Strange OpenVPN routing problem

excelsi · April 22, 2022, 3:34pm

Hi,

since a movement i have strange problem that after OpenVPN Connection is established no routing to my private networks behind the VPN works (only if i have look since two times i can remember).
I didn't change any config that worked perfectly before very long time.
Here is a log snippet of the connection:

Fri Apr 22 17:14:24 2022 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Fri Apr 22 17:14:24 2022 OpenVPN 2.5.6 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Mar 16 2022
Fri Apr 22 17:14:24 2022 Windows version 10.0 (Windows 10 or greater) 64bit
Fri Apr 22 17:14:24 2022 library versions: OpenSSL 1.1.1n  15 Mar 2022, LZO 2.10
Fri Apr 22 17:14:24 2022 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Fri Apr 22 17:14:24 2022 Need hold release from management interface, waiting...
Fri Apr 22 17:14:24 2022 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'state on'
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'log all on'
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'echo all on'
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'bytecount 5'
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'hold off'
Fri Apr 22 17:14:25 2022 MANAGEMENT: CMD 'hold release'
Fri Apr 22 17:14:32 2022 MANAGEMENT: CMD 'username "Auth" "kieselmi"'
Fri Apr 22 17:14:32 2022 MANAGEMENT: CMD 'password [...]'
Fri Apr 22 17:14:33 2022 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 22 17:14:33 2022 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 22 17:14:33 2022 MANAGEMENT: >STATE:1650640473,RESOLVE,,,,,,
Fri Apr 22 17:14:33 2022 TCP/UDP: Preserving recently used remote address: [AF_INET6]IPV6-Address:1194
Fri Apr 22 17:14:33 2022 Socket Buffers: R=[65536->65536] S=[64512->64512]
Fri Apr 22 17:14:33 2022 Attempting to establish TCP connection with [AF_INET6]IPV6-Address:1194 [nonblock]
Fri Apr 22 17:14:33 2022 MANAGEMENT: >STATE:1650640473,TCP_CONNECT,,,,,,
Fri Apr 22 17:14:33 2022 TCP connection established with [AF_INET6]IPV6-Address:1194
Fri Apr 22 17:14:33 2022 TCPv6_CLIENT link local: (not bound)
Fri Apr 22 17:14:33 2022 TCPv6_CLIENT link remote: [AF_INET6]IPV6-Address:1194
Fri Apr 22 17:14:33 2022 MANAGEMENT: >STATE:1650640473,WAIT,,,,,,
Fri Apr 22 17:14:33 2022 MANAGEMENT: >STATE:1650640473,AUTH,,,,,,
Fri Apr 22 17:14:33 2022 TLS: Initial packet from [AF_INET6]IPV6-Address:1194, sid=027cc78f 5be3f2ae
Fri Apr 22 17:14:35 2022 VERIFY OK: depth=1, C=DE, ST=MA, O=MKL
Fri Apr 22 17:14:35 2022 VERIFY KU OK
Fri Apr 22 17:14:35 2022 Validating certificate extended key usage
Fri Apr 22 17:14:35 2022 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Apr 22 17:14:35 2022 VERIFY EKU OK
Fri Apr 22 17:14:35 2022 VERIFY OK: depth=0, CN=my-server
Fri Apr 22 17:14:35 2022 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA256
Fri Apr 22 17:14:35 2022 [my-server] Peer Connection Initiated with [AF_INET6]IPV6-Address:1194
Fri Apr 22 17:14:35 2022 PUSH: Received control message: 'PUSH_REPLY,route 192.168.20.0 255.255.255.0,route 192.168.21.0 255.255.255.0,dhcp-option DNS 192.168.20.254,dhcp-option DNS 192.168.21.254,compress lz4-v2,persist-key,persist-tun,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Fri Apr 22 17:14:35 2022 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: timers and/or timeouts modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: compression parms modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: --persist options modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: --ifconfig/up options modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: route options modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: route-related options modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: peer-id set
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: adjusting link_mtu to 1627
Fri Apr 22 17:14:35 2022 OPTIONS IMPORT: data channel crypto options modified
Fri Apr 22 17:14:35 2022 Data Channel: using negotiated cipher 'AES-256-GCM'
Fri Apr 22 17:14:35 2022 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Apr 22 17:14:35 2022 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Apr 22 17:14:35 2022 interactive service msg_channel=452
Fri Apr 22 17:14:35 2022 open_tun
Fri Apr 22 17:14:35 2022 tap-windows6 device [Local Area Connection] opened
Fri Apr 22 17:14:35 2022 TAP-Windows Driver Version 9.24 
Fri Apr 22 17:14:36 2022 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Fri Apr 22 17:14:36 2022 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {D77030E1-D0AB-42FD-903A-2C9BC085B7C5} [DHCP-serv: 10.8.0.0, lease-time: 31536000]
Fri Apr 22 17:14:36 2022 Successful ARP Flush on interface [21] {D77030E1-D0AB-42FD-903A-2C9BC085B7C5}
Fri Apr 22 17:14:36 2022 MANAGEMENT: >STATE:1650640476,ASSIGN_IP,,10.8.0.2,,,,
Fri Apr 22 17:14:36 2022 IPv4 MTU set to 1500 on interface 21 using service
Fri Apr 22 17:14:41 2022 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Fri Apr 22 17:14:41 2022 MANAGEMENT: >STATE:1650640481,ADD_ROUTES,,,,,,
Fri Apr 22 17:14:41 2022 C:\Windows\system32\route.exe ADD 192.168.20.0 MASK 255.255.255.0 10.8.0.1
Fri Apr 22 17:14:41 2022 Route addition via service succeeded
Fri Apr 22 17:14:41 2022 C:\Windows\system32\route.exe ADD 192.168.21.0 MASK 255.255.255.0 10.8.0.1
Fri Apr 22 17:14:41 2022 Route addition via service succeeded
Fri Apr 22 17:14:41 2022 Initialization Sequence Completed
Fri Apr 22 17:14:41 2022 Register_dns request sent to the service
Fri Apr 22 17:14:41 2022 MANAGEMENT: >STATE:1650640481,CONNECTED,SUCCESS,10.8.0.2,IPV6-Address,1194,2003:e4:ef04:3cfc:dd13:f951:68ca:ad14,51016

It configured the routes sucessfully to 192.168.20/21 networks and i tried it also from LTE Scenario instead of a fixed Internet Connection no difference here.. i cannot reach any system in these Networks.

Rebootet all the Systems multiple times checked the FW (which i didn't change at all)..have no more idea what i can do..i think that it's maybe something strange regarding my ISP for whatever reason...

Any help?
Thanks!

mk24 · April 22, 2022, 4:00pm

On the client, try
ping 10.8.0.1
tracert 192.168.20.1 (and other IPs in the remote LAN)

It doesn't look like an ISP problem since the outer (encrypted) link to the server is intact. and "Initialization Sequence Completed" was logged, which generally means the link is OK.

excelsi · April 22, 2022, 4:04pm

Unfortunatley i get absolutley nothing:

PS C:\> ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:

PS C:\> tracert 192.168.20.254

Tracing route to 192.168.20.254 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3
PS C:\> tracert 192.168.21.254

Tracing route to 192.168.21.254 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3

mk24 · April 22, 2022, 4:13pm

OK, ping 10.8.0.2 should work (with a very quick reply time) since that is the tunnel interface on your PC. So try that, if it doesn't work there's a problem with the client.

The log looks like the tunnel is up, so ping 10.8.0.1 really should work. Running tcpdump -i tun0 on the server would show if anything is coming through but being blocked by the server firewall.

excelsi · April 22, 2022, 4:17pm

yeah ping to the client works.
I will check tcpdump if im on the server side again.
Thanks!

excelsi · April 27, 2022, 4:04pm

I have now captured a tcpdump and it seems its getting something but i still don't get the webpage of my Fritzbox:

root@OpenWrt-MKL:~# tcpdump -i ovpns0 -vv
tcpdump: listening on ovpns0, link-type RAW (Raw IP), capture size 262144 bytes
18:00:21.895261 IP (tos 0x0, ttl 64, id 18505, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.57242 > 192.168.20.254.53: [udp sum ok] 62495+ A? self.events.data.microsoft.com. (48)
18:00:21.905306 IP (tos 0x0, ttl 64, id 18548, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.29526 > 192.168.20.254.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:21.905756 IP (tos 0x0, ttl 64, id 18581, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.24604 > 192.168.20.254.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:21.906174 IP (tos 0x0, ttl 64, id 4653, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.39926 > OpenWrt-MKL.lan.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:22.078315 IP (tos 0x0, ttl 64, id 4662, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.56395 > OpenWrt-MKL.lan.53: [udp sum ok] 16834+ A? edge.microsoft.com. (36)
18:00:22.078619 IP (tos 0x0, ttl 64, id 18624, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.57488 > 192.168.20.254.53: [udp sum ok] 31811+ A? c.bingapis.com. (32)
18:00:22.079082 IP (tos 0x0, ttl 64, id 4667, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.11538 > OpenWrt-MKL.lan.53: [udp sum ok] 8564+ A? self.events.data.microsoft.com. (48)
18:00:22.079405 IP (tos 0x0, ttl 64, id 4746, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.8984 > OpenWrt-MKL.lan.53: [udp sum ok] 25268+ A? www.msn.com. (29)
18:00:22.190594 IP (tos 0x0, ttl 64, id 4865, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.12380 > OpenWrt-MKL.lan.53: [udp sum ok] 35504+ A? deff.nelreports.net. (37)
18:00:22.265588 IP (tos 0x0, ttl 64, id 4866, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.63002 > OpenWrt-MKL.lan.53: [udp sum ok] 29911+ A? deff.nelreports.net. (37)
18:00:23.893904 IP (tos 0x0, ttl 64, id 18779, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.30641 > 192.168.20.254.53: [udp sum ok] 10571+ A? edge.microsoft.com. (36)
18:00:23.895988 IP (tos 0x0, ttl 64, id 4941, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.41870 > OpenWrt-MKL.lan.53: [udp sum ok] 22060+ A? self.events.data.microsoft.com. (48)
18:00:23.959182 IP (tos 0x0, ttl 64, id 18904, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.45381 > 192.168.20.254.53: [udp sum ok] 64843+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:25.054924 IP (tos 0x0, ttl 64, id 5128, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.11621 > OpenWrt-MKL.lan.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:25.175889 IP (tos 0x0, ttl 64, id 5157, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.7356 > OpenWrt-MKL.lan.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:25.237995 IP (tos 0x0, ttl 64, id 19202, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.15161 > 192.168.20.254.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:25.472365 IP (tos 0x0, ttl 64, id 5233, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.28364 > OpenWrt-MKL.lan.53: [udp sum ok] 31811+ A? c.bingapis.com. (32)
18:00:25.937283 IP (tos 0x0, ttl 64, id 4866, offset 0, flags [DF], proto UDP (17), length 65, bad cksum 46fa (->47fa)!)
    10.8.0.2.16548 > 192.168.20.254.53: [bad udp cksum 0x1699 -> 0x5b7f!] 64783+[|domain]
18:00:26.160828 IP (tos 0x0, ttl 64, id 19299, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.33584 > 192.168.20.254.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:27.936386 IP truncated-ip - 5 bytes missing! (tos 0x0, ttl 64, id 4941, offset 0, flags [DF], proto UDP (17), length 76, bad cksum 46a4 (->47a4)!)
    10.8.0.2.63603 > 192.168.20.254.53: [udp sum ok] 10704+ A? pcscfhost1.ims.telekom.de. (43)
18:00:27.943094 IP (tos 0x0, ttl 64, id 19308, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.45889 > 192.168.20.254.53: [udp sum ok] 45260+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:28.470711 IP (tos 0x0, ttl 64, id 5567, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.8871 > OpenWrt-MKL.lan.53: [udp sum ok] 10571+ A? edge.microsoft.com. (36)
18:00:28.976689 IP (tos 0x0, ttl 64, id 5624, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.24905 > OpenWrt-MKL.lan.53: [udp sum ok] 64843+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:30.017077 IP truncated-ip - 5 bytes missing! (tos 0x0, ttl 64, id 19202, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.29526 > 192.168.20.254.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:30.162328 IP (tos 0x0, ttl 64, id 19789, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.24604 > 192.168.20.254.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:30.241119 IP (tos 0x0, ttl 64, id 5752, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.39926 > OpenWrt-MKL.lan.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:30.470903 IP (tos 0x0, ttl 64, id 19825, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.24235 > 192.168.20.254.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:30.958326 IP (tos 0x0, ttl 64, id 5925, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.17867 > OpenWrt-MKL.lan.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:31.162379 IP (tos 0x0, ttl 64, id 5938, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.58640 > OpenWrt-MKL.lan.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:33.017471 IP (tos 0x0, ttl 64, id 6201, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.57562 > OpenWrt-MKL.lan.53: [udp sum ok] 31880+ A? www.msn.com. (29)
18:00:34.024098 IP (tos 0x0, ttl 64, id 20233, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.6142 > 192.168.20.254.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:34.104340 IP truncated-ip - 3 bytes missing! (tos 0x0, ttl 64, id 19769, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.35787 > 192.168.20.254.53: [udp sum ok] 4074+ A? www.msn.com. (29)
18:00:34.224341 IP (tos 0x0, ttl 64, id 20257, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.27902 > 192.168.20.254.53: [udp sum ok] 21081+ A? www.google.com. (32)
18:00:34.302043 IP (tos 0x0, ttl 64, id 20260, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.6510 > 192.168.20.254.53: [udp sum ok] 51040+ A? fritz.box. (27)
18:00:35.031068 IP (tos 0x0, ttl 64, id 20408, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.35418 > 192.168.20.254.53: [udp sum ok] 35731+ A? c.bingapis.com. (32)
18:00:35.097264 IP (tos 0x0, ttl 64, id 6238, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.11621 > OpenWrt-MKL.lan.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:35.097582 IP (tos 0x0, ttl 64, id 6241, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.41035 > OpenWrt-MKL.lan.53: [udp sum ok] 28419+ A? www.msn.com. (29)
18:00:35.183966 IP (tos 0x0, ttl 64, id 6246, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.7356 > OpenWrt-MKL.lan.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:35.231114 IP (tos 0x0, ttl 64, id 6250, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.19076 > OpenWrt-MKL.lan.53: [udp sum ok] 21323+ A? www.google.com. (32)
18:00:35.231475 IP (tos 0x0, ttl 64, id 6252, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.40744 > OpenWrt-MKL.lan.53: [udp sum ok] 39081+ A? fritz.box. (27)
18:00:35.469973 IP (tos 0x0, ttl 64, id 6304, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37893 > OpenWrt-MKL.lan.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:35.953206 IP (tos 0x0, ttl 64, id 20573, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.16548 > 192.168.20.254.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:36.057493 IP (tos 0x0, ttl 64, id 6350, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5475 > OpenWrt-MKL.lan.53: [udp sum ok] 5343+ A? c.bingapis.com. (32)
18:00:36.181909 IP truncated-ip - 3 bytes missing! (tos 0x0, ttl 64, id 6238, offset 0, flags [DF], proto UDP (17), length 60, bad cksum 41a3 (->42a3)!)
    10.8.0.2.33584 > 192.168.20.254.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:36.231196 IP (tos 0x0, ttl 64, id 20615, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37095 > 192.168.20.254.53: [udp sum ok] 55166+ A? www.google.com. (32)
18:00:36.231672 IP (tos 0x0, ttl 64, id 20619, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.28943 > 192.168.20.254.53: [udp sum ok] 21545+ A? fritz.box. (27)
18:00:37.038725 IP (tos 0x0, ttl 64, id 20781, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.59321 > 192.168.20.254.53: [udp sum ok] 51415+ A? c.bingapis.com. (32)
18:00:37.136388 IP (tos 0x0, ttl 64, id 20786, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.29695 > 192.168.20.254.53: [udp sum ok] 4253+ A? www.msn.com. (29)
18:00:37.837519 IP (tos 0x0, ttl 64, id 20905, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.33650 > 192.168.20.254.53: [udp sum ok] 27728+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:37.906037 IP (tos 0x0, ttl 64, id 6780, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.43159 > OpenWrt-MKL.lan.53: [udp sum ok] 10822+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:37.906426 IP (tos 0x0, ttl 64, id 20906, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.40830 > 192.168.20.254.53: [udp sum ok] 30481+ A? pcscfhost1.ims.telekom.de. (43)
18:00:37.906874 IP (tos 0x0, ttl 64, id 6781, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.48468 > OpenWrt-MKL.lan.53: [udp sum ok] 14844+ A? pcscfhost1.ims.telekom.de. (43)
18:00:38.231297 IP (tos 0x0, ttl 64, id 6820, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.48636 > OpenWrt-MKL.lan.53: [udp sum ok] 29228+ A? www.google.com. (32)
18:00:38.280765 IP (tos 0x0, ttl 64, id 6821, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.47980 > OpenWrt-MKL.lan.53: [udp sum ok] 28110+ A? fritz.box. (27)
18:00:38.975911 IP (tos 0x0, ttl 64, id 6834, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.7541 > OpenWrt-MKL.lan.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:39.070022 IP (tos 0x0, ttl 64, id 6856, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.22196 > OpenWrt-MKL.lan.53: [udp sum ok] 55606+ A? c.bingapis.com. (32)
18:00:39.148217 IP (tos 0x0, ttl 64, id 21126, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48968 > 192.168.20.254.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:40.265430 IP (tos 0x0, ttl 64, id 21367, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.45592 > 192.168.20.254.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:40.309731 IP (tos 0x0, ttl 64, id 21368, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3205 > 192.168.20.254.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:40.470241 IP truncated-ip - 11 bytes missing! (tos 0x0, ttl 64, id 6781, offset 0, flags [DF], proto UDP (17), length 71, bad cksum 3f79 (->4079)!)
    10.8.0.2.24235 > 192.168.20.254.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:40.960880 IP (tos 0x0, ttl 64, id 7242, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.17867 > OpenWrt-MKL.lan.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:41.079991 IP (tos 0x0, ttl 64, id 21538, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.12492 > 192.168.20.254.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:41.178014 IP (tos 0x0, ttl 64, id 7290, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.58640 > OpenWrt-MKL.lan.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:43.991571 IP (tos 0x0, ttl 64, id 6856, offset 0, flags [DF], proto UDP (17), length 60, bad cksum 3f39 (->4039)!)
    10.8.0.2.6142 > 192.168.20.254.53: [bad udp cksum 0xa4fb -> 0xa53c!] 31245+[|domain]
18:00:44.082034 IP (tos 0x0, ttl 64, id 7879, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.1455 > OpenWrt-MKL.lan.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:45.081197 IP (tos 0x0, ttl 64, id 21700, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.64180 > 192.168.20.254.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:45.256266 IP (tos 0x0, ttl 64, id 7920, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5487 > OpenWrt-MKL.lan.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:45.318829 IP (tos 0x0, ttl 64, id 7922, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.41977 > OpenWrt-MKL.lan.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:45.476523 IP (tos 0x0, ttl 64, id 7946, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37893 > OpenWrt-MKL.lan.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:45.829884 IP (tos 0x0, ttl 64, id 21878, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.55874 > 192.168.20.254.53: [udp sum ok] 8113+ A? self.events.data.microsoft.com. (48)
18:00:46.097284 IP (tos 0x0, ttl 64, id 7957, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.38415 > OpenWrt-MKL.lan.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:46.831253 IP truncated-ip - 2 bytes missing! (tos 0x0, ttl 64, id 21547, offset 0, flags [DF], proto UDP (17), length 78, bad cksum 6c4 (->5c4)!)
    10.8.0.2.21406 > OpenWrt-MKL.lan.53: [udp sum ok] 62887+ A? self.events.data.microsoft.com. (48)
18:00:47.831542 IP (tos 0x0, ttl 64, id 22196, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.49998 > 192.168.20.254.53: [udp sum ok] 30635+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:47.897662 IP (tos 0x0, ttl 64, id 8327, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.38113 > OpenWrt-MKL.lan.53: [udp sum ok] 56908+ A? pcscfhost1.ims.telekom.de. (43)
18:00:47.903621 IP (tos 0x0, ttl 64, id 22197, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.34076 > 192.168.20.254.53: [udp sum ok] 47904+ A? pcscfhost1.ims.telekom.de. (43)
18:00:47.904095 IP (tos 0x0, ttl 64, id 8328, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.60594 > OpenWrt-MKL.lan.53: [udp sum ok] 22745+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:47.905104 IP (tos 0x0, ttl 64, id 22199, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.36026 > 192.168.20.254.53: [udp sum ok] 15188+ A? self.events.data.microsoft.com. (48)
18:00:48.991248 IP (tos 0x0, ttl 64, id 8445, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.7541 > OpenWrt-MKL.lan.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:49.096441 IP (tos 0x0, ttl 64, id 22281, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48968 > 192.168.20.254.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:49.856139 IP (tos 0x0, ttl 64, id 8648, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.11249 > OpenWrt-MKL.lan.53: [udp sum ok] 35523+ A? self.events.data.microsoft.com. (48)
18:00:50.096257 IP (tos 0x0, ttl 64, id 8654, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48681 > OpenWrt-MKL.lan.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:50.270384 IP (tos 0x0, ttl 64, id 22567, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.45592 > 192.168.20.254.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:50.319887 IP (tos 0x0, ttl 64, id 22570, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3205 > 192.168.20.254.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:50.483380 IP truncated-ip - 11 bytes missing! (tos 0x0, ttl 64, id 8328, offset 0, flags [DF], proto UDP (17), length 71, bad cksum 396e (->3a6e)!)
    10.8.0.2.33734 > 192.168.20.254.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:00:51.095995 IP (tos 0x0, ttl 64, id 22744, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.12492 > 192.168.20.254.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:51.897587 IP (tos 0x0, ttl 64, id 22805, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.65209 > 192.168.20.254.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:00:54.097425 IP (tos 0x0, ttl 64, id 8861, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.1455 > OpenWrt-MKL.lan.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:55.098006 IP truncated-ip - 19 bytes missing! (tos 0x0, ttl 64, id 8648, offset 0, flags [DF], proto UDP (17), length 76, bad cksum 3829 (->3929)!)
    10.8.0.2.64180 > 192.168.20.254.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:55.270741 IP (tos 0x0, ttl 64, id 9079, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5487 > OpenWrt-MKL.lan.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:55.323659 IP (tos 0x0, ttl 64, id 9082, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.41977 > OpenWrt-MKL.lan.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:55.495922 IP (tos 0x0, ttl 64, id 9088, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.1216 > OpenWrt-MKL.lan.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:00:56.111488 IP (tos 0x0, ttl 64, id 9097, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.38415 > OpenWrt-MKL.lan.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:56.896652 IP (tos 0x0, ttl 64, id 9169, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.46642 > OpenWrt-MKL.lan.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:00:57.081319 IP (tos 0x0, ttl 64, id 23342, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.43115 > 192.168.20.254.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:00:57.840499 IP (tos 0x0, ttl 64, id 9180, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.53565 > OpenWrt-MKL.lan.53: [udp sum ok] 1429+ A? pcscfhost1.ims.telekom.de. (43)
18:00:57.884288 IP (tos 0x0, ttl 64, id 9182, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.54169 > OpenWrt-MKL.lan.53: [udp sum ok] 30215+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:59.097703 IP (tos 0x0, ttl 64, id 23551, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.63316 > 192.168.20.254.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:00.096095 IP (tos 0x0, ttl 64, id 9646, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48681 > OpenWrt-MKL.lan.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:01:00.175882 IP (tos 0x0, ttl 64, id 23781, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.50681 > 192.168.20.254.53: [udp sum ok] 13285+ A? www.msn.com. (29)
18:01:00.270094 IP (tos 0x0, ttl 64, id 23794, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.46993 > 192.168.20.254.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:00.324612 IP (tos 0x0, ttl 64, id 23795, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.59393 > 192.168.20.254.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:00.325035 IP (tos 0x0, ttl 64, id 23799, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.35024 > 192.168.20.254.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:00.325415 IP (tos 0x0, ttl 64, id 23800, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.46321 > 192.168.20.254.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:00.325793 IP (tos 0x0, ttl 64, id 23806, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.64067 > 192.168.20.254.53: [udp sum ok] 52690+ A? edge.microsoft.com. (36)
18:01:00.496270 IP (tos 0x0, ttl 64, id 23830, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.33734 > 192.168.20.254.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:01:01.194183 IP (tos 0x0, ttl 64, id 9673, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.40757 > OpenWrt-MKL.lan.53: [udp sum ok] 46249+ A? www.msn.com. (29)
18:01:01.336126 IP (tos 0x0, ttl 64, id 9683, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.62214 > OpenWrt-MKL.lan.53: [udp sum ok] 15785+ A? edge.microsoft.com. (36)
18:01:01.917285 IP (tos 0x0, ttl 64, id 23955, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.65209 > 192.168.20.254.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:01:02.097500 IP (tos 0x0, ttl 64, id 9838, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.53804 > OpenWrt-MKL.lan.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:01:02.184081 IP (tos 0x0, ttl 64, id 23961, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.43937 > 192.168.20.254.53: [udp sum ok] 47842+ A? c.bingapis.com. (32)
18:01:02.237947 IP (tos 0x0, ttl 64, id 23962, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.33985 > 192.168.20.254.53: [udp sum ok] 40931+ A? www.msn.com. (29)
18:01:02.335714 IP (tos 0x0, ttl 64, id 23996, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.8588 > 192.168.20.254.53: [udp sum ok] 57431+ A? edge.microsoft.com. (36)
18:01:03.190844 IP (tos 0x0, ttl 64, id 9931, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.26261 > OpenWrt-MKL.lan.53: [udp sum ok] 480+ A? c.bingapis.com. (32)
18:01:03.438486 IP (tos 0x0, ttl 64, id 24021, offset 0, flags [DF], proto UDP (17), length 56)
    10.8.0.2.49561 > 192.168.20.254.53: [udp sum ok] 52283+ A? google.com. (28)
18:01:04.109030 IP (tos 0x0, ttl 64, id 10023, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5285 > OpenWrt-MKL.lan.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:04.200533 IP (tos 0x0, ttl 64, id 24140, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.31903 > 192.168.20.254.53: [udp sum ok] 17379+ A? c.bingapis.com. (32)
18:01:04.256390 IP (tos 0x0, ttl 64, id 10035, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.59180 > OpenWrt-MKL.lan.53: [udp sum ok] 53197+ A? www.msn.com. (29)
18:01:04.359770 IP (tos 0x0, ttl 64, id 10059, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.51357 > OpenWrt-MKL.lan.53: [udp sum ok] 59810+ A? edge.microsoft.com. (36)
18:01:04.433601 IP (tos 0x0, ttl 64, id 10071, offset 0, flags [DF], proto UDP (17), length 56)
    10.8.0.2.27480 > OpenWrt-MKL.lan.53: [udp sum ok] 31985+ A? google.com. (28)
18:01:04.537178 IP (tos 0x0, ttl 64, id 10083, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.60662 > OpenWrt-MKL.lan.53: [udp sum ok] 56618+ A? fritz.box. (27)
18:01:05.280025 IP (tos 0x0, ttl 64, id 10192, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.49802 > OpenWrt-MKL.lan.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:05.337687 IP (tos 0x0, ttl 64, id 10193, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.60754 > OpenWrt-MKL.lan.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:05.338048 IP (tos 0x0, ttl 64, id 10195, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3085 > OpenWrt-MKL.lan.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:05.338349 IP (tos 0x0, ttl 64, id 10196, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.22742 > OpenWrt-MKL.lan.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:05.495956 IP (tos 0x0, ttl 64, id 10243, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.1216 > OpenWrt-MKL.lan.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:01:05.550657 IP (tos 0x0, ttl 64, id 24446, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.65480 > 192.168.20.254.53: [udp sum ok] 25725+ A? fritz.box. (27)
18:01:06.230081 IP (tos 0x0, ttl 64, id 10404, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.25592 > OpenWrt-MKL.lan.53: [udp sum ok] 1576+ A? c.bingapis.com. (32)
18:01:06.280509 IP (tos 0x0, ttl 64, id 24453, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.3730 > 192.168.20.254.53: [udp sum ok] 21446+ A? www.msn.com. (29)
18:01:06.390769 IP (tos 0x0, ttl 64, id 24481, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.5760 > 192.168.20.254.53: [udp sum ok] 7890+ A? edge.microsoft.com. (36)
18:01:06.561034 IP (tos 0x0, ttl 64, id 10471, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.6533 > OpenWrt-MKL.lan.53: [udp sum ok] 64155+ A? fritz.box. (27)
18:01:06.910498 IP (tos 0x0, ttl 64, id 10545, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.46642 > OpenWrt-MKL.lan.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:01:07.095805 IP (tos 0x0, ttl 64, id 24531, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.43115 > 192.168.20.254.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:01:07.880763 IP (tos 0x0, ttl 64, id 24587, offset 0, flags [DF], proto UDP (17), length 77)
    10.8.0.2.63524 > 192.168.20.254.53: [udp sum ok] 40914+ SRV? _sip._tcp.pcscf2.ims.telekom.de. (49)
18:01:08.255905 IP (tos 0x0, ttl 64, id 24602, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.47822 > 192.168.20.254.53: [udp sum ok] 26617+ A? c.bingapis.com. (32)
18:01:08.590432 IP (tos 0x0, ttl 64, id 24650, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.15002 > 192.168.20.254.53: [udp sum ok] 14555+ A? fritz.box. (27)
18:01:09.112637 IP (tos 0x0, ttl 64, id 24737, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.63316 > 192.168.20.254.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:10.280127 IP (tos 0x0, ttl 64, id 24883, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.59393 > 192.168.20.254.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:10.344699 IP (tos 0x0, ttl 64, id 24884, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.46993 > 192.168.20.254.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:10.345061 IP (tos 0x0, ttl 64, id 24887, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.35024 > 192.168.20.254.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:10.345370 IP (tos 0x0, ttl 64, id 24888, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.46321 > 192.168.20.254.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:10.616312 IP (tos 0x0, ttl 64, id 24919, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.65456 > 192.168.20.254.53: [udp sum ok] 63597+ A? fritz.box. (27)
18:01:11.258909 IP (tos 0x0, ttl 64, id 11082, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.41888 > OpenWrt-MKL.lan.53: [udp sum ok] 21446+ A? www.msn.com. (29)
18:01:11.389831 IP (tos 0x0, ttl 64, id 11092, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.62288 > OpenWrt-MKL.lan.53: [udp sum ok] 7890+ A? edge.microsoft.com. (36)
18:01:11.918374 IP (tos 0x0, ttl 64, id 25003, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.44205 > 192.168.20.254.53: [udp sum ok] 7777+ A? self.events.data.microsoft.com. (48)
18:01:11.989633 IP (tos 0x0, ttl 64, id 25004, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.35681 > 192.168.20.254.53: [udp sum ok] 44144+ A? self.events.data.microsoft.com. (48)
18:01:12.110297 IP (tos 0x0, ttl 64, id 11141, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.53804 > OpenWrt-MKL.lan.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:01:13.275172 IP (tos 0x0, ttl 64, id 11252, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.52466 > OpenWrt-MKL.lan.53: [udp sum ok] 26617+ A? c.bingapis.com. (32)
18:01:14.112055 IP (tos 0x0, ttl 64, id 11297, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5285 > OpenWrt-MKL.lan.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:14.265998 IP (tos 0x0, ttl 64, id 25201, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.60626 > 192.168.20.254.53: [udp sum ok] 3104+ A? c.bingapis.com. (32)
18:01:15.295722 IP (tos 0x0, ttl 64, id 11484, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.49802 > OpenWrt-MKL.lan.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:15.353394 IP (tos 0x0, ttl 64, id 11485, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.60754 > OpenWrt-MKL.lan.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:15.353716 IP (tos 0x0, ttl 64, id 11489, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.22742 > OpenWrt-MKL.lan.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:15.353981 IP (tos 0x0, ttl 64, id 11486, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3085 > OpenWrt-MKL.lan.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:15.633446 IP (tos 0x0, ttl 64, id 11522, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.33557 > OpenWrt-MKL.lan.53: [udp sum ok] 63597+ A? fritz.box. (27)
18:01:16.256017 IP (tos 0x0, ttl 64, id 25219, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.3730 > 192.168.20.254.53: [udp sum ok] 21446+ A? www.msn.com. (29)
18:01:16.390340 IP (tos 0x0, ttl 64, id 25223, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.5760 > 192.168.20.254.53: [udp sum ok] 7890+ A? edge.microsoft.com. (36)
18:01:16.909929 IP (tos 0x0, ttl 64, id 11651, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.41083 > OpenWrt-MKL.lan.53: [udp sum ok] 7777+ A? self.events.data.microsoft.com. (48)
18:01:16.960135 IP (tos 0x0, ttl 64, id 11652, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.41295 > OpenWrt-MKL.lan.53: [udp sum ok] 44144+ A? self.events.data.microsoft.com. (48)
18:01:17.110149 IP (tos 0x0, ttl 64, id 25237, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.60138 > 192.168.20.254.53: [udp sum ok] 7632+ A? www.msn.com. (29)
18:01:17.917848 IP (tos 0x0, ttl 64, id 11805, offset 0, flags [DF], proto UDP (17), length 77)
    10.8.0.2.52715 > OpenWrt-MKL.lan.53: [udp sum ok] 2426+ SRV? _sip._tcp.pcscf2.ims.telekom.de. (49)
18:01:17.984184 IP (tos 0x0, ttl 64, id 25435, offset 0, flags [DF], proto UDP (17), length 77)
    10.8.0.2.35901 > 192.168.20.254.53: [udp sum ok] 17473+ SRV? _sip._tcp.pcscf2.ims.telekom.de. (49)
18:01:17.984674 IP (tos 0x0, ttl 64, id 25436, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.45174 > 192.168.20.254.53: [udp sum ok] 64960+ A? self.events.data.microsoft.com. (48)
18:01:18.277767 IP (tos 0x0, ttl 64, id 25512, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.47822 > 192.168.20.254.53: [udp sum ok] 26617+ A? c.bingapis.com. (32)
18:01:18.937221 IP (tos 0x0, ttl 64, id 12014, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.22144 > OpenWrt-MKL.lan.53: [udp sum ok] 36315+ A? self.events.data.microsoft.com. (48)
18:01:19.277936 IP (tos 0x0, ttl 64, id 12084, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.1356 > OpenWrt-MKL.lan.53: [udp sum ok] 3104+ A? c.bingapis.com. (32)
18:01:19.952335 IP (tos 0x0, ttl 64, id 25607, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.17856 > 192.168.20.254.53: [udp sum ok] 48739+ A? self.events.data.microsoft.com. (48)
18:01:20.309914 IP (tos 0x0, ttl 64, id 25619, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.16851 > 192.168.20.254.53: [udp sum ok] 16791+ A? fritz.box. (27)
18:01:20.638193 IP (tos 0x0, ttl 64, id 25634, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.65456 > 192.168.20.254.53: [udp sum ok] 63597+ A? fritz.box. (27)
18:01:21.271258 IP (tos 0x0, ttl 64, id 12102, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.41888 > OpenWrt-MKL.lan.53: [udp sum ok] 21446+ A? www.msn.com. (29)
18:01:21.399833 IP (tos 0x0, ttl 64, id 12113, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.62288 > OpenWrt-MKL.lan.53: [udp sum ok] 7890+ A? edge.microsoft.com. (36)
201 packets captured
202 packets received by filter
1 packet dropped by kernel

excelsi · April 27, 2022, 4:06pm

Also tried the IP same result:

root@OpenWrt-MKL:~# tcpdump -i ovpns0 -vv
tcpdump: listening on ovpns0, link-type RAW (Raw IP), capture size 262144 bytes
18:00:21.895261 IP (tos 0x0, ttl 64, id 18505, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.57242 > 192.168.20.254.53: [udp sum ok] 62495+ A? self.events.data.microsoft.com. (48)
18:00:21.905306 IP (tos 0x0, ttl 64, id 18548, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.29526 > 192.168.20.254.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:21.905756 IP (tos 0x0, ttl 64, id 18581, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.24604 > 192.168.20.254.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:21.906174 IP (tos 0x0, ttl 64, id 4653, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.39926 > OpenWrt-MKL.lan.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:22.078315 IP (tos 0x0, ttl 64, id 4662, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.56395 > OpenWrt-MKL.lan.53: [udp sum ok] 16834+ A? edge.microsoft.com. (36)
18:00:22.078619 IP (tos 0x0, ttl 64, id 18624, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.57488 > 192.168.20.254.53: [udp sum ok] 31811+ A? c.bingapis.com. (32)
18:00:22.079082 IP (tos 0x0, ttl 64, id 4667, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.11538 > OpenWrt-MKL.lan.53: [udp sum ok] 8564+ A? self.events.data.microsoft.com. (48)
18:00:22.079405 IP (tos 0x0, ttl 64, id 4746, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.8984 > OpenWrt-MKL.lan.53: [udp sum ok] 25268+ A? www.msn.com. (29)
18:00:22.190594 IP (tos 0x0, ttl 64, id 4865, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.12380 > OpenWrt-MKL.lan.53: [udp sum ok] 35504+ A? deff.nelreports.net. (37)
18:00:22.265588 IP (tos 0x0, ttl 64, id 4866, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.63002 > OpenWrt-MKL.lan.53: [udp sum ok] 29911+ A? deff.nelreports.net. (37)
18:00:23.893904 IP (tos 0x0, ttl 64, id 18779, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.30641 > 192.168.20.254.53: [udp sum ok] 10571+ A? edge.microsoft.com. (36)
18:00:23.895988 IP (tos 0x0, ttl 64, id 4941, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.41870 > OpenWrt-MKL.lan.53: [udp sum ok] 22060+ A? self.events.data.microsoft.com. (48)
18:00:23.959182 IP (tos 0x0, ttl 64, id 18904, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.45381 > 192.168.20.254.53: [udp sum ok] 64843+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:25.054924 IP (tos 0x0, ttl 64, id 5128, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.11621 > OpenWrt-MKL.lan.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:25.175889 IP (tos 0x0, ttl 64, id 5157, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.7356 > OpenWrt-MKL.lan.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:25.237995 IP (tos 0x0, ttl 64, id 19202, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.15161 > 192.168.20.254.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:25.472365 IP (tos 0x0, ttl 64, id 5233, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.28364 > OpenWrt-MKL.lan.53: [udp sum ok] 31811+ A? c.bingapis.com. (32)
18:00:25.937283 IP (tos 0x0, ttl 64, id 4866, offset 0, flags [DF], proto UDP (17), length 65, bad cksum 46fa (->47fa)!)
    10.8.0.2.16548 > 192.168.20.254.53: [bad udp cksum 0x1699 -> 0x5b7f!] 64783+[|domain]
18:00:26.160828 IP (tos 0x0, ttl 64, id 19299, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.33584 > 192.168.20.254.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:27.936386 IP truncated-ip - 5 bytes missing! (tos 0x0, ttl 64, id 4941, offset 0, flags [DF], proto UDP (17), length 76, bad cksum 46a4 (->47a4)!)
    10.8.0.2.63603 > 192.168.20.254.53: [udp sum ok] 10704+ A? pcscfhost1.ims.telekom.de. (43)
18:00:27.943094 IP (tos 0x0, ttl 64, id 19308, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.45889 > 192.168.20.254.53: [udp sum ok] 45260+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:28.470711 IP (tos 0x0, ttl 64, id 5567, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.8871 > OpenWrt-MKL.lan.53: [udp sum ok] 10571+ A? edge.microsoft.com. (36)
18:00:28.976689 IP (tos 0x0, ttl 64, id 5624, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.24905 > OpenWrt-MKL.lan.53: [udp sum ok] 64843+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:30.017077 IP truncated-ip - 5 bytes missing! (tos 0x0, ttl 64, id 19202, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.29526 > 192.168.20.254.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:30.162328 IP (tos 0x0, ttl 64, id 19789, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.24604 > 192.168.20.254.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:30.241119 IP (tos 0x0, ttl 64, id 5752, offset 0, flags [DF], proto UDP (17), length 65)
    10.8.0.2.39926 > OpenWrt-MKL.lan.53: [udp sum ok] 22931+ A? play.googleapis.com. (37)
18:00:30.470903 IP (tos 0x0, ttl 64, id 19825, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.24235 > 192.168.20.254.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:30.958326 IP (tos 0x0, ttl 64, id 5925, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.17867 > OpenWrt-MKL.lan.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:31.162379 IP (tos 0x0, ttl 64, id 5938, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.58640 > OpenWrt-MKL.lan.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:33.017471 IP (tos 0x0, ttl 64, id 6201, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.57562 > OpenWrt-MKL.lan.53: [udp sum ok] 31880+ A? www.msn.com. (29)
18:00:34.024098 IP (tos 0x0, ttl 64, id 20233, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.6142 > 192.168.20.254.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:34.104340 IP truncated-ip - 3 bytes missing! (tos 0x0, ttl 64, id 19769, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.35787 > 192.168.20.254.53: [udp sum ok] 4074+ A? www.msn.com. (29)
18:00:34.224341 IP (tos 0x0, ttl 64, id 20257, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.27902 > 192.168.20.254.53: [udp sum ok] 21081+ A? www.google.com. (32)
18:00:34.302043 IP (tos 0x0, ttl 64, id 20260, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.6510 > 192.168.20.254.53: [udp sum ok] 51040+ A? fritz.box. (27)
18:00:35.031068 IP (tos 0x0, ttl 64, id 20408, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.35418 > 192.168.20.254.53: [udp sum ok] 35731+ A? c.bingapis.com. (32)
18:00:35.097264 IP (tos 0x0, ttl 64, id 6238, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.11621 > OpenWrt-MKL.lan.53: [udp sum ok] 57405+ A? c.bingapis.com. (32)
18:00:35.097582 IP (tos 0x0, ttl 64, id 6241, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.41035 > OpenWrt-MKL.lan.53: [udp sum ok] 28419+ A? www.msn.com. (29)
18:00:35.183966 IP (tos 0x0, ttl 64, id 6246, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.7356 > OpenWrt-MKL.lan.53: [udp sum ok] 62761+ A? www.msn.com. (29)
18:00:35.231114 IP (tos 0x0, ttl 64, id 6250, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.19076 > OpenWrt-MKL.lan.53: [udp sum ok] 21323+ A? www.google.com. (32)
18:00:35.231475 IP (tos 0x0, ttl 64, id 6252, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.40744 > OpenWrt-MKL.lan.53: [udp sum ok] 39081+ A? fritz.box. (27)
18:00:35.469973 IP (tos 0x0, ttl 64, id 6304, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37893 > OpenWrt-MKL.lan.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:35.953206 IP (tos 0x0, ttl 64, id 20573, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.16548 > 192.168.20.254.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:36.057493 IP (tos 0x0, ttl 64, id 6350, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5475 > OpenWrt-MKL.lan.53: [udp sum ok] 5343+ A? c.bingapis.com. (32)
18:00:36.181909 IP truncated-ip - 3 bytes missing! (tos 0x0, ttl 64, id 6238, offset 0, flags [DF], proto UDP (17), length 60, bad cksum 41a3 (->42a3)!)
    10.8.0.2.33584 > 192.168.20.254.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:36.231196 IP (tos 0x0, ttl 64, id 20615, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37095 > 192.168.20.254.53: [udp sum ok] 55166+ A? www.google.com. (32)
18:00:36.231672 IP (tos 0x0, ttl 64, id 20619, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.28943 > 192.168.20.254.53: [udp sum ok] 21545+ A? fritz.box. (27)
18:00:37.038725 IP (tos 0x0, ttl 64, id 20781, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.59321 > 192.168.20.254.53: [udp sum ok] 51415+ A? c.bingapis.com. (32)
18:00:37.136388 IP (tos 0x0, ttl 64, id 20786, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.29695 > 192.168.20.254.53: [udp sum ok] 4253+ A? www.msn.com. (29)
18:00:37.837519 IP (tos 0x0, ttl 64, id 20905, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.33650 > 192.168.20.254.53: [udp sum ok] 27728+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:37.906037 IP (tos 0x0, ttl 64, id 6780, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.43159 > OpenWrt-MKL.lan.53: [udp sum ok] 10822+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:37.906426 IP (tos 0x0, ttl 64, id 20906, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.40830 > 192.168.20.254.53: [udp sum ok] 30481+ A? pcscfhost1.ims.telekom.de. (43)
18:00:37.906874 IP (tos 0x0, ttl 64, id 6781, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.48468 > OpenWrt-MKL.lan.53: [udp sum ok] 14844+ A? pcscfhost1.ims.telekom.de. (43)
18:00:38.231297 IP (tos 0x0, ttl 64, id 6820, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.48636 > OpenWrt-MKL.lan.53: [udp sum ok] 29228+ A? www.google.com. (32)
18:00:38.280765 IP (tos 0x0, ttl 64, id 6821, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.47980 > OpenWrt-MKL.lan.53: [udp sum ok] 28110+ A? fritz.box. (27)
18:00:38.975911 IP (tos 0x0, ttl 64, id 6834, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.7541 > OpenWrt-MKL.lan.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:39.070022 IP (tos 0x0, ttl 64, id 6856, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.22196 > OpenWrt-MKL.lan.53: [udp sum ok] 55606+ A? c.bingapis.com. (32)
18:00:39.148217 IP (tos 0x0, ttl 64, id 21126, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48968 > 192.168.20.254.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:40.265430 IP (tos 0x0, ttl 64, id 21367, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.45592 > 192.168.20.254.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:40.309731 IP (tos 0x0, ttl 64, id 21368, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3205 > 192.168.20.254.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:40.470241 IP truncated-ip - 11 bytes missing! (tos 0x0, ttl 64, id 6781, offset 0, flags [DF], proto UDP (17), length 71, bad cksum 3f79 (->4079)!)
    10.8.0.2.24235 > 192.168.20.254.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:40.960880 IP (tos 0x0, ttl 64, id 7242, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.17867 > OpenWrt-MKL.lan.53: [udp sum ok] 64783+ A? self.events.data.microsoft.com. (48)
18:00:41.079991 IP (tos 0x0, ttl 64, id 21538, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.12492 > 192.168.20.254.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:41.178014 IP (tos 0x0, ttl 64, id 7290, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.58640 > OpenWrt-MKL.lan.53: [udp sum ok] 26260+ A? www.msn.com. (29)
18:00:43.991571 IP (tos 0x0, ttl 64, id 6856, offset 0, flags [DF], proto UDP (17), length 60, bad cksum 3f39 (->4039)!)
    10.8.0.2.6142 > 192.168.20.254.53: [bad udp cksum 0xa4fb -> 0xa53c!] 31245+[|domain]
18:00:44.082034 IP (tos 0x0, ttl 64, id 7879, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.1455 > OpenWrt-MKL.lan.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:45.081197 IP (tos 0x0, ttl 64, id 21700, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.64180 > 192.168.20.254.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:45.256266 IP (tos 0x0, ttl 64, id 7920, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5487 > OpenWrt-MKL.lan.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:45.318829 IP (tos 0x0, ttl 64, id 7922, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.41977 > OpenWrt-MKL.lan.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:45.476523 IP (tos 0x0, ttl 64, id 7946, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.37893 > OpenWrt-MKL.lan.53: [udp sum ok] 64921+ A? c.bingapis.com. (32)
18:00:45.829884 IP (tos 0x0, ttl 64, id 21878, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.55874 > 192.168.20.254.53: [udp sum ok] 8113+ A? self.events.data.microsoft.com. (48)
18:00:46.097284 IP (tos 0x0, ttl 64, id 7957, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.38415 > OpenWrt-MKL.lan.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:46.831253 IP truncated-ip - 2 bytes missing! (tos 0x0, ttl 64, id 21547, offset 0, flags [DF], proto UDP (17), length 78, bad cksum 6c4 (->5c4)!)
    10.8.0.2.21406 > OpenWrt-MKL.lan.53: [udp sum ok] 62887+ A? self.events.data.microsoft.com. (48)
18:00:47.831542 IP (tos 0x0, ttl 64, id 22196, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.49998 > 192.168.20.254.53: [udp sum ok] 30635+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:47.897662 IP (tos 0x0, ttl 64, id 8327, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.38113 > OpenWrt-MKL.lan.53: [udp sum ok] 56908+ A? pcscfhost1.ims.telekom.de. (43)
18:00:47.903621 IP (tos 0x0, ttl 64, id 22197, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.34076 > 192.168.20.254.53: [udp sum ok] 47904+ A? pcscfhost1.ims.telekom.de. (43)
18:00:47.904095 IP (tos 0x0, ttl 64, id 8328, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.60594 > OpenWrt-MKL.lan.53: [udp sum ok] 22745+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:47.905104 IP (tos 0x0, ttl 64, id 22199, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.36026 > 192.168.20.254.53: [udp sum ok] 15188+ A? self.events.data.microsoft.com. (48)
18:00:48.991248 IP (tos 0x0, ttl 64, id 8445, offset 0, flags [DF], proto UDP (17), length 78)
    10.8.0.2.7541 > OpenWrt-MKL.lan.53: [udp sum ok] 31245+ A? gateway.bingviz.microsoftapp.net. (50)
18:00:49.096441 IP (tos 0x0, ttl 64, id 22281, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48968 > 192.168.20.254.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:49.856139 IP (tos 0x0, ttl 64, id 8648, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.11249 > OpenWrt-MKL.lan.53: [udp sum ok] 35523+ A? self.events.data.microsoft.com. (48)
18:00:50.096257 IP (tos 0x0, ttl 64, id 8654, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48681 > OpenWrt-MKL.lan.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:50.270384 IP (tos 0x0, ttl 64, id 22567, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.45592 > 192.168.20.254.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:50.319887 IP (tos 0x0, ttl 64, id 22570, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3205 > 192.168.20.254.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:50.483380 IP truncated-ip - 11 bytes missing! (tos 0x0, ttl 64, id 8328, offset 0, flags [DF], proto UDP (17), length 71, bad cksum 396e (->3a6e)!)
    10.8.0.2.33734 > 192.168.20.254.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:00:51.095995 IP (tos 0x0, ttl 64, id 22744, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.12492 > 192.168.20.254.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:51.897587 IP (tos 0x0, ttl 64, id 22805, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.65209 > 192.168.20.254.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:00:54.097425 IP (tos 0x0, ttl 64, id 8861, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.1455 > OpenWrt-MKL.lan.53: [udp sum ok] 5035+ A? www.msn.com. (29)
18:00:55.098006 IP truncated-ip - 19 bytes missing! (tos 0x0, ttl 64, id 8648, offset 0, flags [DF], proto UDP (17), length 76, bad cksum 3829 (->3929)!)
    10.8.0.2.64180 > 192.168.20.254.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:00:55.270741 IP (tos 0x0, ttl 64, id 9079, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5487 > OpenWrt-MKL.lan.53: [udp sum ok] 28790+ A? www.google.com. (32)
18:00:55.323659 IP (tos 0x0, ttl 64, id 9082, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.41977 > OpenWrt-MKL.lan.53: [udp sum ok] 14061+ A? fritz.box. (27)
18:00:55.495922 IP (tos 0x0, ttl 64, id 9088, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.1216 > OpenWrt-MKL.lan.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:00:56.111488 IP (tos 0x0, ttl 64, id 9097, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.38415 > OpenWrt-MKL.lan.53: [udp sum ok] 42426+ A? c.bingapis.com. (32)
18:00:56.896652 IP (tos 0x0, ttl 64, id 9169, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.46642 > OpenWrt-MKL.lan.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:00:57.081319 IP (tos 0x0, ttl 64, id 23342, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.43115 > 192.168.20.254.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:00:57.840499 IP (tos 0x0, ttl 64, id 9180, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.53565 > OpenWrt-MKL.lan.53: [udp sum ok] 1429+ A? pcscfhost1.ims.telekom.de. (43)
18:00:57.884288 IP (tos 0x0, ttl 64, id 9182, offset 0, flags [DF], proto UDP (17), length 71)
    10.8.0.2.54169 > OpenWrt-MKL.lan.53: [udp sum ok] 30215+ AAAA? pcscfhost1.ims.telekom.de. (43)
18:00:59.097703 IP (tos 0x0, ttl 64, id 23551, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.63316 > 192.168.20.254.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:00.096095 IP (tos 0x0, ttl 64, id 9646, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.48681 > OpenWrt-MKL.lan.53: [udp sum ok] 8965+ A? www.msn.com. (29)
18:01:00.175882 IP (tos 0x0, ttl 64, id 23781, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.50681 > 192.168.20.254.53: [udp sum ok] 13285+ A? www.msn.com. (29)
18:01:00.270094 IP (tos 0x0, ttl 64, id 23794, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.46993 > 192.168.20.254.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:00.324612 IP (tos 0x0, ttl 64, id 23795, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.59393 > 192.168.20.254.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:00.325035 IP (tos 0x0, ttl 64, id 23799, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.35024 > 192.168.20.254.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:00.325415 IP (tos 0x0, ttl 64, id 23800, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.46321 > 192.168.20.254.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:00.325793 IP (tos 0x0, ttl 64, id 23806, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.64067 > 192.168.20.254.53: [udp sum ok] 52690+ A? edge.microsoft.com. (36)
18:01:00.496270 IP (tos 0x0, ttl 64, id 23830, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.33734 > 192.168.20.254.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:01:01.194183 IP (tos 0x0, ttl 64, id 9673, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.40757 > OpenWrt-MKL.lan.53: [udp sum ok] 46249+ A? www.msn.com. (29)
18:01:01.336126 IP (tos 0x0, ttl 64, id 9683, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.62214 > OpenWrt-MKL.lan.53: [udp sum ok] 15785+ A? edge.microsoft.com. (36)
18:01:01.917285 IP (tos 0x0, ttl 64, id 23955, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.65209 > 192.168.20.254.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:01:02.097500 IP (tos 0x0, ttl 64, id 9838, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.53804 > OpenWrt-MKL.lan.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:01:02.184081 IP (tos 0x0, ttl 64, id 23961, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.43937 > 192.168.20.254.53: [udp sum ok] 47842+ A? c.bingapis.com. (32)
18:01:02.237947 IP (tos 0x0, ttl 64, id 23962, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.33985 > 192.168.20.254.53: [udp sum ok] 40931+ A? www.msn.com. (29)
18:01:02.335714 IP (tos 0x0, ttl 64, id 23996, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.8588 > 192.168.20.254.53: [udp sum ok] 57431+ A? edge.microsoft.com. (36)
18:01:03.190844 IP (tos 0x0, ttl 64, id 9931, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.26261 > OpenWrt-MKL.lan.53: [udp sum ok] 480+ A? c.bingapis.com. (32)
18:01:03.438486 IP (tos 0x0, ttl 64, id 24021, offset 0, flags [DF], proto UDP (17), length 56)
    10.8.0.2.49561 > 192.168.20.254.53: [udp sum ok] 52283+ A? google.com. (28)
18:01:04.109030 IP (tos 0x0, ttl 64, id 10023, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.5285 > OpenWrt-MKL.lan.53: [udp sum ok] 37177+ A? c.bingapis.com. (32)
18:01:04.200533 IP (tos 0x0, ttl 64, id 24140, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.31903 > 192.168.20.254.53: [udp sum ok] 17379+ A? c.bingapis.com. (32)
18:01:04.256390 IP (tos 0x0, ttl 64, id 10035, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.59180 > OpenWrt-MKL.lan.53: [udp sum ok] 53197+ A? www.msn.com. (29)
18:01:04.359770 IP (tos 0x0, ttl 64, id 10059, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.51357 > OpenWrt-MKL.lan.53: [udp sum ok] 59810+ A? edge.microsoft.com. (36)
18:01:04.433601 IP (tos 0x0, ttl 64, id 10071, offset 0, flags [DF], proto UDP (17), length 56)
    10.8.0.2.27480 > OpenWrt-MKL.lan.53: [udp sum ok] 31985+ A? google.com. (28)
18:01:04.537178 IP (tos 0x0, ttl 64, id 10083, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.60662 > OpenWrt-MKL.lan.53: [udp sum ok] 56618+ A? fritz.box. (27)
18:01:05.280025 IP (tos 0x0, ttl 64, id 10192, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.49802 > OpenWrt-MKL.lan.53: [udp sum ok] 15601+ A? www.google.com. (32)
18:01:05.337687 IP (tos 0x0, ttl 64, id 10193, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.60754 > OpenWrt-MKL.lan.53: [udp sum ok] 37138+ A? www.google.com. (32)
18:01:05.338048 IP (tos 0x0, ttl 64, id 10195, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.3085 > OpenWrt-MKL.lan.53: [udp sum ok] 41286+ A? fritz.box. (27)
18:01:05.338349 IP (tos 0x0, ttl 64, id 10196, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.22742 > OpenWrt-MKL.lan.53: [udp sum ok] 13716+ A? fritz.box. (27)
18:01:05.495956 IP (tos 0x0, ttl 64, id 10243, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.1216 > OpenWrt-MKL.lan.53: [udp sum ok] 26114+ A? c.bingapis.com. (32)
18:01:05.550657 IP (tos 0x0, ttl 64, id 24446, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.65480 > 192.168.20.254.53: [udp sum ok] 25725+ A? fritz.box. (27)
18:01:06.230081 IP (tos 0x0, ttl 64, id 10404, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.25592 > OpenWrt-MKL.lan.53: [udp sum ok] 1576+ A? c.bingapis.com. (32)
18:01:06.280509 IP (tos 0x0, ttl 64, id 24453, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.3730 > 192.168.20.254.53: [udp sum ok] 21446+ A? www.msn.com. (29)
18:01:06.390769 IP (tos 0x0, ttl 64, id 24481, offset 0, flags [DF], proto UDP (17), length 64)
    10.8.0.2.5760 > 192.168.20.254.53: [udp sum ok] 7890+ A? edge.microsoft.com. (36)
18:01:06.561034 IP (tos 0x0, ttl 64, id 10471, offset 0, flags [DF], proto UDP (17), length 55)
    10.8.0.2.6533 > OpenWrt-MKL.lan.53: [udp sum ok] 64155+ A? fritz.box. (27)
18:01:06.910498 IP (tos 0x0, ttl 64, id 10545, offset 0, flags [DF], proto UDP (17), length 76)
    10.8.0.2.46642 > OpenWrt-MKL.lan.53: [udp sum ok] 57575+ A? self.events.data.microsoft.com. (48)
18:01:07.095805 IP (tos 0x0, ttl 64, id 24531, offset 0, flags [DF], proto UDP (17), length 57)
    10.8.0.2.43115 > 192.168.20.254.53: [udp sum ok] 24164+ A? www.msn.com. (29)
18:01:07.880763 IP (tos 0x0, ttl 64, id 24587, offset 0, flags [DF], proto UDP (17), length 77)
    10.8.0.2.63524 > 192.168.20.254.53: [udp sum ok] 40914+ SRV? _sip._tcp.pcscf2.ims.telekom.de. (49)
18:01:08.255905 IP (tos 0x0, ttl 64, id 24602, offset 0, flags [DF], proto UDP (17), length 60)
    10.8.0.2.47822 > 192.168.20.254.53: [udp sum ok] 26617+ A? c.bingapis.com. (32)
69 packets captured
69 packets received by filter
0 packets dropped by kernel

excelsi · April 27, 2022, 4:09pm

What's this:
"IP truncated-ip - 5 bytes missing!"
Is there maybe an MTU Size Problem on VPN Tunnel how can i check that maybe?

excelsi · May 1, 2022, 5:51pm

I'm confused here .. now i have this issue also at another Location where everything worked perfectly before and No Changes in between...any Help appreciated!