, flags [DF], proto TCP (6), length 52)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4df5 (correct), seq 3294, ack 3193, win 256, options [nop,nop,sack 1 {3150:3193}], length 0
12:57:29.332761 IP (tos 0x0, ttl 127, id 15858, offset 0, flags [DF], proto TCP (6), length 1492)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x1c03 (correct), seq 603:2055, ack 3193, win 256, length 1452
12:57:29.377794 IP (tos 0x0, ttl 61, id 25328, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x5f8a (correct), seq 3193, ack 2055, win 33, length 0
12:57:29.378234 IP (tos 0x0, ttl 127, id 15859, offset 0, flags [DF], proto TCP (6), length 1279)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0x2a68 (correct), seq 2055:3294, ack 3193, win 256, length 1239
12:57:29.383049 IP (tos 0x0, ttl 61, id 25329, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [.], cksum 0x5ab0 (correct), seq 3193, ack 3294, win 36, length 0
12:57:29.410401 IP (tos 0x0, ttl 61, id 25330, offset 0, flags [DF], proto TCP (6), length 1430)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x97a6 (correct), seq 3193:4583, ack 3294, win 36, length 1390
12:57:29.410511 IP (tos 0x0, ttl 61, id 25331, offset 0, flags [DF], proto TCP (6), length 1430)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0xfe0e (correct), seq 4583:5973, ack 3294, win 36, length 1390
12:57:29.410516 IP (tos 0x0, ttl 61, id 25332, offset 0, flags [DF], proto TCP (6), length 158)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0xb908 (correct), seq 5973:6091, ack 3294, win 36, length 118
12:57:29.410519 IP (tos 0x0, ttl 61, id 25333, offset 0, flags [DF], proto TCP (6), length 76)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x14d3 (correct), seq 6091:6127, ack 3294, win 36, length 36
12:57:29.410523 IP (tos 0x0, ttl 61, id 25334, offset 0, flags [DF], proto TCP (6), length 66)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [P.], cksum 0x82a7 (correct), seq 6127:6153, ack 3294, win 36, length 26
12:57:29.410815 IP (tos 0x0, ttl 127, id 15860, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e82 (correct), seq 3294, ack 6091, win 256, length 0
12:57:29.411265 IP (tos 0x0, ttl 127, id 15861, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e44 (correct), seq 3294, ack 6153, win 256, length 0
12:57:29.974984 IP (tos 0x0, ttl 127, id 15867, offset 0, flags [DF], proto TCP (6), length 52)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [S], cksum 0x7e2e (correct), seq 2321946471, win 65340, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
12:57:29.982634 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [S.], cksum 0x2d2c (correct), seq 3330414481, ack 2321946472, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
12:57:29.982966 IP (tos 0x0, ttl 127, id 15869, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xdf0d (correct), seq 1, ack 1, win 260, length 0
12:57:29.983622 IP (tos 0x0, ttl 127, id 15870, offset 0, flags [DF], proto TCP (6), length 557)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x21c0 (correct), seq 1:518, ack 1, win 260, length 517
12:57:29.990922 IP (tos 0x0, ttl 61, id 9488, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xddee (correct), seq 1, ack 518, win 30, length 0
12:57:29.993261 IP (tos 0x0, ttl 61, id 9489, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xdc30 (correct), seq 1:1453, ack 518, win 30, length 1452
12:57:29.993342 IP (tos 0x0, ttl 61, id 9490, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xaa71 (correct), seq 1453:2905, ack 518, win 30, length 1452
12:57:29.993347 IP (tos 0x0, ttl 61, id 9491, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0x7cca (correct), seq 2905:3150, ack 518, win 30, length 245
12:57:29.993556 IP (tos 0x0, ttl 127, id 15871, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xd1b0 (correct), seq 518, ack 2905, win 260, length 0
12:57:29.994681 IP (tos 0x0, ttl 127, id 15872, offset 0, flags [DF], proto TCP (6), length 125)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x57ec (correct), seq 518:603, ack 3150, win 259, length 85
12:57:30.001944 IP (tos 0x0, ttl 61, id 9492, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xa273 (correct), seq 3150:3193, ack 603, win 30, length 43
12:57:30.002781 IP (tos 0x0, ttl 127, id 15873, offset 0, flags [DF], proto TCP (6), length 837)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0x15e9 (correct), seq 603:1400, ack 3193, win 259, length 797
12:57:30.034458 IP (tos 0x0, ttl 61, id 9493, offset 0, flags [DF], proto TCP (6), length 599)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xf7fc (correct), seq 3193:3752, ack 1400, win 32, length 559
12:57:30.075040 IP (tos 0x0, ttl 127, id 15874, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xcaf2 (correct), seq 1400, ack 3752, win 257, length 0
12:57:30.443963 IP (tos 0x0, ttl 127, id 15876, offset 0, flags [DF], proto TCP (6), length 837)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0xa76c (correct), seq 1400:2197, ack 3752, win 257, length 797
12:57:30.492519 IP (tos 0x0, ttl 61, id 9494, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xc8b5 (correct), seq 3752, ack 2197, win 33, length 0
12:57:30.520119 IP (tos 0x0, ttl 61, id 9495, offset 0, flags [DF], proto TCP (6), length 599)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0x4740 (correct), seq 3752:4311, ack 2197, win 33, length 559
12:57:30.560933 IP (tos 0x0, ttl 127, id 15877, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xc5a8 (correct), seq 2197, ack 4311, win 255, length 0
12:57:31.794005 IP (tos 0x0, ttl 127, id 15887, offset 0, flags [DF], proto TCP (6), length 63)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [P.], cksum 0x351f (correct), seq 3294:3317, ack 6153, win 256, length 23
12:57:31.794117 IP (tos 0x0, ttl 127, id 15888, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [F.], cksum 0x4e2c (correct), seq 3317, ack 6153, win 256, length 0
12:57:31.798910 IP (tos 0x0, ttl 61, id 25335, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50019: Flags [F.], cksum 0x4f07 (correct), seq 6153, ack 3318, win 36, length 0
12:57:31.799343 IP (tos 0x0, ttl 127, id 15890, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50019 > 104.16.20.24.443: Flags [.], cksum 0x4e2b (correct), seq 3318, ack 6154, win 256, length 0
12:57:33.587428 IP (tos 0x0, ttl 127, id 15893, offset 0, flags [DF], proto TCP (6), length 837)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [P.], cksum 0xe574 (correct), seq 2197:2994, ack 4311, win 255, length 797
12:57:33.594403 IP (tos 0x0, ttl 61, id 9496, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [.], cksum 0xc367 (correct), seq 4311, ack 2994, win 35, length 0
12:57:33.654937 IP (tos 0x0, ttl 61, id 9497, offset 0, flags [DF], proto TCP (6), length 599)
    104.16.20.24.443 > xx.xx.xxx.xx.50026: Flags [P.], cksum 0xa327 (correct), seq 4311:4870, ack 2994, win 35, length 559
12:57:33.699997 IP (tos 0x0, ttl 127, id 15894, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.50026 > 104.16.20.24.443: Flags [.], cksum 0xc057 (correct), seq 2994, ack 4870, win 260, length 0
17

Don’t Fragment flag is set. This is why it is failing. Why woul wine do that?

18

No idea. I will file a bug report on Wine's bug tracker.

19

Hold on, it was on a reply packet. I need to compare on a bigger monitor: a small screen is getting in the way.

20

No rush :slight_smile: I'll wait before submitting the bug report.

Edit: Maybe I will have to run a capture on the LAN bridge on the Lede router as well? Since the LAN bridge has a 1500 mtu, while the pppoe-wan interface has a 1492 mtu. So the capture on the wan interface might already be missing packets from the LoL client that were too large. Let me verify my hypothesis.

21

Lan Bridge Capture:

root@LEDE:~# tcpdump -i br-lan -vv -nn src 104.16.20.24 or src 104.16.21.24 or d
st 104.16.20.24 or dst 104.16.21.24
tcpdump: listening on br-lan, link-type EN10MB (Ethernet), capture size 262144 bytes
13:30:24.696479 IP (tos 0x0, ttl 64, id 54177, offset 0, flags [none], proto TCP (6), length 60)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [S], cksum 0xbb46 (correct), seq 1859009807, win 29200, options [mss 1460,sackOK,TS val 1988623720 ecr 0,nop,wscale 7], length 0
13:30:24.701845 IP (tos 0x0, ttl 60, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [S.], cksum 0x3749 (correct), seq 1053941785, ack 1859009808, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:24.701926 IP (tos 0x0, ttl 64, id 54182, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe949 (correct), seq 1, ack 1, win 229, length 0
13:30:24.702660 IP (tos 0x0, ttl 64, id 54183, offset 0, flags [none], proto TCP (6), length 557)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x860b (correct), seq 1:518, ack 1, win 229, length 517
13:30:24.707847 IP (tos 0x0, ttl 60, id 51191, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0xe80b (correct), seq 1, ack 518, win 30, length 0
13:30:24.714741 IP (tos 0x0, ttl 60, id 51192, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x6287 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:24.714839 IP (tos 0x0, ttl 60, id 18425, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x76d2 (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:24.715002 IP (tos 0x0, ttl 64, id 54191, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe182 (correct), seq 518, ack 1453, win 251, length 0
13:30:24.715102 IP (tos 0x0, ttl 60, id 18426, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0x41db (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:24.715008 IP (tos 0x0, ttl 64, id 54192, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xdbbf (correct), seq 518, ack 2905, win 274, length 0
13:30:24.715380 IP (tos 0x0, ttl 64, id 54193, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xdab3 (correct), seq 518, ack 3150, win 297, length 0
13:30:24.717246 IP (tos 0x0, ttl 64, id 54194, offset 0, flags [none], proto TCP (6), length 125)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x54fc (correct), seq 518:603, ack 3150, win 297, length 85
13:30:24.722625 IP (tos 0x0, ttl 60, id 51195, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0xe5e9 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:24.726230 IP (tos 0x0, ttl 64, id 54197, offset 0, flags [none], proto TCP (6), length 2731)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [P.], cksum 0x4a07 (incorrect -> 0x1f3c), seq 603:3294, ack 3193, win 297, length 2691
13:30:24.731698 IP (tos 0x0, ttl 60, id 51196, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x387d (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:24.736774 IP (tos 0x0, ttl 64, id 54204, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:24.945802 IP (tos 0x0, ttl 64, id 54283, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:25.361797 IP (tos 0x0, ttl 64, id 54358, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:26.217810 IP (tos 0x0, ttl 64, id 54491, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:27.881806 IP (tos 0x0, ttl 64, id 54789, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:31.209819 IP (tos 0x0, ttl 64, id 56617, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:34.688964 IP (tos 0x0, ttl 64, id 58615, offset 0, flags [none], proto TCP (6), length 63)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [FP.], cksum 0x3ef6 (correct), seq 3294:3317, ack 3193, win 297, length 23
13:30:34.694028 IP (tos 0x0, ttl 60, id 51197, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [.], cksum 0x3863 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:34.694155 IP (tos 0x0, ttl 64, id 58619, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:34.760402 IP (tos 0x0, ttl 64, id 58626, offset 0, flags [none], proto TCP (6), length 60)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [S], cksum 0x83a4 (correct), seq 1780240912, win 29200, options [mss 1460,sackOK,TS val 1988633783 ecr 0,nop,wscale 7], length 0
13:30:34.765669 IP (tos 0x0, ttl 60, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [S.], cksum 0xadd2 (correct), seq 2916280891, ack 1780240913, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:34.765778 IP (tos 0x0, ttl 64, id 58632, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x5fd3 (correct), seq 1, ack 1, win 229, length 0
13:30:34.766210 IP (tos 0x0, ttl 64, id 58633, offset 0, flags [none], proto TCP (6), length 557)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0xd061 (correct), seq 1:518, ack 1, win 229, length 517
13:30:34.771532 IP (tos 0x0, ttl 60, id 1139, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x5e95 (correct), seq 1, ack 518, win 30, length 0
13:30:34.775825 IP (tos 0x0, ttl 60, id 1140, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x4523 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:34.775912 IP (tos 0x0, ttl 60, id 1141, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0xabde (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:34.775963 IP (tos 0x0, ttl 60, id 1142, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x0075 (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:34.776099 IP (tos 0x0, ttl 64, id 58634, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x5150 (correct), seq 518, ack 3150, win 278, length 0
13:30:34.778029 IP (tos 0x0, ttl 64, id 58636, offset 0, flags [none], proto TCP (6), length 125)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0x1efc (correct), seq 518:603, ack 3150, win 278, length 85
13:30:34.783882 IP (tos 0x0, ttl 60, id 1143, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x14e4 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:34.785597 IP (tos 0x0, ttl 64, id 58643, offset 0, flags [none], proto TCP (6), length 2731)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [P.], cksum 0x4a07 (incorrect -> 0x4d62), seq 603:3294, ack 3193, win 278, length 2691
13:30:34.791039 IP (tos 0x0, ttl 60, id 1144, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x8e68 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:34.795802 IP (tos 0x0, ttl 64, id 58648, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:34.905826 IP (tos 0x0, ttl 64, id 58661, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:35.009835 IP (tos 0x0, ttl 64, id 58691, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:35.321851 IP (tos 0x0, ttl 64, id 58979, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:35.425823 IP (tos 0x0, ttl 64, id 59022, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:36.201838 IP (tos 0x0, ttl 64, id 59391, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:36.265813 IP (tos 0x0, ttl 64, id 59418, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:37.865836 IP (tos 0x0, ttl 64, id 60948, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460
13:30:37.929852 IP (tos 0x0, ttl 64, id 60974, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:39.706148 IP (tos 0x0, ttl 60, id 51198, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [P.], cksum 0x852b (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:39.706232 IP (tos 0x0, ttl 60, id 51199, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47542: Flags [F.], cksum 0x384b (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:39.706283 IP (tos 0x0, ttl 64, id 62161, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [R], cksum 0x06cd (correct), seq 1859010410, win 0, length 0
13:30:39.706290 IP (tos 0x0, ttl 64, id 62162, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [R], cksum 0x06cd (correct), seq 1859010410, win 0, length 0
13:30:41.257857 IP (tos 0x0, ttl 64, id 63397, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:44.769872 IP (tos 0x0, ttl 64, id 789, offset 0, flags [none], proto TCP (6), length 63)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [FP.], cksum 0x742c (correct), seq 3294:3317, ack 3193, win 278, length 23
13:30:44.775029 IP (tos 0x0, ttl 60, id 1145, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [.], cksum 0x8e4e (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:44.775180 IP (tos 0x0, ttl 64, id 794, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:44.986848 IP (tos 0x0, ttl 64, id 1001, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:45.401872 IP (tos 0x0, ttl 64, id 1320, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:46.249886 IP (tos 0x0, ttl 64, id 1583, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:47.913905 IP (tos 0x0, ttl 64, id 2235, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [.], cksum 0x05f9 (correct), seq 603:2063, ack 3193, win 278, length 1460
13:30:49.773963 IP (tos 0x0, ttl 60, id 1146, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [P.], cksum 0x984e (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:49.774061 IP (tos 0x0, ttl 60, id 1147, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > 192.168.1.153.47546: Flags [F.], cksum 0x8e36 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:49.774559 IP (tos 0x0, ttl 64, id 3630, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [R], cksum 0xf679 (correct), seq 1780241515, win 0, length 0
13:30:49.774575 IP (tos 0x0, ttl 64, id 3631, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.1.153.47546 > 104.16.21.24.443: Flags [R], cksum 0xf679 (correct), seq 1780241515, win 0, length 0
^C
62 packets captured
62 packets received by filter
0 packets dropped by kernel