[SOLVED] Strange Wine + League of Legends + Lede bug

Mushoz · May 6, 2018, 11:34am

Wan interface capture:

tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:30:24.696663 IP (tos 0x0, ttl 63, id 54177, offset 0, flags [none], proto TCP (6), length 60)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [S], cksum 0x6efe (correct), seq 1859009807, win 29200, options [mss 1452,sackOK,TS val 1988623720 ecr 0,nop,wscale 7], length 0
13:30:24.701756 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [S.], cksum 0xeaf8 (correct), seq 1053941785, ack 1859009808, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:24.701996 IP (tos 0x0, ttl 63, id 54182, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x9cf9 (correct), seq 1, ack 1, win 229, length 0
13:30:24.702761 IP (tos 0x0, ttl 63, id 54183, offset 0, flags [none], proto TCP (6), length 557)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0x39bb (correct), seq 1:518, ack 1, win 229, length 517
13:30:24.707783 IP (tos 0x0, ttl 61, id 51191, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x9bbb (correct), seq 1, ack 518, win 30, length 0
13:30:24.714674 IP (tos 0x0, ttl 61, id 51192, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x1637 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:24.714785 IP (tos 0x0, ttl 61, id 18425, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0x2a82 (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:24.715043 IP (tos 0x0, ttl 61, id 18426, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0xf58a (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:24.715104 IP (tos 0x0, ttl 63, id 54191, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x9532 (correct), seq 518, ack 1453, win 251, length 0
13:30:24.715196 IP (tos 0x0, ttl 63, id 54192, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x8f6f (correct), seq 518, ack 2905, win 274, length 0
13:30:24.715505 IP (tos 0x0, ttl 63, id 54193, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], cksum 0x8e63 (correct), seq 518, ack 3150, win 297, length 0
13:30:24.717344 IP (tos 0x0, ttl 63, id 54194, offset 0, flags [none], proto TCP (6), length 125)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0x08ac (correct), seq 518:603, ack 3150, win 297, length 85
13:30:24.722544 IP (tos 0x0, ttl 61, id 51195, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0x9999 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:24.726394 IP (tos 0x0, ttl 63, id 54197, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.726470 IP (tos 0x0, ttl 63, id 54197, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:24.726503 IP (tos 0x0, ttl 63, id 54198, offset 0, flags [none], proto TCP (6), length 1271)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [P.], cksum 0xc28e (correct), seq 2063:3294, ack 3193, win 297, length 1231
13:30:24.731603 IP (tos 0x0, ttl 61, id 51196, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0xec2c (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:24.736890 IP (tos 0x0, ttl 63, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.736949 IP (tos 0x0, ttl 63, id 54204, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:24.945919 IP (tos 0x0, ttl 63, id 54283, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.945974 IP (tos 0x0, ttl 63, id 54283, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:25.361942 IP (tos 0x0, ttl 63, id 54358, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:25.362003 IP (tos 0x0, ttl 63, id 54358, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:26.217975 IP (tos 0x0, ttl 63, id 54491, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:26.218049 IP (tos 0x0, ttl 63, id 54491, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:27.881937 IP (tos 0x0, ttl 63, id 54789, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:27.881995 IP (tos 0x0, ttl 63, id 54789, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:31.209911 IP (tos 0x0, ttl 63, id 56617, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:31.209963 IP (tos 0x0, ttl 63, id 56617, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.689071 IP (tos 0x0, ttl 63, id 58615, offset 0, flags [none], proto TCP (6), length 63)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [FP.], cksum 0xf2a5 (correct), seq 3294:3317, ack 3193, win 297, length 23
13:30:34.693949 IP (tos 0x0, ttl 61, id 51197, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [.], cksum 0xec12 (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:34.694235 IP (tos 0x0, ttl 63, id 58619, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:34.694283 IP (tos 0x0, ttl 63, id 58619, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.760645 IP (tos 0x0, ttl 63, id 58626, offset 0, flags [none], proto TCP (6), length 60)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [S], cksum 0x375c (correct), seq 1780240912, win 29200, options [mss 1452,sackOK,TS val 1988633783 ecr 0,nop,wscale 7], length 0
13:30:34.765573 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [S.], cksum 0x6182 (correct), seq 2916280891, ack 1780240913, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0
13:30:34.765847 IP (tos 0x0, ttl 63, id 58632, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], cksum 0x1383 (correct), seq 1, ack 1, win 229, length 0
13:30:34.766309 IP (tos 0x0, ttl 63, id 58633, offset 0, flags [none], proto TCP (6), length 557)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0x8411 (correct), seq 1:518, ack 1, win 229, length 517
13:30:34.771476 IP (tos 0x0, ttl 61, id 1139, offset 0, flags [DF], proto TCP (6), length 40)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x1245 (correct), seq 1, ack 518, win 30, length 0
13:30:34.775744 IP (tos 0x0, ttl 61, id 1140, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0xf8d2 (correct), seq 1:1453, ack 518, win 30, length 1452
13:30:34.775748 IP (tos 0x0, ttl 61, id 1141, offset 0, flags [DF], proto TCP (6), length 1492)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x5f8e (correct), seq 1453:2905, ack 518, win 30, length 1452
13:30:34.775751 IP (tos 0x0, ttl 61, id 1142, offset 0, flags [DF], proto TCP (6), length 285)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0xb424 (correct), seq 2905:3150, ack 518, win 30, length 245
13:30:34.776192 IP (tos 0x0, ttl 63, id 58634, offset 0, flags [none], proto TCP (6), length 40)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], cksum 0x0500 (correct), seq 518, ack 3150, win 278, length 0
13:30:34.778198 IP (tos 0x0, ttl 63, id 58636, offset 0, flags [none], proto TCP (6), length 125)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0xd2ab (correct), seq 518:603, ack 3150, win 278, length 85
13:30:34.783816 IP (tos 0x0, ttl 61, id 1143, offset 0, flags [DF], proto TCP (6), length 83)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0xc893 (correct), seq 3150:3193, ack 603, win 30, length 43
13:30:34.785804 IP (tos 0x0, ttl 63, id 58643, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:34.785888 IP (tos 0x0, ttl 63, id 58643, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.785921 IP (tos 0x0, ttl 63, id 58644, offset 0, flags [none], proto TCP (6), length 1271)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [P.], cksum 0x4635 (correct), seq 2063:3294, ack 3193, win 278, length 1231
13:30:34.790966 IP (tos 0x0, ttl 61, id 1144, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x4218 (correct), seq 3193, ack 603, win 32, options [nop,nop,sack 1 {2063:3294}], length 0
13:30:34.795922 IP (tos 0x0, ttl 63, id 58648, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:34.795999 IP (tos 0x0, ttl 63, id 58648, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:34.905982 IP (tos 0x0, ttl 63, id 58661, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:34.906069 IP (tos 0x0, ttl 63, id 58661, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.009980 IP (tos 0x0, ttl 63, id 58691, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:35.010054 IP (tos 0x0, ttl 63, id 58691, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.322013 IP (tos 0x0, ttl 63, id 58979, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:35.322100 IP (tos 0x0, ttl 63, id 58979, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:35.425977 IP (tos 0x0, ttl 63, id 59022, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:35.426061 IP (tos 0x0, ttl 63, id 59022, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:36.201939 IP (tos 0x0, ttl 63, id 59391, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:36.201986 IP (tos 0x0, ttl 63, id 59391, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:36.265917 IP (tos 0x0, ttl 63, id 59418, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:36.265977 IP (tos 0x0, ttl 63, id 59418, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:37.865950 IP (tos 0x0, ttl 63, id 60948, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:37.866011 IP (tos 0x0, ttl 63, id 60948, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:37.930009 IP (tos 0x0, ttl 63, id 60974, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:37.930091 IP (tos 0x0, ttl 63, id 60974, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:39.706085 IP (tos 0x0, ttl 61, id 51198, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [P.], cksum 0x38db (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:39.706090 IP (tos 0x0, ttl 61, id 51199, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47542: Flags [F.], cksum 0xebfa (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:39.706353 IP (tos 0x0, ttl 63, id 62161, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [R], cksum 0xba7c (correct), seq 1859010410, win 0, length 0
13:30:39.706432 IP (tos 0x0, ttl 63, id 62162, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [R], cksum 0xba7c (correct), seq 1859010410, win 0, length 0
13:30:41.257994 IP (tos 0x0, ttl 63, id 63397, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:41.258049 IP (tos 0x0, ttl 63, id 63397, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:44.769978 IP (tos 0x0, ttl 63, id 789, offset 0, flags [none], proto TCP (6), length 63)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [FP.], cksum 0x27dc (correct), seq 3294:3317, ack 3193, win 278, length 23
13:30:44.774951 IP (tos 0x0, ttl 61, id 1145, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [.], cksum 0x41fe (correct), seq 3193, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:44.775286 IP (tos 0x0, ttl 63, id 794, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:44.775345 IP (tos 0x0, ttl 63, id 794, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:44.986951 IP (tos 0x0, ttl 63, id 1001, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:44.987011 IP (tos 0x0, ttl 63, id 1001, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:45.402005 IP (tos 0x0, ttl 63, id 1320, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:45.402075 IP (tos 0x0, ttl 63, id 1320, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:46.249976 IP (tos 0x0, ttl 63, id 1583, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:46.250030 IP (tos 0x0, ttl 63, id 1583, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:47.914051 IP (tos 0x0, ttl 63, id 2235, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:30:47.914122 IP (tos 0x0, ttl 63, id 2235, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6
13:30:49.773868 IP (tos 0x0, ttl 61, id 1146, offset 0, flags [DF], proto TCP (6), length 75)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [P.], cksum 0x4bfe (correct), seq 3193:3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 23
13:30:49.773873 IP (tos 0x0, ttl 61, id 1147, offset 0, flags [DF], proto TCP (6), length 52)
    104.16.21.24.443 > xx.xx.xxx.xx.47546: Flags [F.], cksum 0x41e6 (correct), seq 3216, ack 603, win 34, options [nop,nop,sack 1 {2063:3318}], length 0
13:30:49.774696 IP (tos 0x0, ttl 63, id 3630, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [R], cksum 0xaa29 (correct), seq 1780241515, win 0, length 0
13:30:49.774809 IP (tos 0x0, ttl 63, id 3631, offset 0, flags [DF], proto TCP (6), length 40)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [R], cksum 0xaa29 (correct), seq 1780241515, win 0, length 0
13:30:55.003920 IP (tos 0xc0, ttl 61, id 25656, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.003925 IP (tos 0xc0, ttl 61, id 25657, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54283, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.004051 IP (tos 0xc0, ttl 61, id 25658, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54197, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:55.515023 IP (tos 0xc0, ttl 61, id 25672, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54358, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:56.539940 IP (tos 0xc0, ttl 61, id 26137, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54491, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:58.076038 IP (tos 0xc0, ttl 61, id 26459, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54789, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:01.658850 IP (tos 0xc0, ttl 61, id 28487, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 56617, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:04.730913 IP (tos 0xc0, ttl 61, id 31345, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58619, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.243145 IP (tos 0xc0, ttl 61, id 31477, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58661, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.243150 IP (tos 0xc0, ttl 61, id 31478, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58648, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.243153 IP (tos 0xc0, ttl 61, id 31479, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58643, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.243301 IP (tos 0xc0, ttl 61, id 31476, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58691, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:05.754884 IP (tos 0xc0, ttl 61, id 31956, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 58979, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:05.755931 IP (tos 0xc0, ttl 61, id 31957, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 59022, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:06.267892 IP (tos 0xc0, ttl 61, id 32189, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 59391, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:06.778869 IP (tos 0xc0, ttl 61, id 32656, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 59418, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:08.314861 IP (tos 0xc0, ttl 61, id 33509, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 60948, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:31:08.314865 IP (tos 0xc0, ttl 61, id 33508, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 60974, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:11.387014 IP (tos 0xc0, ttl 61, id 36082, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 63397, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:14.970876 IP (tos 0xc0, ttl 61, id 37770, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 794, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:15.483999 IP (tos 0xc0, ttl 61, id 38096, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 1320, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:15.484326 IP (tos 0xc0, ttl 61, id 38097, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 1001, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:16.507783 IP (tos 0xc0, ttl 61, id 38302, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 1583, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
13:31:18.043034 IP (tos 0xc0, ttl 61, id 39101, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 2235, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47546 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 278, length 1452
^C
112 packets captured
113 packets received by filter
0 packets dropped by kernel

Mushoz · May 6, 2018, 11:35am

I am not really sure what to make of the fact that more packets were captured on the WAN interface with identical filters. They ran in parallel for the exact same duration.

fantom-x · May 6, 2018, 12:25pm

A LAN packet arrives: length 1500

13:30:24.736774 IP (tos 0x0, ttl 64, id 54204, offset 0, flags [none], proto TCP (6), length 1500)
    192.168.1.153.47542 > 104.16.21.24.443: Flags [.], cksum 0xe4dc (correct), seq 603:2063, ack 3193, win 297, length 1460

It is properly split and sent out:

13:30:24.736890 IP (tos 0x0, ttl 63, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452
13:30:24.736949 IP (tos 0x0, ttl 63, id 54204, offset 1472, flags [none], proto TCP (6), length 28)
    xx.xx.xxx.xx > 104.16.21.24: ip-proto-6

The game server replies that is does not like it (is it possible that they just do not want to deal with fragmented packets for performance reasons?):

13:30:55.003920 IP (tos 0xc0, ttl 61, id 25656, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.21.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556
	IP (tos 0x0, ttl 60, id 54204, offset 0, flags [+], proto TCP (6), length 1492)
    xx.xx.xxx.xx.47542 > 104.16.21.24.443: Flags [.], seq 603:2055, ack 3193, win 297, length 1452

What I am not seeing is the packet id 25656 on the LAN side forwarded to the originating host. You can add ICMP packets to your capture on LAN to see if these get forwarded to your Linux host (use the id field to trace the path of the packet). In theory, your Linux box should adjust the MTU down for this connection upon receiving this reply (it is called MTU Path Discovery).

BTW, do you have your Linux firewall set to drop ICMP requests? Can you ping that machine from the router?

fantom-x · May 6, 2018, 12:31pm

Or, the MTU probing is simply disabled on Linux by default:

cat /proc/sys/net/ipv4/tcp_mtu_probing
0

Mushoz · May 6, 2018, 12:45pm

The firewall is disabled completely on the Fedora machine.

But in that case it should also not like the packets from the Windows machine, right?

Good catch! This would be on my Fedora machine, correct? I am not at home at the moment, but will definitely check this when I am.

fantom-x · May 6, 2018, 1:09pm

You can check it by doing another LAN/WAN capture and see if Windows even sends packets of 1,500 bytes. If it does not, then it was able to dynamically adjust MTU to the proper size (or its MTU is already at 1,492; you can check that as well by googling the proper commands).
Either way, you got all the tools and info you need to zero in on the source of the problem: your Linux client/machine does not adjust the MTU properly. It now depends on how deep into this hole you want to go to figure out what exactly is happening.

Affirmative, but I never tried it myself. I am also on a PPPoE connection and what I actually do is set the DHCP server on the router to advertise MTU=1,492, even though not every client actually takes that into consideration. Other clients I force to use MTU=1,492. This does lower the LAN throughput a bit, but it does avoid the fragmentation overhead as well as the issues like you have experienced. I also set all LAN interfaces to use MTU=1,492.
Look at it this way as well: MSS Clamping is not free and takes resources (CPU and bandwidth), which are limited.

Mushoz · May 6, 2018, 1:09pm

Got it. Thank you very much for pointing me in the right direction Will dive deeper into this as soon as I am home. Because multiple other people were struggling with this issue, so it would be good to have a general solution available.

I should probably download a master branch firmware and use baby jumbo frames for my WAN interface, and use 1500 MTU everywhere. Probably the cleanest fix for my situation.

Mushoz · May 7, 2018, 7:56am

Okay, so was able to track down the issue, but I am still not sure what is causing it. When I login via my Windows PC I can see the following packets on my LAN bridge:

08:40:57.628062 IP (tos 0xc0, ttl 64, id 59635, offset 0, flags [none], proto ICMP (1), length 576)
    192.168.1.1 > 192.168.1.154: ICMP 104.16.21.24 unreachable - need to frag (mtu 1492), length 556

Which means the router is correctly telling my PC that it needs to use a MTU of 1492. However, no such packets can be seen when my Linux PC tries to login as it endlessly retries with 1500 MTU packets (see previous captures on LAN bridge). Note that I do see ICMP messages regarding MTU for other connections, so path MTU discovery is working fine on my Linux PC. Just for this particular server the router refuses to let the PC know it needs a lower MTU. And I am not sure why.

I can see one packet that triggered said message on the Windows PC:

08:40:57.627787 IP (tos 0x0, ttl 128, id 13958, offset 0, flags [DF], proto TCP (6), length 2731)
    192.168.1.154.49972 > 104.16.21.24.443: Flags [P.], cksum 0x4a08 (incorrect -> 0xa8db), seq 603:3294, ack 3193, win 255, length 2691
08:40:57.628062 IP (tos 0xc0, ttl 64, id 59635, offset 0, flags [none], proto ICMP (1), length 576)
    192.168.1.1 > 192.168.1.154: ICMP 104.16.21.24 unreachable - need to frag (mtu 1492), length 556
	IP (tos 0x0, ttl 128, id 13958, offset 0, flags [DF], proto TCP (6), length 2731)

I see a similar packet going out on the Linux PC, but no such ICMP message is generated by the router:

08:54:48.047494 IP (tos 0x0, ttl 64, id 45537, offset 0, flags [none], proto TCP (6), length 2731)
    192.168.1.153.56746 > 104.16.20.24.443: Flags [P.], cksum 0x4907 (incorrect -> 0x2378), seq 603:3294, ack 3193, win 278, length 2691

Why the different behavior? And more importantly, how to fix this?

Edit: Ahhh, I finally understand! On the Windows PC the large packet has the Don't Fragment flag (DF) set, and hence the router sends out an ICMP package to tell the PC to tone down the MTU, as it cannot be send in its current state. On the Linux PC, however, the large packet does not have this flag, so the router happily fragments it without sending back a ICMP package. And the server somehow doesn't like fragmented packets.

Changing Riot's server to accept fragmented packets isn't really something we can do, of course. But where is the bug located you think? Linux's TCP stack seems fine, since I have seen ICMP packets for path MTU discovery before, and they work just fine. So this is most likely a bug with Wine. I will fine a bug report on Wine's bug tracker.

fantom-x · May 7, 2018, 10:52am

Another venue could be to start another thread here to understand why the router does not forward the original ICMP message to your Linux PC. Notice, that for Windows the router replies with need to fragment, but the game server sends something else and the router drops it.
To me it read as if the small packet got lost/ignored and the reply indicated that the server exceeded some timeout waiting for all packets to arrive. I am not sure if the message is really supposed to be dropped.

Mushoz · May 7, 2018, 11:17am

Because the router doesn't receive any ICMP messages regarding the MTU. Neither for Windows, nor for Linux show any on the WAN interface. The ICMP messages complaining about a too large MTU are simply generated by the router itself, because the MTU isn't sufficient at the WAN interface. But because Linux doesn't set the DF flag, the router simply fragments the package and thus doesn't generate a ICMP packet. And for some reason Riot's servers don't like fragmented packages very much.

We know one thing for sure: Wine isn't correctly showing the same behavior as it does on Windows, since it does not set the DF flag, while the DF flag is set on Windows, so that's definitely a bug IMO. We would expect the same behavior.

The weird thing remaining is these packages on the WAN interface when using Linux:

12:53:22.082733 IP (tos 0xc0, ttl 61, id 51634, offset 0, flags [none], proto ICMP (1), length 576)
    104.16.20.24 > xx.xx.xxx.xx: ICMP ip reassembly time exceeded, length 556

I have no idea why reassembly is failing. Perhaps a misconfiguration on Riot's part? Maybe they don't allow fragmented packages for performance reasons as you mentioned? No idea, and we will probably never know without having access to Riot's servers. That these packets aren't forwarded to the PC is completely normal, because it was the router that did the fragmentation, not the PC.

Mushoz · May 7, 2018, 11:18am

Which message is being dropped on Windows?

fantom-x · May 7, 2018, 11:28am

ICMP ip reassembly time exceeded: the router did not forward it to your Linux PC. Could be a feature or a bug.
UPDATE: right, the router did the fragmentation. Case closed then.

fantom-x · May 8, 2018, 10:32pm

What I am still curious about is that according to the wine bug report, it works fine with other routers (Debian based specifically): what is it that OpenWRT is doing different that this breaks?

Mushoz · May 8, 2018, 10:38pm

Maybe they are using baby jumbo frames by default. That's why my ISP's router does work. Or maybe it announces a 1492 MTU via DHCP. Anyway, a patch was proposed in that bug report and it seems to be fixed now

Mushoz · May 11, 2018, 10:41am

Final follow-up: The patch was just committed to Wine and is now fixed when building from source: https://github.com/wine-mirror/wine/commit/6d6b4bffb3f619ae298669b888775350223e281f