John.K
I'm in a remote area behind NAT routers... I have to have a web server running... a VPN provider using OPEN VPN is trying to help me... it almost works... but I am getting tons of spurious traffic that neither of us understands.
So... just to explain the setup... the VPN Provider has given me a fixed IP... I connect to the VPN... then HTTP requests going to that Fixed IP come down the pipe to me, and the web server sees them... which it does.
But so much other stuff is also coming down that it floods my server. At first we thought it was a DOS attack... I don't think so... I think my server is seeing URL GETS that other VPN clients are putting into their browsers. I think they for some strange reason, come to my web server instead of going to the real destination server.
My server naturally refuses these connections because it doesn't know what to do with them...
Below I have some TCPDUMP data of the TAP0 interface CLIENT (WEB SERVER) SIDE so experts can study this...
And below that I have some of the Apache access log... important to note that none of these GET requests are coming from my domain name... I seem to be getting requests that should go to other servers...
What is interesting is that all these requests are coming from DATATEC ISP and ENZU ISP... and they seem to be from people browsing... which makes me think its from other VPN clients...
If anyone has any idea what is actually happening... much obliged... because everyone seems to be stumped.
The whole system uses OPENVPN... and as I said, without these phantom requests messing up my limited bandwitdth... it actually works great otherwise...
Calling experts... thanks...
------------------------------------------
TCPDUMP....
root@unit1:~# tcpdump -vi tap0
06:09:54.634800 IP (tos 0x0, ttl 120, id 15971, offset 0, flags [DF], proto TCP (6), length 48)
244.78-244-23.rdns.scalabledns.com.3466 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x62cc (correct), seq 1019067113, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:09:54.634820 IP (tos 0x0, ttl 64, id 44172, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 244.78-244-23.rdns.scalabledns.com.3466: Flags [R.], cksum 0x8eef (correct), seq 0, ack 1019067114, win 0, length 0
06:09:54.634831 IP (tos 0x0, ttl 120, id 9008, offset 0, flags [DF], proto TCP (6), length 48)
231.31-202-104.rdns.scalabledns.com.3691 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x1113 (correct), seq 35136670, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:09:54.634842 IP (tos 0x0, ttl 64, id 36467, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 231.31-202-104.rdns.scalabledns.com.3691: Flags [R.], cksum 0x3d36 (correct), seq 0, ack 35136671, win 0, length 0
06:09:54.634850 IP (tos 0x0, ttl 120, id 21012, offset 0, flags [DF], proto TCP (6), length 48)
233.31-202-104.rdns.scalabledns.com.1424 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x1a1a (correct), seq 161225964, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:09:54.634860 IP (tos 0x0, ttl 64, id 51837, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 233.31-202-104.rdns.scalabledns.com.1424: Flags [R.], cksum 0x463d (correct), seq 0, ack 161225965, win 0, length 0
06:09:54.634867 IP (tos 0x0, ttl 120, id 28992, offset 0, flags [DF], proto TCP (6), length 48)
83.9-202-104.rdns.scalabledns.com.1493 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x60f0 (correct), seq 1116451703, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:09:54.634876 IP (tos 0x0, ttl 64, id 17003, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 83.9-202-104.rdns.scalabledns.com.1493: Flags [R.], cksum 0x8d13 (correct), seq 0, ack 1116451704, win 0, length 0
06:09:54.638761 IP (tos 0x0, ttl 255, id 34057, offset 0, flags [DF], proto UDP (17), length 165)
assigned-120-8-44-41.dc3.cz.mdns > 224.0.0.251.mdns: 0*- [0q] 2/0/0 6.5.6.e.6.d.e.f.f.f.f.2.9.c.4.b.4.4.0.0.3.2.1.0.8.2.5.1.1.0.0.2.ip6.arpa. (Cache flush) PTR unit1.local., unit1.local. (Cache flush) AAAA 2001:1528:123:44:b4c9:2fff:fed6:e656 (137)
06:09:54.638818 IP6 (hlim 255, next-header UDP (17) payload length: 145) 2001:1528:123:44:b4c9:2fff:fed6:e656.mdns > ff02::fb.mdns: [udp sum ok] 0*- [0q] 2/0/0 6.5.6.e.6.d.e.f.f.f.f.2.9.c.4.b.4.4.0.0.3.2.1.0.8.2.5.1.1.0.0.2.ip6.arpa. (Cache flush) PTR unit1.local., unit1.local. (Cache flush) AAAA 2001:1528:123:44:b4c9:2fff:fed6:e656 (137)
06:09:54.678530 IP6 (hlim 64, next-header TCP (6) payload length: 40) 2001:1528:123:44:b4c9:2fff:fed6:e656.56770 > 2800:3f0:4002:801::1013.https: Flags [S], cksum 0x84bb (incorrect -> 0xb9c2), seq 1639232691, win 14400, options [mss 1440,sackOK,TS val 21224027 ecr 0,nop,wscale 7], length 0
06:10:00.106842 IP6 (hlim 1, next-header Options (0) payload length: 36) fe80::b4c9:2fff:fed6:e656 > ff02::16: HBH (rtalert: 0x0000) (padn) [icmp6 sum ok] ICMP6, multicast listener report v2, 1 group record(s) [gaddr ff02::fb to_ex, 0 source(s)]
06:10:00.246855 IP (tos 0x0, ttl 113, id 23674, offset 0, flags [DF], proto TCP (6), length 48)
198.204.227.190.2106 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xc850 (correct), seq 2751115220, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:00.246878 IP (tos 0x0, ttl 64, id 13984, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 198.204.227.190.2106: Flags [R.], cksum 0xf473 (correct), seq 0, ack 2751115221, win 0, length 0
06:10:00.246888 IP (tos 0x0, ttl 113, id 18745, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.1766 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xe959 (correct), seq 3945320439, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:00.246910 IP (tos 0x0, ttl 64, id 50047, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.1766: Flags [R.], cksum 0x157d (correct), seq 0, ack 3945320440, win 0, length 0
06:10:00.246918 IP (tos 0x0, ttl 120, id 11043, offset 0, flags [DF], proto TCP (6), length 48)
231.31-202-104.rdns.scalabledns.com.4727 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x11d8 (correct), seq 1644085222, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:00.831391 IP (tos 0x0, ttl 120, id 23268, offset 0, flags [DF], proto TCP (6), length 48)
233.31-202-104.rdns.scalabledns.com.2023 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x515c (correct), seq 643745424, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:00.831418 IP (tos 0x0, ttl 64, id 52582, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 233.31-202-104.rdns.scalabledns.com.2023: Flags [R.], cksum 0x7d7f (correct), seq 0, ack 643745425, win 0, length 0
06:10:01.026929 IP6 (hlim 255, next-header UDP (17) payload length: 54) 2001:1528:123:44:b4c9:2fff:fed6:e656.mdns > ff02::fb.mdns: [udp sum ok] 0 PTR (QM)? 188.227.204.198.in-addr.arpa. (46)
06:10:01.026971 IP (tos 0x0, ttl 255, id 34837, offset 0, flags [DF], proto UDP (17), length 74)
assigned-120-8-44-41.dc3.cz.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 188.227.204.198.in-addr.arpa. (46)
06:10:06.037706 IP (tos 0x0, ttl 113, id 19524, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.1829 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x083b (correct), seq 2243696196, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:06.037732 IP (tos 0x0, ttl 64, id 50614, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.1829: Flags [R.], cksum 0x345e (correct), seq 0, ack 2243696197, win 0, length 0
06:10:06.037744 IP (tos 0x0, ttl 120, id 25583, offset 0, flags [DF], proto TCP (6), length 48)
232.31-202-104.rdns.scalabledns.com.1644 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x1a45 (correct), seq 3590016902, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:06.037755 IP (tos 0x0, ttl 64, id 11645, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 232.31-202-104.rdns.scalabledns.com.1644: Flags [R.], cksum 0x4668 (correct), seq 0, ack 3590016903, win 0, length 0
06:10:11.257920 IP (tos 0x0, ttl 120, id 29558, offset 0, flags [DF], proto TCP (6), length 48)
234.31-202-104.rdns.scalabledns.com.2703 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xb8a6 (correct), seq 2116224216, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:11.545285 IP (tos 0x0, ttl 120, id 27411, offset 0, flags [DF], proto TCP (6), length 48)
233.31-202-104.rdns.scalabledns.com.2958 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x015b (correct), seq 2824573165, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:11.545324 IP (tos 0x0, ttl 64, id 54335, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 233.31-202-104.rdns.scalabledns.com.2958: Flags [R.], cksum 0x2d7e (correct), seq 0, ack 2824573166, win 0, length 0
06:10:11.545335 IP (tos 0x0, ttl 113, id 13095, offset 0, flags [DF], proto TCP (6), length 48)
142.54.189.242.3638 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xd235 (correct), seq 1687698872, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:11.545347 IP (tos 0x0, ttl 64, id 47208, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 142.54.189.242.3638: Flags [R.], cksum 0xfe58 (correct), seq 0, ack 1687698873, win 0, length 0
06:10:11.835203 IP (tos 0x0, ttl 120, id 1041, offset 0, flags [DF], proto TCP (6), length 48)
147.31-202-104.rdns.scalabledns.com.4193 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x346c (correct), seq 477685058, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:11.835248 IP (tos 0x0, ttl 64, id 64158, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 147.31-202-104.rdns.scalabledns.com.4193: Flags [R.], cksum 0x608f (correct), seq 0, ack 477685059, win 0, length 0
06:10:11.835260 IP (tos 0x0, ttl 120, id 23543, offset 0, flags [DF], proto TCP (6), length 48)
121.9-202-104.rdns.scalabledns.com.4273 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x65f7 (correct), seq 1464635053, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:11.835275 IP (tos 0x0, ttl 64, id 40279, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 121.9-202-104.rdns.scalabledns.com.4273: Flags [R.], cksum 0x921a (correct), seq 0, ack 1464635054, win 0, length 0
06:10:11.835284 IP (tos 0x0, ttl 113, id 28061, offset 0, flags [DF], proto TCP (6), length 48)
198.204.227.190.3333 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xdf00 (correct), seq 1090647890, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:12.154319 IP (tos 0x0, ttl 113, id 20403, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.1991 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xf50a (correct), seq 1029271861, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:12.154345 IP (tos 0x0, ttl 64, id 51410, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.1991: Flags [R.], cksum 0x212e (correct), seq 0, ack 1029271862, win 0, length 0
06:10:12.154356 IP (tos 0x0, ttl 113, id 18004, offset 0, flags [DF], proto TCP (6), length 48)
198.204.239.242.2529 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x9a04 (correct), seq 1783957995, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:12.154379 IP (tos 0x0, ttl 64, id 29706, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 198.204.239.242.2529: Flags [R.], cksum 0xc627 (correct), seq 0, ack 1783957996, win 0, length 0
06:10:12.154387 IP (tos 0x0, ttl 113, id 28737, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.252.2507 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xfeee (correct), seq 3637561808, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:12.154397 IP (tos 0x0, ttl 64, id 23585, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.252.2507: Flags [R.], cksum 0x2b12 (correct), seq 0, ack 3637561809, win 0, length 0
06:10:12.442606 IP (tos 0x0, ttl 120, id 14996, offset 0, flags [DF], proto TCP (6), length 48)
243.78-244-23.rdns.scalabledns.com.2980 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x4a0e (correct), seq 338886169, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:12.442631 IP (tos 0x0, ttl 64, id 30690, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 243.78-244-23.rdns.scalabledns.com.2980: Flags [R.], cksum 0x7631 (correct), seq 0, ack 338886170, win 0, length 0
06:10:17.646623 IP (tos 0x0, ttl 113, id 8168, offset 0, flags [DF], proto TCP (6), length 48)
198.204.239.246.2460 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x2e5b (correct), seq 1550222276, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:17.646655 IP (tos 0x0, ttl 64, id 41604, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 198.204.239.246.2460: Flags [R.], cksum 0x5a7e (correct), seq 0, ack 1550222277, win 0, length 0
06:10:22.844886 IP (tos 0x0, ttl 120, id 8330, offset 0, flags [DF], proto TCP (6), length 48)
89.9-202-104.rdns.scalabledns.com.1462 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xe2d4 (correct), seq 3008610531, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:22.844902 IP (tos 0x0, ttl 64, id 4693, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 89.9-202-104.rdns.scalabledns.com.1462: Flags [R.], cksum 0x0ef8 (correct), seq 0, ack 3008610532, win 0, length 0
06:10:22.844912 IP (tos 0x0, ttl 120, id 31844, offset 0, flags [DF], proto TCP (6), length 48)
233.31-202-104.rdns.scalabledns.com.3586 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x5633 (correct), seq 3456046077, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:22.844921 IP (tos 0x0, ttl 64, id 55636, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 233.31-202-104.rdns.scalabledns.com.3586: Flags [R.], cksum 0x8256 (correct), seq 0, ack 3456046078, win 0, length 0
06:10:22.844929 IP (tos 0x0, ttl 113, id 20678, offset 0, flags [DF], proto TCP (6), length 48)
198.204.229.152.1465 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xe20f (correct), seq 2704120201, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:22.844938 IP (tos 0x0, ttl 64, id 51283, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 198.204.229.152.1465: Flags [R.], cksum 0x0e33 (correct), seq 0, ack 2704120202, win 0, length 0
06:10:22.844946 IP (tos 0x0, ttl 113, id 26542, offset 0, flags [DF], proto TCP (6), length 48)
74.91.30.218.3390 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x55d5 (correct), seq 292024629, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:22.844954 IP (tos 0x0, ttl 64, id 30547, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 74.91.30.218.3390: Flags [R.], cksum 0x81f8 (correct), seq 0, ack 292024630, win 0, length 0
06:10:22.844962 IP (tos 0x0, ttl 120, id 26232, offset 0, flags [DF], proto TCP (6), length 48)
244.78-244-23.rdns.scalabledns.com.2001 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x0c13 (correct), seq 906763789, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:23.131760 IP (tos 0x0, ttl 113, id 21889, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.gris > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xa2ac (correct), seq 1583456763, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:23.131798 IP (tos 0x0, ttl 64, id 52708, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.gris: Flags [R.], cksum 0xcecf (correct), seq 0, ack 1583456764, win 0, length 0
06:10:23.131810 IP (tos 0x0, ttl 120, id 12466, offset 0, flags [DF], proto TCP (6), length 48)
122.9-202-104.rdns.scalabledns.com.3715 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xad5c (correct), seq 969565943, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:23.131820 IP (tos 0x0, ttl 64, id 54270, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 122.9-202-104.rdns.scalabledns.com.3715: Flags [R.], cksum 0xd97f (correct), seq 0, ack 969565944, win 0, length 0
06:10:23.131828 IP (tos 0x0, ttl 113, id 30129, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.252.2693 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x6db5 (correct), seq 1806419829, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:28.394225 IP (tos 0x0, ttl 120, id 10786, offset 0, flags [DF], proto TCP (6), length 48)
174.78-244-23.rdns.scalabledns.com.3064 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x60df (correct), seq 2918468983, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:28.394251 IP (tos 0x0, ttl 64, id 54539, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 174.78-244-23.rdns.scalabledns.com.3064: Flags [R.], cksum 0x8d02 (correct), seq 0, ack 2918468984, win 0, length 0
06:10:28.394261 IP (tos 0x0, ttl 113, id 22524, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.2266 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x7253 (correct), seq 3330107829, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:28.394272 IP (tos 0x0, ttl 64, id 53047, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.2266: Flags [R.], cksum 0x9e76 (correct), seq 0, ack 3330107830, win 0, length 0
06:10:28.394280 IP (tos 0x0, ttl 120, id 1994, offset 0, flags [DF], proto TCP (6), length 48)
84.9-202-104.rdns.scalabledns.com.1872 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x62cc (correct), seq 3664648252, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:28.394290 IP (tos 0x0, ttl 64, id 61544, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 84.9-202-104.rdns.scalabledns.com.1872: Flags [R.], cksum 0x8eef (correct), seq 0, ack 3664648253, win 0, length 0
06:10:28.394297 IP (tos 0x0, ttl 120, id 21179, offset 0, flags [DF], proto TCP (6), length 48)
124.9-202-104.rdns.scalabledns.com.4536 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xf340 (correct), seq 1758457558, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:28.394306 IP (tos 0x0, ttl 64, id 2861, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 124.9-202-104.rdns.scalabledns.com.4536: Flags [R.], cksum 0x1f64 (correct), seq 0, ack 1758457559, win 0, length 0
06:10:28.394314 IP (tos 0x0, ttl 120, id 1163, offset 0, flags [DF], proto TCP (6), length 48)
233.31-202-104.rdns.scalabledns.com.4536 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xdd0d (correct), seq 1622800050, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:33.636404 IP (tos 0x0, ttl 120, id 30908, offset 0, flags [DF], proto TCP (6), length 48)
121.9-202-104.rdns.scalabledns.com.1961 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xdd0b (correct), seq 946749311, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:33.636427 IP (tos 0x0, ttl 64, id 42196, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 121.9-202-104.rdns.scalabledns.com.1961: Flags [R.], cksum 0x092f (correct), seq 0, ack 946749312, win 0, length 0
06:10:38.891133 IP (tos 0x0, ttl 113, id 2301, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.246.3200 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x6395 (correct), seq 3572328030, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:38.891160 IP (tos 0x0, ttl 64, id 10747, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.246.3200: Flags [R.], cksum 0x8fb8 (correct), seq 0, ack 3572328031, win 0, length 0
06:10:39.190049 IP (tos 0x0, ttl 113, id 4930, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.245.1218 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x1f30 (correct), seq 3659246932, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:39.190074 IP (tos 0x0, ttl 64, id 46582, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.245.1218: Flags [R.], cksum 0x4b53 (correct), seq 0, ack 3659246933, win 0, length 0
06:10:44.298762 IP (tos 0x0, ttl 113, id 5778, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.245.1414 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x9e5f (correct), seq 1026280017, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:44.298788 IP (tos 0x0, ttl 64, id 47190, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.245.1414: Flags [R.], cksum 0xca82 (correct), seq 0, ack 1026280018, win 0, length 0
06:10:44.298799 IP (tos 0x0, ttl 120, id 26763, offset 0, flags [DF], proto TCP (6), length 48)
243.78-244-23.rdns.scalabledns.com.1962 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x5eee (correct), seq 126745048, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:44.298810 IP (tos 0x0, ttl 64, id 32983, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 243.78-244-23.rdns.scalabledns.com.1962: Flags [R.], cksum 0x8b11 (correct), seq 0, ack 126745049, win 0, length 0
06:10:44.298817 IP (tos 0x0, ttl 113, id 24724, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.2577 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0x5455 (correct), seq 4213068251, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:44.298827 IP (tos 0x0, ttl 64, id 55063, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.2577: Flags [R.], cksum 0x8078 (correct), seq 0, ack 4213068252, win 0, length 0
06:10:49.638268 IP (tos 0x0, ttl 113, id 25511, offset 0, flags [DF], proto TCP (6), length 48)
63.141.227.247.2657 > assigned-120-8-44-41.dc3.cz.http: Flags [S], cksum 0xc4f8 (correct), seq 332646451, win 65535, options [mss 1319,nop,nop,sackOK], length 0
06:10:49.638286 IP (tos 0x0, ttl 64, id 55966, offset 0, flags [DF], proto TCP (6), length 40)
assigned-120-8-44-41.dc3.cz.http > 63.141.227.247.2657: Flags [R.], cksum 0xf11b (correct), seq 0, ack 332646452, win 0, length 0
--------------------------------------
Apache Access Log
63.141.251.72 - - [06/Jan/2016:04:54:55 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad28034a.cgi/v=2.3S/sz=300x250A|300x600A/81657/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6330 "http://www.uclabruins.com/AdMonitor.dbml?ATCLID=209426951&SPSID=749899&SPID=126929&DB_LANG=C&DB_OEM_ID=30500&MONITOR_AD_ID=1324042" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9"
23.244.78.109 - - [06/Jan/2016:04:54:55 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad27559a.cgi/v=2.3S/sz=728x90A/7703/NF/RETURN-CODE/JS/ HTTP/1.0" 200 7519 "http://www.gwsports.com/sports/c-wpolo/spec-rel/gewa-c-wpolo-spec-rel.html" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.23 (KHTML, like Gecko) Chrome/11.0.686.3 Safari/534.23"
198.204.229.149 - - [06/Jan/2016:04:54:56 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad28163a.cgi/v=2.3S/sz=728x90A|970x66A/32271/NF/RETURN-CODE/JS/ HTTP/1.0" 200 7524 "http://shop.gozags.com/COLLEGE_Gonzaga_Bulldogs_Kids_Youth" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_6) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.12 Safari/534.24"
104.202.31.228 - - [06/Jan/2016:04:54:55 -0500] "GET http://adskimomedia.adk2x.com/imp?p=70514425&size=300x250&ap=1300&ct=html&r= HTTP/1.0" 302 596 "http://www.freeonlinemahjonggames.net/novelmahjongg2.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.703.0 Chrome/12.0.703.0 Safari/534.24"
104.202.31.148 - - [06/Jan/2016:04:54:56 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad27559a.cgi/v=2.3S/sz=728x90A/53334/NF/RETURN-CODE/JS/ HTTP/1.0" 200 7502 "http://www.gwsports.com/sports/w-lacros/spec-rel/gewa-w-lacros-spec-rel.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Alexa Toolbar)"
198.204.234.11 - - [06/Jan/2016:04:54:56 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad28034a.cgi/v=2.3S/sz=300x250A|300x600A/74156/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6338 "http://www.uclabruins.com/ViewArticle.dbml?DB_OEM_ID=30500&ATCLID=209512065" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.7.10) Gecko/20050717 Firefox/1.0.6"
104.202.9.89 - - [06/Jan/2016:04:54:56 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad29025a.cgi/v=2.3S/sz=728x90A|970x66A/77678/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6537 "http://www.abdgames.com/the-hysterical-history-of-portable-consoles/" "Mozilla/5.0 (Windows NT 6.0; rv:39.0) Gecko/20100101 Firefox/39.0"
104.202.9.83 - - [06/Jan/2016:04:54:57 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad27559a.cgi/v=2.3S/sz=300x250A|300x600A/57516/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6337 "http://www.gwsports.com/facilities/athletic-fields.html" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.9.168 Version/11.51"
198.204.239.242 - - [06/Jan/2016:04:54:57 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad29025a.cgi/v=2.3S/sz=728x90A|970x66A/19705/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6520 "http://www.abdgames.com/mega-man-10-review-2/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36"
142.54.189.253 - - [06/Jan/2016:04:54:58 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad29346a.cgi/v=2.3S/sz=300x250A|300x600A/2920/NF/RETURN-CODE/JS/ HTTP/1.0" 200 6331 "http://www.richmondspiders.com/AdMonitor.dbml?ATCLID=205242634&SPSID=635084&SPID=91937&DB_LANG=C&DB_OEM_ID=26800&MONITOR_AD_ID=1467749" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36"
23.244.77.236 - - [06/Jan/2016:04:54:58 -0500] "GET http://www.burstnet.com/cgi-bin/ads/ad27559a.cgi/v=2.3S/sz=728x90A/9904/NF/RETURN-CODE/JS/ HTTP/1.0" 200 7519 "http://www.gwsports.com/sports/m-rowing/sched/gewa-m-rowing-sched.html" "Mozilla/4.0 (compatible; MSIE 6.01; Windows 95; Alexa Toolbar)"
and it goes on and on...
