Setting Up AdGuard: DNS Redirect doesn’t work

Rhizome · 1 July 2021 19:16

I installed AdGuard Home on DietPi v7.3, Rpi 4b from the Dietpi repository. I walked through the configuration & Unbound setup. Dietpi Internet connection test works. Successfully logged into my web AdGuard setup & Dashboard from my PC.

However, redirecting to the Rpi’s address doesn’t work through the router. I.e no internet connection. Admittedly my SmartRG modem router has a confusing interface so I may not have clicked the correct options. So, I returned it to its original settings and instead changed my Win 10 pc’s ipv4 DNS to the Rpi’s address. Still no internet connection, however,

This makes me think that the configuration of the Rpi is faulty. Can someone suggest what to try next or which settings to check & how?

Joulinar · 1 July 2021 20:24

Hi,

ok let’s have a look to your system and check all running services

dietpi-services status

as well let’s check open ports

ss -tulpn | grep LISTEN

and finally let’s check DNS resolution for AGH and Unbound. Replace 192.168.x.x with the IP address of your device

dig 192.168.x.x -p 53 google.com
dig 127.0.0.1 -p 5335 google.com

It might be dig command did not exist. If this is the case, simply install it apt install dnsutils

Rhizome · 1 July 2021 23:27

Hi, Joulinar, here’s the output:

DietPi-Services
─────────────────────────────────────────────────────
 Mode: status 

[  OK  ] DietPi-Services | avahi-daemon		active (running) since Thu 2021-07-01 21:03:26 BST; 1min 59s ago
[  OK  ] DietPi-Services | shairport-sync	active (running) since Thu 2021-07-01 21:03:26 BST; 1min 59s ago
[  OK  ] DietPi-Services | cron			active (running) since Thu 2021-07-01 21:03:26 BST; 1min 59s ago
[  OK  ] DietPi-Services | dropbear		active (running) since Thu 2021-07-01 21:03:25 BST; 1min 59s ago
Warning: The unit file, source configuration file or drop-ins of unbound.service changed on disk. Run 'systemctl daemon-reload' to reload units.
[  OK  ] DietPi-Services | unbound		active (running) since Thu 2021-07-01 21:03:20 BST; 2min 5s ago
[  OK  ] DietPi-Services | adguardhome		active (running) since Thu 2021-07-01 21:03:25 BST; 1min 59s ago
[ INFO ] DietPi-Services | dietpi-vpn		inactive (dead)
[  OK  ] DietPi-Services | dietpi-ramlog	active (exited) since Thu 2021-07-01 21:02:22 BST; 3min 3s ago
[  OK  ] DietPi-Services | dietpi-preboot	active (exited) since Thu 2021-07-01 21:02:22 BST; 3min 2s ago
[  OK  ] DietPi-Services | dietpi-boot		active (exited) since Thu 2021-07-01 21:03:25 BST; 1min 59s ago
[  OK  ] DietPi-Services | dietpi-postboot	active (exited) since Thu 2021-07-01 21:03:25 BST; 1min 59s ago
[ INFO ] DietPi-Services | dietpi-wifi-monitor	inactive (dead)

====

tcp     LISTEN   0        1000             0.0.0.0:22             0.0.0.0:*      users:(("dropbear",pid=970,fd=3))                                              
tcp     LISTEN   0        256            127.0.0.1:5335           0.0.0.0:*      users:(("unbound",pid=936,fd=4))                                               
tcp     LISTEN   0        5                0.0.0.0:5000           0.0.0.0:*      users:(("shairport-sync",pid=996,fd=5))                                        
tcp     LISTEN   0        4096                   *:53                   *:*      users:(("AdGuardHome",pid=964,fd=18))                                          
tcp     LISTEN   0        1000                [::]:22                [::]:*      users:(("dropbear",pid=970,fd=4))                                              
tcp     LISTEN   0        5                   [::]:5000              [::]:*      users:(("shairport-sync",pid=996,fd=7))                                        
tcp     LISTEN   0        4096                   *:8083                 *:*      users:(("AdGuardHome",pid=964,fd=16))

====

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> 192.168.1.100 -p 53 google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 21922
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;192.168.1.100.			IN	A

;; AUTHORITY SECTION:
.			730	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2021070103 1800 900 604800 86400

;; Query time: 18 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Fri Jul 02 00:23:43 BST 2021
;; MSG SIZE  rcvd: 117

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58683
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		102	IN	A	172.217.164.206

;; Query time: 18 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Fri Jul 02 00:23:43 BST 2021
;; MSG SIZE  rcvd: 55

====

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> 127.0.0.1 -p 5335 google.com
;; global options: +cmd
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached

Joulinar · 2 July 2021 08:45

hmm the DNS request sent to AGH (192.168.1.100) was answered by a different server (192.168.1.1). I guess this is your router. Correct?

;; SERVER: 192.168.1.1#53(192.168.1.1)

Furthermore there seems to be an issue with Unbound not able to answer your DNS request at all

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> 127.0.0.1 -p 5335 google.com
;; global options: +cmd
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached

Did you use default configuration on Unbound or was there something changed? Can you have a look to the log pls

journalctl -u unbound.service

Did you restart your system after installation?

As a workaround we could deactivate Unbound within AGH settings to see if AGH would be working on it’s own.

Rhizome · 2 July 2021 15:35

Hi Joulinar,

Yes, 192.168.1.1 is my router/modem.
Re: Unbound configuration, I think I just used the default. Log is below.
Re reboot: yes I believe I did after Unbound was installed. Also after Dig was installed. I reran the dig commands (see below Unbound Log.)

How does one deactivate Unbound?

====

-- Logs begin at Thu 2019-02-14 10:11:58 GMT, end at Fri 2021-07-02 16:25:16 BST
. --
Jul 02 16:05:33 DietPi systemd[1]: Starting Unbound DNS server...
Jul 02 16:05:33 DietPi package-helper[631]: /var/lib/unbound/root.key has content
Jul 02 16:05:33 DietPi package-helper[631]: success: the anchor is ok
Jul 02 16:05:34 DietPi unbound[648]: [648:0] info: start of service (unbound 1.9.0).
Jul 02 16:05:34 DietPi systemd[1]: Started Unbound DNS server.

====

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> 192.168.1.100 -p 53 google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2016
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;192.168.1.100.			IN	A

;; AUTHORITY SECTION:
.			512	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2021070200 1800 900 604800 86400

;; Query time: 17 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Fri Jul 02 16:11:39 BST 2021
;; MSG SIZE  rcvd: 117

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22190
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		106	IN	A	172.217.164.206

;; Query time: 17 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Fri Jul 02 16:11:39 BST 2021
;; MSG SIZE  rcvd: 55

====

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> 127.0.0.1 -p 5335 google.com
;; global options: +cmd
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached

Joulinar · 2 July 2021 16:22

ok to remove Unbound from AGH configuration

G_CONFIG_INJECT 'upstream_dns_file:[[:blank:]]' '  upstream_dns_file: ""' /mnt/dietpi_userdata/adguardhome/AdGuardHome.yaml
systemctl restart adguardhome

Now, AGH should use preconfigured global upstream DNS server. You should be ok to change a computer to use AGH as DNS and in AGH have a look to the dashboard if you see DNS queries. If this is working fine, we could have a look to Unbound afterwards.

Rhizome · 2 July 2021 19:57

Thanks Joulinard,
Here’s the output from the Unbound removal:
OK ] G_CONFIG_INJECT | Setting in /mnt/dietpi_userdata/adguardhome/AdGuardHome.yaml adjusted: upstream_dns_file: “”

Next, I disabled DHCP on my router and pointed to the Adguard Rpi fixed address. Didn’t include a secondary DNS server. But I couldn’t get on the internet.

Then Reloaded saved router settings with DHCP enabled. Changed PC ipv4 DNS to point to Adguard on the Rpi. I still have PC internet access but AdGuard Home dashboard shows no activity. Rpi doesn’t show up in the DHCP router list, but it has an internet connection.

Not sure what the issue is. Perhaps the Adguard Home dashboard settings need changing.

Rhizome · 2 July 2021 21:43

I notice in the AdGuardHome.yaml file that under “bind hosts:” it shows 0.0.0.0 rather than 192.168.1.100. (Rpi Adguard.) Is that correct?

Joulinar · 3 July 2021 10:08

let me try to answer some of your points

I disabled DHCP on my router

There is no need to disable DHCP directly on your router.

“bind hosts:” it shows 0.0.0.0 rather than 192.168.1.100

This is perfect setting. 0.0.0.0 are seen as wildcards, means AGH will LISTEN on all interfaces.

Rpi doesn’t show up in the DHCP router list…

Maybe your RPi is using STATIC IP instead of DHCP?

…but it has an internet connection.

The RPi is not using AGH as DNS server. Usually it should connect directly to Quad9 global upstream DNS. This is totally fine.

OK let’s see if we could do some more tracing for your issue

First let’s install tcpdump on your RPi

dietpi-software install 15

Now change DNS server on your Windows network settings. You can leave IP address set to DHCP. I guess you know what I mean, even if it is German language

Now we are ready to trace. Pls run following command on your RPi. It captures whole DNS traffic and will stop after 500 lines or once cancelled

tcpdump -i any -c500 -nn port 853 or port 53 or port 443

on Windows open a cmd and run following

nslookup google.com

Hopefully you will see something captured by tcpdump now. If possible post the output from both, tcpdump as well as nslookup

Rhizome · 3 July 2021 13:13

Here’s the nslookup:

DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.1.100

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

====

Here’s the tcp dump:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:51:19.761934 IP 192.168.1.2.57804 > 192.168.1.100.53: 15523+ A? example.org. (29)
13:51:19.762014 IP 192.168.1.2.55772 > 192.168.1.100.53: 25103+ A? ipv4only.arpa. (31)
13:51:19.762016 IP 192.168.1.2.57967 > 192.168.1.100.53: 37015+ A? detectportal.firefox.com. (42)
13:51:19.929957 IP 192.168.1.2.53539 > 192.168.1.100.53: 24535+ A? wpad.Home. (27)
13:51:19.932211 IP 192.168.1.2.57584 > 192.168.1.100.53: 60039+ A? example.org. (29)
13:51:20.392512 IP 192.168.1.2.50988 > 192.168.1.100.53: 24013+ A? secure10.sync.com. (35)
13:51:20.935197 IP 192.168.1.2.57584 > 192.168.1.100.53: 60039+ A? example.org. (29)
13:51:21.939204 IP 192.168.1.2.53539 > 192.168.1.100.53: 24535+ A? wpad.Home. (27)
13:51:21.939218 IP 192.168.1.2.57584 > 192.168.1.100.53: 60039+ A? example.org. (29)
13:51:22.225144 IP 192.168.1.2.59669 > 192.168.1.100.53: 39228+ A? secure1.sync.com. (34)
13:51:22.403032 IP 192.168.1.2.50988 > 192.168.1.100.53: 24013+ A? secure10.sync.com. (35)
13:51:23.230225 IP 192.168.1.2.59669 > 192.168.1.100.53: 39228+ A? secure1.sync.com. (34)
13:51:23.245520 IP 192.168.1.2.63584 > 192.168.1.100.53: 14417+ A? dns.msftncsi.com. (34)
13:51:23.245908 IP 192.168.1.2.59874 > 192.168.1.100.53: 7969+ A? ipv6.msftconnecttest.com. (42)
13:51:23.776965 IP 192.168.1.2.57967 > 192.168.1.100.53: 37015+ A? detectportal.firefox.com. (42)
13:51:23.777282 IP 192.168.1.2.57804 > 192.168.1.100.53: 15523+ A? example.org. (29)
13:51:23.777296 IP 192.168.1.2.55772 > 192.168.1.100.53: 25103+ A? ipv4only.arpa. (31)
13:51:23.950539 IP 192.168.1.2.57584 > 192.168.1.100.53: 60039+ A? example.org. (29)
13:51:24.235934 IP 192.168.1.2.59669 > 192.168.1.100.53: 39228+ A? secure1.sync.com. (34)
13:51:25.945851 IP 192.168.1.2.55241 > 192.168.1.100.53: 58624+ A? Home.Home. (27)
13:51:26.245498 IP 192.168.1.2.59669 > 192.168.1.100.53: 39228+ A? secure1.sync.com. (34)
13:51:26.408653 IP 192.168.1.2.50988 > 192.168.1.100.53: 24013+ A? secure10.sync.com. (35)
13:51:26.950686 IP 192.168.1.2.55241 > 192.168.1.100.53: 58624+ A? Home.Home. (27)
13:51:27.248401 IP 192.168.1.2.60457 > 192.168.1.100.53: 221+ A? dns.msftncsi.com. (34)
13:51:27.248421 IP 192.168.1.2.53794 > 192.168.1.100.53: Flags [S], seq 522051813, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:27.248428 IP 192.168.1.2.51106 > 192.168.1.100.53: 63114+ AAAA? dns.msftncsi.com. (34)
13:51:27.791376 IP 192.168.1.2.64473 > 192.168.1.100.53: 8268+ A? ipv4only.arpa. (31)
13:51:27.791660 IP 192.168.1.2.49893 > 192.168.1.100.53: 7378+ A? detectportal.firefox.com. (42)
13:51:27.951030 IP 192.168.1.2.57584 > 192.168.1.100.53: 60039+ A? example.org. (29)
13:51:28.248089 IP 192.168.1.2.53794 > 192.168.1.100.53: Flags [S], seq 522051813, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:28.248422 IP 192.168.1.2.51106 > 192.168.1.100.53: 63114+ AAAA? dns.msftncsi.com. (34)
13:51:28.248437 IP 192.168.1.2.60457 > 192.168.1.100.53: 221+ A? dns.msftncsi.com. (34)
13:51:28.805437 IP 192.168.1.2.49893 > 192.168.1.100.53: 7378+ A? detectportal.firefox.com. (42)
13:51:28.805454 IP 192.168.1.2.64473 > 192.168.1.100.53: 8268+ A? ipv4only.arpa. (31)
13:51:28.959071 IP 192.168.1.2.55241 > 192.168.1.100.53: 58624+ A? Home.Home. (27)
13:51:29.258253 IP 192.168.1.2.60457 > 192.168.1.100.53: 221+ A? dns.msftncsi.com. (34)
13:51:29.258606 IP 192.168.1.2.51106 > 192.168.1.100.53: 63114+ AAAA? dns.msftncsi.com. (34)
13:51:29.807837 IP 192.168.1.2.64473 > 192.168.1.100.53: 8268+ A? ipv4only.arpa. (31)
13:51:29.807856 IP 192.168.1.2.49893 > 192.168.1.100.53: 7378+ A? detectportal.firefox.com. (42)
13:51:30.249100 IP 192.168.1.2.53794 > 192.168.1.100.53: Flags [S], seq 522051813, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:30.249429 IP 192.168.1.2.59669 > 192.168.1.100.53: 39228+ A? secure1.sync.com. (34)
13:51:30.462868 IP 192.168.1.2.60346 > 192.168.1.100.53: 5020+ A? secure20.sync.com. (35)
13:51:31.269597 IP 192.168.1.2.51106 > 192.168.1.100.53: 63114+ AAAA? dns.msftncsi.com. (34)
13:51:31.269618 IP 192.168.1.2.60457 > 192.168.1.100.53: 221+ A? dns.msftncsi.com. (34)
13:51:31.475427 IP 192.168.1.2.60346 > 192.168.1.100.53: 5020+ A? secure20.sync.com. (35)
13:51:31.809209 IP 192.168.1.2.49893 > 192.168.1.100.53: 7378+ A? detectportal.firefox.com. (42)
13:51:31.809369 IP 192.168.1.2.64473 > 192.168.1.100.53: 8268+ A? ipv4only.arpa. (31)
13:51:31.965235 IP 192.168.1.2.54779 > 192.168.1.100.53: 21108+ A? example.org. (29)
13:51:32.484173 IP 192.168.1.2.60346 > 192.168.1.100.53: 5020+ A? secure20.sync.com. (35)
13:51:32.967949 IP 192.168.1.2.54779 > 192.168.1.100.53: 21108+ A? example.org. (29)
13:51:32.969007 IP 192.168.1.2.64589 > 192.168.1.100.53: 37328+ A? Home.Home. (27)
13:51:33.984212 IP 192.168.1.2.54779 > 192.168.1.100.53: 21108+ A? example.org. (29)
13:51:33.984230 IP 192.168.1.2.64589 > 192.168.1.100.53: 37328+ A? Home.Home. (27)
13:51:34.254278 IP 192.168.1.2.53794 > 192.168.1.100.53: Flags [S], seq 522051813, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:34.490540 IP 192.168.1.2.60346 > 192.168.1.100.53: 5020+ A? secure20.sync.com. (35)
13:51:35.271120 IP 192.168.1.2.60457 > 192.168.1.100.53: 221+ A? dns.msftncsi.com. (34)
13:51:35.271139 IP 192.168.1.2.51106 > 192.168.1.100.53: 63114+ AAAA? dns.msftncsi.com. (34)
13:51:35.817386 IP 192.168.1.2.64473 > 192.168.1.100.53: 8268+ A? ipv4only.arpa. (31)
13:51:35.817404 IP 192.168.1.2.49893 > 192.168.1.100.53: 7378+ A? detectportal.firefox.com. (42)
13:51:35.985123 IP 192.168.1.2.64589 > 192.168.1.100.53: 37328+ A? Home.Home. (27)
13:51:35.985476 IP 192.168.1.2.54779 > 192.168.1.100.53: 21108+ A? example.org. (29)
13:51:38.501972 IP 192.168.1.2.60346 > 192.168.1.100.53: 5020+ A? secure20.sync.com. (35)
13:51:39.280011 IP 192.168.1.2.61700 > 192.168.1.100.53: 44064+ AAAA? Home. (22)
13:51:39.280310 IP 192.168.1.2.61641 > 192.168.1.100.53: Flags [S], seq 1418498172, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:39.280420 IP 192.168.1.2.53070 > 192.168.1.100.53: 3916+ A? Home. (22)
13:51:39.280958 IP 192.168.1.2.50409 > 192.168.1.100.53: Flags [S], seq 3909286532, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:39.828546 IP 192.168.1.2.49650 > 192.168.1.100.53: 42683+ A? detectportal.firefox.com. (42)
13:51:39.998885 IP 192.168.1.2.54779 > 192.168.1.100.53: 21108+ A? example.org. (29)
13:51:40.280180 IP 192.168.1.2.61700 > 192.168.1.100.53: 44064+ AAAA? Home. (22)
13:51:40.280200 IP 192.168.1.2.53070 > 192.168.1.100.53: 3916+ A? Home. (22)
13:51:40.295141 IP 192.168.1.2.61641 > 192.168.1.100.53: Flags [S], seq 1418498172, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:40.295162 IP 192.168.1.2.50409 > 192.168.1.100.53: Flags [S], seq 3909286532, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:40.841803 IP 192.168.1.2.49650 > 192.168.1.100.53: 42683+ A? detectportal.firefox.com. (42)
13:51:41.289300 IP 192.168.1.2.53070 > 192.168.1.100.53: 3916+ A? Home. (22)
13:51:41.289656 IP 192.168.1.2.61700 > 192.168.1.100.53: 44064+ AAAA? Home. (22)
13:51:41.855219 IP 192.168.1.2.49650 > 192.168.1.100.53: 42683+ A? detectportal.firefox.com. (42)
13:51:42.254489 IP 192.168.1.2.53794 > 192.168.1.100.53: Flags [S], seq 522051813, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:42.301187 IP 192.168.1.2.50409 > 192.168.1.100.53: Flags [S], seq 3909286532, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:42.301205 IP 192.168.1.2.61641 > 192.168.1.100.53: Flags [S], seq 1418498172, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:43.295647 IP 192.168.1.2.61700 > 192.168.1.100.53: 44064+ AAAA? Home. (22)
13:51:43.295669 IP 192.168.1.2.53070 > 192.168.1.100.53: 3916+ A? Home. (22)
13:51:43.659081 IP 192.168.1.5.53735 > 192.168.1.100.53: Flags [S], seq 3792271665, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:43.859247 IP 192.168.1.2.49650 > 192.168.1.100.53: 42683+ A? detectportal.firefox.com. (42)
13:51:44.670590 IP 192.168.1.5.53735 > 192.168.1.100.53: Flags [S], seq 3792271665, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:46.307138 IP 192.168.1.2.50409 > 192.168.1.100.53: Flags [S], seq 3909286532, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:46.307157 IP 192.168.1.2.61641 > 192.168.1.100.53: Flags [S], seq 1418498172, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:46.674109 IP 192.168.1.5.53735 > 192.168.1.100.53: Flags [S], seq 3792271665, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:47.298972 IP 192.168.1.2.53070 > 192.168.1.100.53: 3916+ A? Home. (22)
13:51:47.299153 IP 192.168.1.2.61700 > 192.168.1.100.53: 44064+ AAAA? Home. (22)
13:51:47.861026 IP 192.168.1.2.49650 > 192.168.1.100.53: 42683+ A? detectportal.firefox.com. (42)
13:51:49.733603 IP 192.168.1.2.56369 > 192.168.1.100.53: 55377+ A? secure10.sync.com. (35)
13:51:50.684883 IP 192.168.1.5.53735 > 192.168.1.100.53: Flags [S], seq 3792271665, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:50.746971 IP 192.168.1.2.56369 > 192.168.1.100.53: 55377+ A? secure10.sync.com. (35)
13:51:51.758948 IP 192.168.1.2.56369 > 192.168.1.100.53: 55377+ A? secure10.sync.com. (35)
13:51:53.451026 IP 192.168.1.2.64018 > 192.168.1.100.53: 3143+ A? dns.msftncsi.com. (34)
13:51:53.766093 IP 192.168.1.2.56369 > 192.168.1.100.53: 55377+ A? secure10.sync.com. (35)
13:51:54.314061 IP 192.168.1.2.61641 > 192.168.1.100.53: Flags [S], seq 1418498172, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:54.314070 IP 192.168.1.2.50409 > 192.168.1.100.53: Flags [S], seq 3909286532, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:51:54.455688 IP 192.168.1.2.64018 > 192.168.1.100.53: 3143+ A? dns.msftncsi.com. (34)
13:51:55.465642 IP 192.168.1.2.64018 > 192.168.1.100.53: 3143+ A? dns.msftncsi.com. (34)
13:51:57.472805 IP 192.168.1.2.64018 > 192.168.1.100.53: 3143+ A? dns.msftncsi.com. (34)
13:51:57.772076 IP 192.168.1.2.56369 > 192.168.1.100.53: 55377+ A? secure10.sync.com. (35)
13:51:58.693543 IP 192.168.1.5.53735 > 192.168.1.100.53: Flags [S], seq 3792271665, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:01.484007 IP 192.168.1.2.64018 > 192.168.1.100.53: 3143+ A? dns.msftncsi.com. (34)
13:52:01.814798 IP 192.168.1.2.51245 > 192.168.1.100.53: 50497+ A? secure20.sync.com. (35)
13:52:02.828169 IP 192.168.1.2.51245 > 192.168.1.100.53: 50497+ A? secure20.sync.com. (35)
13:52:03.839873 IP 192.168.1.2.51245 > 192.168.1.100.53: 50497+ A? secure20.sync.com. (35)
13:52:05.487784 IP 192.168.1.2.53434 > 192.168.1.100.53: Flags [S], seq 215937533, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:05.843205 IP 192.168.1.2.51245 > 192.168.1.100.53: 50497+ A? secure20.sync.com. (35)
13:52:06.499312 IP 192.168.1.2.53434 > 192.168.1.100.53: Flags [S], seq 215937533, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:08.512962 IP 192.168.1.2.53434 > 192.168.1.100.53: Flags [S], seq 215937533, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:09.822461 IP 192.168.1.2.63093 > 192.168.1.100.53: 53714+ A? secure10.sync.com. (35)
13:52:09.847785 IP 192.168.1.2.51245 > 192.168.1.100.53: 50497+ A? secure20.sync.com. (35)
13:52:10.834452 IP 192.168.1.2.63093 > 192.168.1.100.53: 53714+ A? secure10.sync.com. (35)
13:52:11.849137 IP 192.168.1.2.63093 > 192.168.1.100.53: 53714+ A? secure10.sync.com. (35)
13:52:12.524915 IP 192.168.1.2.53434 > 192.168.1.100.53: Flags [S], seq 215937533, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:13.851203 IP 192.168.1.2.63093 > 192.168.1.100.53: 53714+ A? secure10.sync.com. (35)
13:52:17.855565 IP 192.168.1.2.63093 > 192.168.1.100.53: 53714+ A? secure10.sync.com. (35)
13:52:18.666595 IP 192.168.1.2.52668 > 192.168.1.100.53: 19841+ A? checkappexec.microsoft.com. (44)
13:52:19.678167 IP 192.168.1.2.52668 > 192.168.1.100.53: 19841+ A? checkappexec.microsoft.com. (44)
13:52:20.527160 IP 192.168.1.2.53434 > 192.168.1.100.53: Flags [S], seq 215937533, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:20.683460 IP 192.168.1.2.52668 > 192.168.1.100.53: 19841+ A? checkappexec.microsoft.com. (44)
13:52:22.685584 IP 192.168.1.2.52668 > 192.168.1.100.53: 19841+ A? checkappexec.microsoft.com. (44)
13:52:23.170239 IP 192.168.1.2.51322 > 192.168.1.100.53: 29836+ A? wpad.Home. (27)
13:52:23.395417 IP 192.168.1.2.65359 > 192.168.1.100.53: 48156+ A? dns.msftncsi.com. (34)
13:52:23.414381 IP 192.168.1.2.51799 > 192.168.1.100.53: 7115+ A? ipv6.msftconnecttest.com. (42)
13:52:24.172337 IP 192.168.1.2.51322 > 192.168.1.100.53: 29836+ A? wpad.Home. (27)
13:52:24.201300 IP 192.168.1.2.50189 > 192.168.1.100.53: 23888+ A? example.org. (29)
13:52:24.201657 IP 192.168.1.2.62927 > 192.168.1.100.53: 7465+ A? ipv4only.arpa. (31)
13:52:24.201671 IP 192.168.1.2.57875 > 192.168.1.100.53: 15395+ A? detectportal.firefox.com. (42)
13:52:24.406385 IP 192.168.1.2.65359 > 192.168.1.100.53: 48156+ A? dns.msftncsi.com. (34)
13:52:24.421388 IP 192.168.1.2.51799 > 192.168.1.100.53: 7115+ A? ipv6.msftconnecttest.com. (42)
13:52:25.209955 IP 192.168.1.2.57875 > 192.168.1.100.53: 15395+ A? detectportal.firefox.com. (42)
13:52:25.209965 IP 192.168.1.2.50189 > 192.168.1.100.53: 23888+ A? example.org. (29)
13:52:25.209968 IP 192.168.1.2.62927 > 192.168.1.100.53: 7465+ A? ipv4only.arpa. (31)
13:52:25.411252 IP 192.168.1.2.65359 > 192.168.1.100.53: 48156+ A? dns.msftncsi.com. (34)
13:52:25.426728 IP 192.168.1.2.51799 > 192.168.1.100.53: 7115+ A? ipv6.msftconnecttest.com. (42)
13:52:26.174524 IP 192.168.1.2.51322 > 192.168.1.100.53: 29836+ A? wpad.Home. (27)
13:52:26.219439 IP 192.168.1.2.62927 > 192.168.1.100.53: 7465+ A? ipv4only.arpa. (31)
13:52:26.219458 IP 192.168.1.2.57875 > 192.168.1.100.53: 15395+ A? detectportal.firefox.com. (42)
13:52:26.219464 IP 192.168.1.2.50189 > 192.168.1.100.53: 23888+ A? example.org. (29)
13:52:27.419455 IP 192.168.1.2.65359 > 192.168.1.100.53: 48156+ A? dns.msftncsi.com. (34)
13:52:27.434851 IP 192.168.1.2.51799 > 192.168.1.100.53: 7115+ A? ipv6.msftconnecttest.com. (42)
13:52:28.220367 IP 192.168.1.2.50189 > 192.168.1.100.53: 23888+ A? example.org. (29)
13:52:28.220387 IP 192.168.1.2.62927 > 192.168.1.100.53: 7465+ A? ipv4only.arpa. (31)
13:52:28.220542 IP 192.168.1.2.57875 > 192.168.1.100.53: 15395+ A? detectportal.firefox.com. (42)
13:52:28.687501 IP 192.168.1.2.63179 > 192.168.1.100.53: 15784+ A? licensing.mp.microsoft.com. (44)
13:52:29.017003 IP 192.168.1.2.63451 > 192.168.1.100.53: 31721+ A? wpad.Home. (27)
13:52:29.694386 IP 192.168.1.2.63179 > 192.168.1.100.53: 15784+ A? licensing.mp.microsoft.com. (44)
13:52:30.019237 IP 192.168.1.2.63451 > 192.168.1.100.53: 31721+ A? wpad.Home. (27)
13:52:30.175864 IP 192.168.1.2.54571 > 192.168.1.100.53: 27035+ A? Home.Home. (27)
13:52:30.699312 IP 192.168.1.2.63179 > 192.168.1.100.53: 15784+ A? licensing.mp.microsoft.com. (44)
13:52:30.909077 IP 192.168.1.2.64771 > 192.168.1.100.53: 46927+ A? secure10.sync.com. (35)
13:52:31.182026 IP 192.168.1.2.54571 > 192.168.1.100.53: 27035+ A? Home.Home. (27)
13:52:31.431222 IP 192.168.1.2.65359 > 192.168.1.100.53: 48156+ A? dns.msftncsi.com. (34)
13:52:31.446666 IP 192.168.1.2.51799 > 192.168.1.100.53: 7115+ A? ipv6.msftconnecttest.com. (42)
13:52:31.915974 IP 192.168.1.2.64771 > 192.168.1.100.53: 46927+ A? secure10.sync.com. (35)
13:52:32.023497 IP 192.168.1.2.63451 > 192.168.1.100.53: 31721+ A? wpad.Home. (27)
13:52:32.226477 IP 192.168.1.2.50189 > 192.168.1.100.53: 23888+ A? example.org. (29)
13:52:32.226496 IP 192.168.1.2.62927 > 192.168.1.100.53: 7465+ A? ipv4only.arpa. (31)
13:52:32.226502 IP 192.168.1.2.57875 > 192.168.1.100.53: 15395+ A? detectportal.firefox.com. (42)
13:52:32.718200 IP 192.168.1.2.63179 > 192.168.1.100.53: 15784+ A? licensing.mp.microsoft.com. (44)
13:52:32.916413 IP 192.168.1.2.64771 > 192.168.1.100.53: 46927+ A? secure10.sync.com. (35)
13:52:33.196579 IP 192.168.1.2.54571 > 192.168.1.100.53: 27035+ A? Home.Home. (27)
13:52:34.922449 IP 192.168.1.2.64771 > 192.168.1.100.53: 46927+ A? secure10.sync.com. (35)
13:52:35.446141 IP 192.168.1.2.62004 > 192.168.1.100.53: 52300+ A? Home. (22)
13:52:35.446494 IP 192.168.1.2.58697 > 192.168.1.100.53: Flags [S], seq 2903736834, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:35.446731 IP 192.168.1.2.56765 > 192.168.1.100.53: 21125+ A? dns.msftncsi.com. (34)
13:52:35.462559 IP 192.168.1.2.53904 > 192.168.1.100.53: 18182+ AAAA? dns.msftncsi.com. (34)
13:52:36.232268 IP 192.168.1.2.60587 > 192.168.1.100.53: 40136+ A? example.org. (29)
13:52:36.233247 IP 192.168.1.2.61477 > 192.168.1.100.53: 35550+ A? ipv4only.arpa. (31)
13:52:36.233263 IP 192.168.1.2.57953 > 192.168.1.100.53: 63826+ A? detectportal.firefox.com. (42)
13:52:36.446744 IP 192.168.1.2.58697 > 192.168.1.100.53: Flags [S], seq 2903736834, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:36.446921 IP 192.168.1.2.56765 > 192.168.1.100.53: 21125+ A? dns.msftncsi.com. (34)
13:52:36.446929 IP 192.168.1.2.62004 > 192.168.1.100.53: 52300+ A? Home. (22)
13:52:36.476955 IP 192.168.1.2.53904 > 192.168.1.100.53: 18182+ AAAA? dns.msftncsi.com. (34)
13:52:36.729194 IP 192.168.1.2.63179 > 192.168.1.100.53: 15784+ A? licensing.mp.microsoft.com. (44)
13:52:37.197897 IP 192.168.1.2.55663 > 192.168.1.100.53: 57560+ A? Home.Home. (27)
13:52:37.243615 IP 192.168.1.2.57953 > 192.168.1.100.53: 63826+ A? detectportal.firefox.com. (42)
13:52:37.243776 IP 192.168.1.2.60587 > 192.168.1.100.53: 40136+ A? example.org. (29)
13:52:37.243783 IP 192.168.1.2.61477 > 192.168.1.100.53: 35550+ A? ipv4only.arpa. (31)
13:52:37.459966 IP 192.168.1.2.62004 > 192.168.1.100.53: 52300+ A? Home. (22)
13:52:37.460134 IP 192.168.1.2.56765 > 192.168.1.100.53: 21125+ A? dns.msftncsi.com. (34)
13:52:37.492472 IP 192.168.1.2.53904 > 192.168.1.100.53: 18182+ AAAA? dns.msftncsi.com. (34)
13:52:38.209543 IP 192.168.1.2.55663 > 192.168.1.100.53: 57560+ A? Home.Home. (27)
13:52:38.255696 IP 192.168.1.2.57953 > 192.168.1.100.53: 63826+ A? detectportal.firefox.com. (42)
13:52:38.255852 IP 192.168.1.2.60587 > 192.168.1.100.53: 40136+ A? example.org. (29)
13:52:38.255859 IP 192.168.1.2.61477 > 192.168.1.100.53: 35550+ A? ipv4only.arpa. (31)
13:52:38.457896 IP 192.168.1.2.58697 > 192.168.1.100.53: Flags [S], seq 2903736834, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:38.934690 IP 192.168.1.2.64771 > 192.168.1.100.53: 46927+ A? secure10.sync.com. (35)
13:52:39.468619 IP 192.168.1.2.56765 > 192.168.1.100.53: 21125+ A? dns.msftncsi.com. (34)
13:52:39.468778 IP 192.168.1.2.62004 > 192.168.1.100.53: 52300+ A? Home. (22)
13:52:39.499254 IP 192.168.1.2.53904 > 192.168.1.100.53: 18182+ AAAA? dns.msftncsi.com. (34)
13:52:40.213848 IP 192.168.1.2.55663 > 192.168.1.100.53: 57560+ A? Home.Home. (27)
13:52:40.259984 IP 192.168.1.2.57953 > 192.168.1.100.53: 63826+ A? detectportal.firefox.com. (42)
13:52:40.260158 IP 192.168.1.2.60587 > 192.168.1.100.53: 40136+ A? example.org. (29)
13:52:40.260164 IP 192.168.1.2.61477 > 192.168.1.100.53: 35550+ A? ipv4only.arpa. (31)
13:52:42.472424 IP 192.168.1.2.58697 > 192.168.1.100.53: Flags [S], seq 2903736834, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:43.481324 IP 192.168.1.2.62004 > 192.168.1.100.53: 52300+ A? Home. (22)
13:52:43.481342 IP 192.168.1.2.56765 > 192.168.1.100.53: 21125+ A? dns.msftncsi.com. (34)
13:52:43.512494 IP 192.168.1.2.53904 > 192.168.1.100.53: 18182+ AAAA? dns.msftncsi.com. (34)
13:52:44.265346 IP 192.168.1.2.57953 > 192.168.1.100.53: 63826+ A? detectportal.firefox.com. (42)
13:52:44.265365 IP 192.168.1.2.61477 > 192.168.1.100.53: 35550+ A? ipv4only.arpa. (31)
13:52:44.265764 IP 192.168.1.2.60587 > 192.168.1.100.53: 40136+ A? example.org. (29)
13:52:47.486279 IP 192.168.1.2.58418 > 192.168.1.100.53: Flags [S], seq 896120150, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:47.516719 IP 192.168.1.2.57883 > 192.168.1.100.53: 35003+ AAAA? Home. (22)
13:52:47.516927 IP 192.168.1.2.63864 > 192.168.1.100.53: Flags [S], seq 3365043248, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:48.275270 IP 192.168.1.2.65436 > 192.168.1.100.53: 62312+ A? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:48.295370 IP 192.168.1.2.60068 > 192.168.1.100.53: 47699+ AAAA? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:48.488722 IP 192.168.1.2.58418 > 192.168.1.100.53: Flags [S], seq 896120150, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:48.519659 IP 192.168.1.2.63864 > 192.168.1.100.53: Flags [S], seq 3365043248, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:48.519677 IP 192.168.1.2.57883 > 192.168.1.100.53: 35003+ AAAA? Home. (22)
13:52:49.283583 IP 192.168.1.2.65436 > 192.168.1.100.53: 62312+ A? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:49.299243 IP 192.168.1.2.60068 > 192.168.1.100.53: 47699+ AAAA? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:49.531867 IP 192.168.1.2.57883 > 192.168.1.100.53: 35003+ AAAA? Home. (22)
13:52:49.815887 IP 192.168.1.2.55735 > 192.168.1.100.53: 1+ PTR? 100.1.168.192.in-addr.arpa. (44)
13:52:50.286458 IP 192.168.1.2.65436 > 192.168.1.100.53: 62312+ A? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:50.301551 IP 192.168.1.2.60068 > 192.168.1.100.53: 47699+ AAAA? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:50.478806 IP 192.168.1.2.58697 > 192.168.1.100.53: Flags [S], seq 2903736834, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:50.493994 IP 192.168.1.2.58418 > 192.168.1.100.53: Flags [S], seq 896120150, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:50.524623 IP 192.168.1.2.63864 > 192.168.1.100.53: Flags [S], seq 3365043248, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:51.535125 IP 192.168.1.2.57883 > 192.168.1.100.53: 35003+ AAAA? Home. (22)
13:52:51.825520 IP 192.168.1.2.58911 > 192.168.1.100.53: 2+ A? google.com.Home. (33)
13:52:52.300645 IP 192.168.1.2.65436 > 192.168.1.100.53: 62312+ A? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:52.315967 IP 192.168.1.2.60068 > 192.168.1.100.53: 47699+ AAAA? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:53.443372 IP 192.168.1.2.62839 > 192.168.1.100.53: 7142+ A? dns.msftncsi.com. (34)
13:52:53.833865 IP 192.168.1.2.62840 > 192.168.1.100.53: 3+ AAAA? google.com.Home. (33)
13:52:54.447470 IP 192.168.1.2.62839 > 192.168.1.100.53: 7142+ A? dns.msftncsi.com. (34)
13:52:54.495832 IP 192.168.1.2.58418 > 192.168.1.100.53: Flags [S], seq 896120150, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:54.526095 IP 192.168.1.2.63864 > 192.168.1.100.53: Flags [S], seq 3365043248, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:52:55.454853 IP 192.168.1.2.62839 > 192.168.1.100.53: 7142+ A? dns.msftncsi.com. (34)
13:52:55.547205 IP 192.168.1.2.57883 > 192.168.1.100.53: 35003+ AAAA? Home. (22)
13:52:55.840803 IP 192.168.1.2.62841 > 192.168.1.100.53: 4+ A? google.com. (28)
13:52:56.307301 IP 192.168.1.2.65436 > 192.168.1.100.53: 62312+ A? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:56.322541 IP 192.168.1.2.60068 > 192.168.1.100.53: 47699+ AAAA? prod.detectportal.prod.cloudops.mozgcp.net. (60)
13:52:57.468960 IP 192.168.1.2.62839 > 192.168.1.100.53: 7142+ A? dns.msftncsi.com. (34)
13:52:57.855032 IP 192.168.1.2.62842 > 192.168.1.100.53: 5+ AAAA? google.com. (28)
13:53:00.322376 IP 192.168.1.2.53825 > 192.168.1.100.53: 2729+ A? Home.Home. (27)
13:53:00.337393 IP 192.168.1.2.62070 > 192.168.1.100.53: 25377+ AAAA? Home.Home. (27)
13:53:01.325515 IP 192.168.1.2.53825 > 192.168.1.100.53: 2729+ A? Home.Home. (27)
13:53:01.339965 IP 192.168.1.2.62070 > 192.168.1.100.53: 25377+ AAAA? Home.Home. (27)
13:53:01.478867 IP 192.168.1.2.62839 > 192.168.1.100.53: 7142+ A? dns.msftncsi.com. (34)
13:53:02.503723 IP 192.168.1.2.58418 > 192.168.1.100.53: Flags [S], seq 896120150, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:02.534296 IP 192.168.1.2.63864 > 192.168.1.100.53: Flags [S], seq 3365043248, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:03.330107 IP 192.168.1.2.53825 > 192.168.1.100.53: 2729+ A? Home.Home. (27)
13:53:03.345240 IP 192.168.1.2.62070 > 192.168.1.100.53: 25377+ AAAA? Home.Home. (27)
13:53:05.485082 IP 192.168.1.2.56988 > 192.168.1.100.53: Flags [S], seq 1033632831, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:06.499730 IP 192.168.1.2.56988 > 192.168.1.100.53: Flags [S], seq 1033632831, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:07.352334 IP 192.168.1.2.58805 > 192.168.1.100.53: 955+ AAAA? Home.Home. (27)
13:53:08.357221 IP 192.168.1.2.58805 > 192.168.1.100.53: 955+ AAAA? Home.Home. (27)
13:53:08.511607 IP 192.168.1.2.56988 > 192.168.1.100.53: Flags [S], seq 1033632831, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:10.369690 IP 192.168.1.2.58805 > 192.168.1.100.53: 955+ AAAA? Home.Home. (27)
13:53:12.513222 IP 192.168.1.2.56988 > 192.168.1.100.53: Flags [S], seq 1033632831, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:20.525370 IP 192.168.1.2.56988 > 192.168.1.100.53: Flags [S], seq 1033632831, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:23.450441 IP 192.168.1.2.64071 > 192.168.1.100.53: 12230+ A? dns.msftncsi.com. (34)
13:53:24.462108 IP 192.168.1.2.64071 > 192.168.1.100.53: 12230+ A? dns.msftncsi.com. (34)
13:53:25.465117 IP 192.168.1.2.64071 > 192.168.1.100.53: 12230+ A? dns.msftncsi.com. (34)
13:53:27.476681 IP 192.168.1.2.64071 > 192.168.1.100.53: 12230+ A? dns.msftncsi.com. (34)
13:53:31.484164 IP 192.168.1.2.64071 > 192.168.1.100.53: 12230+ A? dns.msftncsi.com. (34)
13:53:35.491782 IP 192.168.1.2.54414 > 192.168.1.100.53: Flags [S], seq 3313508324, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:36.503386 IP 192.168.1.2.54414 > 192.168.1.100.53: Flags [S], seq 3313508324, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:38.517179 IP 192.168.1.2.54414 > 192.168.1.100.53: Flags [S], seq 3313508324, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:42.521539 IP 192.168.1.2.54414 > 192.168.1.100.53: Flags [S], seq 3313508324, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:45.825455 IP 192.168.1.2.57150 > 192.168.1.100.53: 29023+ A? secure10.sync.com. (35)
13:53:46.835459 IP 192.168.1.2.57150 > 192.168.1.100.53: 29023+ A? secure10.sync.com. (35)
13:53:47.839068 IP 192.168.1.2.57150 > 192.168.1.100.53: 29023+ A? secure10.sync.com. (35)
13:53:49.849852 IP 192.168.1.2.57150 > 192.168.1.100.53: 29023+ A? secure10.sync.com. (35)
13:53:50.522544 IP 192.168.1.2.54414 > 192.168.1.100.53: Flags [S], seq 3313508324, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:53:51.095217 IP 192.168.1.2.54107 > 192.168.1.100.53: 29178+ A? wpad.Home. (27)
13:53:52.108959 IP 192.168.1.2.54107 > 192.168.1.100.53: 29178+ A? wpad.Home. (27)
13:53:53.447436 IP 192.168.1.2.59146 > 192.168.1.100.53: 30477+ A? dns.msftncsi.com. (34)
13:53:53.855948 IP 192.168.1.2.57150 > 192.168.1.100.53: 29023+ A? secure10.sync.com. (35)
13:53:54.112619 IP 192.168.1.2.54107 > 192.168.1.100.53: 29178+ A? wpad.Home. (27)
13:53:54.460078 IP 192.168.1.2.59146 > 192.168.1.100.53: 30477+ A? dns.msftncsi.com. (34)
13:53:55.460267 IP 192.168.1.2.59146 > 192.168.1.100.53: 30477+ A? dns.msftncsi.com. (34)
13:53:57.500442 IP 192.168.1.2.59146 > 192.168.1.100.53: 30477+ A? dns.msftncsi.com. (34)
13:54:01.516018 IP 192.168.1.2.59146 > 192.168.1.100.53: 30477+ A? dns.msftncsi.com. (34)
13:54:05.532487 IP 192.168.1.2.60041 > 192.168.1.100.53: Flags [S], seq 2349825664, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:06.537957 IP 192.168.1.2.60041 > 192.168.1.100.53: Flags [S], seq 2349825664, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:08.543081 IP 192.168.1.2.60041 > 192.168.1.100.53: Flags [S], seq 2349825664, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:12.552384 IP 192.168.1.2.60041 > 192.168.1.100.53: Flags [S], seq 2349825664, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:20.558591 IP 192.168.1.2.60041 > 192.168.1.100.53: Flags [S], seq 2349825664, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:23.453662 IP 192.168.1.2.60836 > 192.168.1.100.53: 5425+ A? dns.msftncsi.com. (34)
13:54:24.461264 IP 192.168.1.2.60836 > 192.168.1.100.53: 5425+ A? dns.msftncsi.com. (34)
13:54:25.473287 IP 192.168.1.2.60836 > 192.168.1.100.53: 5425+ A? dns.msftncsi.com. (34)
13:54:27.478928 IP 192.168.1.2.60836 > 192.168.1.100.53: 5425+ A? dns.msftncsi.com. (34)
13:54:31.487609 IP 192.168.1.2.60836 > 192.168.1.100.53: 5425+ A? dns.msftncsi.com. (34)
13:54:32.040226 IP 192.168.1.2.51013 > 192.168.1.100.53: 8788+ A? d.dropbox.com. (31)
13:54:33.040276 IP 192.168.1.2.51013 > 192.168.1.100.53: 8788+ A? d.dropbox.com. (31)
13:54:34.052614 IP 192.168.1.2.51013 > 192.168.1.100.53: 8788+ A? d.dropbox.com. (31)
13:54:35.501465 IP 192.168.1.2.51349 > 192.168.1.100.53: Flags [S], seq 3458210356, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:36.064281 IP 192.168.1.2.51013 > 192.168.1.100.53: 8788+ A? d.dropbox.com. (31)
13:54:36.504574 IP 192.168.1.2.51349 > 192.168.1.100.53: Flags [S], seq 3458210356, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:38.509401 IP 192.168.1.2.51349 > 192.168.1.100.53: Flags [S], seq 3458210356, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:40.069905 IP 192.168.1.2.51013 > 192.168.1.100.53: 8788+ A? d.dropbox.com. (31)
13:54:42.512511 IP 192.168.1.2.51349 > 192.168.1.100.53: Flags [S], seq 3458210356, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:54:50.518875 IP 192.168.1.2.51349 > 192.168.1.100.53: Flags [S], seq 3458210356, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:08.448401 IP 192.168.1.2.59052 > 192.168.1.100.53: 57091+ A? dns.msftncsi.com. (34)
13:55:09.449898 IP 192.168.1.2.59052 > 192.168.1.100.53: 57091+ A? dns.msftncsi.com. (34)
13:55:10.454968 IP 192.168.1.2.59052 > 192.168.1.100.53: 57091+ A? dns.msftncsi.com. (34)
13:55:12.461156 IP 192.168.1.2.59052 > 192.168.1.100.53: 57091+ A? dns.msftncsi.com. (34)
13:55:16.473075 IP 192.168.1.2.59052 > 192.168.1.100.53: 57091+ A? dns.msftncsi.com. (34)
13:55:20.486150 IP 192.168.1.2.49317 > 192.168.1.100.53: 31305+ A? dns.msftncsi.com. (34)
13:55:20.486423 IP 192.168.1.2.61999 > 192.168.1.100.53: Flags [S], seq 2129389233, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:21.495167 IP 192.168.1.2.61999 > 192.168.1.100.53: Flags [S], seq 2129389233, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:21.495508 IP 192.168.1.2.49317 > 192.168.1.100.53: 31305+ A? dns.msftncsi.com. (34)
13:55:22.496195 IP 192.168.1.2.49317 > 192.168.1.100.53: 31305+ A? dns.msftncsi.com. (34)
13:55:23.501432 IP 192.168.1.2.61999 > 192.168.1.100.53: Flags [S], seq 2129389233, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:24.501571 IP 192.168.1.2.49317 > 192.168.1.100.53: 31305+ A? dns.msftncsi.com. (34)
13:55:27.514205 IP 192.168.1.2.61999 > 192.168.1.100.53: Flags [S], seq 2129389233, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:28.505620 IP 192.168.1.2.49317 > 192.168.1.100.53: 31305+ A? dns.msftncsi.com. (34)
13:55:35.519511 IP 192.168.1.2.61999 > 192.168.1.100.53: Flags [S], seq 2129389233, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:55:53.450248 IP 192.168.1.2.57836 > 192.168.1.100.53: 26854+ A? dns.msftncsi.com. (34)
13:55:54.458293 IP 192.168.1.2.57836 > 192.168.1.100.53: 26854+ A? dns.msftncsi.com. (34)
13:55:55.469518 IP 192.168.1.2.57836 > 192.168.1.100.53: 26854+ A? dns.msftncsi.com. (34)
13:55:56.156706 IP 192.168.1.2.60149 > 192.168.1.100.53: 32237+ AAAA? www.dropbox.com. (33)
13:55:57.160963 IP 192.168.1.2.60149 > 192.168.1.100.53: 32237+ AAAA? www.dropbox.com. (33)
13:55:57.472918 IP 192.168.1.2.57836 > 192.168.1.100.53: 26854+ A? dns.msftncsi.com. (34)
13:55:58.173830 IP 192.168.1.2.60149 > 192.168.1.100.53: 32237+ AAAA? www.dropbox.com. (33)
13:55:59.534638 IP 192.168.1.2.65152 > 192.168.1.100.53: 55206+ A? secure10.sync.com. (35)
13:56:00.188675 IP 192.168.1.2.60149 > 192.168.1.100.53: 32237+ AAAA? www.dropbox.com. (33)
13:56:00.538763 IP 192.168.1.2.65152 > 192.168.1.100.53: 55206+ A? secure10.sync.com. (35)
13:56:01.488592 IP 192.168.1.2.57836 > 192.168.1.100.53: 26854+ A? dns.msftncsi.com. (34)
13:56:01.551376 IP 192.168.1.2.65152 > 192.168.1.100.53: 55206+ A? secure10.sync.com. (35)
13:56:03.566488 IP 192.168.1.2.65152 > 192.168.1.100.53: 55206+ A? secure10.sync.com. (35)
13:56:04.200498 IP 192.168.1.2.60149 > 192.168.1.100.53: 32237+ AAAA? www.dropbox.com. (33)
13:56:05.494673 IP 192.168.1.2.50313 > 192.168.1.100.53: 63264+ A? dns.msftncsi.com. (34)
13:56:05.494821 IP 192.168.1.2.63716 > 192.168.1.100.53: Flags [S], seq 829029125, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:06.502297 IP 192.168.1.2.63716 > 192.168.1.100.53: Flags [S], seq 829029125, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:06.502468 IP 192.168.1.2.50313 > 192.168.1.100.53: 63264+ A? dns.msftncsi.com. (34)
13:56:07.502659 IP 192.168.1.2.50313 > 192.168.1.100.53: 63264+ A? dns.msftncsi.com. (34)
13:56:07.579154 IP 192.168.1.2.65152 > 192.168.1.100.53: 55206+ A? secure10.sync.com. (35)
13:56:08.211803 IP 192.168.1.2.64149 > 192.168.1.100.53: 54254+ A? netmon-control.dropbox.com. (44)
13:56:08.510215 IP 192.168.1.2.63716 > 192.168.1.100.53: Flags [S], seq 829029125, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:09.220689 IP 192.168.1.2.64149 > 192.168.1.100.53: 54254+ A? netmon-control.dropbox.com. (44)
13:56:09.504664 IP 192.168.1.2.50313 > 192.168.1.100.53: 63264+ A? dns.msftncsi.com. (34)
13:56:10.222828 IP 192.168.1.2.64149 > 192.168.1.100.53: 54254+ A? netmon-control.dropbox.com. (44)
13:56:12.238228 IP 192.168.1.2.64149 > 192.168.1.100.53: 54254+ A? netmon-control.dropbox.com. (44)
13:56:12.523879 IP 192.168.1.2.63716 > 192.168.1.100.53: Flags [S], seq 829029125, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:13.508760 IP 192.168.1.2.50313 > 192.168.1.100.53: 63264+ A? dns.msftncsi.com. (34)
13:56:16.245487 IP 192.168.1.2.64149 > 192.168.1.100.53: 54254+ A? netmon-control.dropbox.com. (44)
13:56:20.529599 IP 192.168.1.2.63716 > 192.168.1.100.53: Flags [S], seq 829029125, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:23.447730 IP 192.168.1.2.62679 > 192.168.1.100.53: 46872+ A? dns.msftncsi.com. (34)
13:56:24.449976 IP 192.168.1.2.62679 > 192.168.1.100.53: 46872+ A? dns.msftncsi.com. (34)
13:56:25.453631 IP 192.168.1.2.62679 > 192.168.1.100.53: 46872+ A? dns.msftncsi.com. (34)
13:56:27.461986 IP 192.168.1.2.62679 > 192.168.1.100.53: 46872+ A? dns.msftncsi.com. (34)
13:56:31.468500 IP 192.168.1.2.62679 > 192.168.1.100.53: 46872+ A? dns.msftncsi.com. (34)
13:56:35.471250 IP 192.168.1.2.63325 > 192.168.1.100.53: Flags [S], seq 42195071, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:36.478724 IP 192.168.1.2.63325 > 192.168.1.100.53: Flags [S], seq 42195071, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:38.488703 IP 192.168.1.2.63325 > 192.168.1.100.53: Flags [S], seq 42195071, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:42.489073 IP 192.168.1.2.63325 > 192.168.1.100.53: Flags [S], seq 42195071, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:42.506936 IP 192.168.1.2.53963 > 192.168.1.100.53: 45148+ A? secure20.sync.com. (35)
13:56:43.517178 IP 192.168.1.2.53963 > 192.168.1.100.53: 45148+ A? secure20.sync.com. (35)
13:56:44.528806 IP 192.168.1.2.53963 > 192.168.1.100.53: 45148+ A? secure20.sync.com. (35)
13:56:46.536652 IP 192.168.1.2.53963 > 192.168.1.100.53: 45148+ A? secure20.sync.com. (35)
13:56:50.498523 IP 192.168.1.2.63325 > 192.168.1.100.53: Flags [S], seq 42195071, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
13:56:50.544202 IP 192.168.1.2.53963 > 192.168.1.100.53: 45148+ A? secure20.sync.com. (35)
13:57:07.973751 IP 192.168.1.2.57505 > 192.168.1.100.53: 2600+ A? bolt.dropbox.com. (34)
13:57:08.986074 IP 192.168.1.2.57505 > 192.168.1.100.53: 2600+ A? bolt.dropbox.com. (34)
13:57:09.989598 IP 192.168.1.2.57505 > 192.168.1.100.53: 2600+ A? bolt.dropbox.com. (34)
13:57:11.999591 IP 192.168.1.2.57505 > 192.168.1.100.53: 2600+ A? bolt.dropbox.com. (34)
13:57:16.014644 IP 192.168.1.2.57505 > 192.168.1.100.53: 2600+ A? bolt.dropbox.com. (34)
13:57:20.175570 IP 192.168.1.2.61693 > 192.168.1.100.53: 4355+ A? client.dropbox.com. (36)
13:57:21.187027 IP 192.168.1.2.61693 > 192.168.1.100.53: 4355+ A? client.dropbox.com. (36)
13:57:22.197641 IP 192.168.1.2.61693 > 192.168.1.100.53: 4355+ A? client.dropbox.com. (36)
13:57:24.203104 IP 192.168.1.2.61693 > 192.168.1.100.53: 4355+ A? client.dropbox.com. (36)
13:57:28.213121 IP 192.168.1.2.61693 > 192.168.1.100.53: 4355+ A? client.dropbox.com. (36)
13:57:30.140625 IP 192.168.1.2.54588 > 192.168.1.100.53: 32854+ A? profile.accounts.firefox.com. (46)
13:57:30.144316 IP 192.168.1.2.59084 > 192.168.1.100.53: 19035+ A? sync-1-us-west1-g.sync.services.mozilla.com. (61)
13:57:31.152030 IP 192.168.1.2.54588 > 192.168.1.100.53: 32854+ A? profile.accounts.firefox.com. (46)
13:57:31.152058 IP 192.168.1.2.59084 > 192.168.1.100.53: 19035+ A? sync-1-us-west1-g.sync.services.mozilla.com. (61)
13:57:32.155065 IP 192.168.1.2.59084 > 192.168.1.100.53: 19035+ A? sync-1-us-west1-g.sync.services.mozilla.com. (61)
13:57:32.155082 IP 192.168.1.2.54588 > 192.168.1.100.53: 32854+ A? profile.accounts.firefox.com. (46)
13:57:32.219544 IP 192.168.1.2.54584 > 192.168.1.100.53: 42920+ A? Home.Home. (27)
13:57:33.230522 IP 192.168.1.2.54584 > 192.168.1.100.53: 42920+ A? Home.Home. (27)
13:57:34.160154 IP 192.168.1.2.54588 > 192.168.1.100.53: 32854+ A? profile.accounts.firefox.com. (46)
13:57:34.160308 IP 192.168.1.2.59084 > 192.168.1.100.53: 19035+ A? sync-1-us-west1-g.sync.services.mozilla.com. (61)
13:57:35.240497 IP 192.168.1.2.54584 > 192.168.1.100.53: 42920+ A? Home.Home. (27)
13:57:38.173853 IP 192.168.1.2.59084 > 192.168.1.100.53: 19035+ A? sync-1-us-west1-g.sync.services.mozilla.com. (61)
13:57:38.173873 IP 192.168.1.2.54588 > 192.168.1.100.53: 32854+ A? profile.accounts.firefox.com. (46)
13:57:42.869495 IP 192.168.1.2.54334 > 192.168.1.100.53: 21078+ A? services.addons.mozilla.org. (45)
13:57:43.880351 IP 192.168.1.2.54334 > 192.168.1.100.53: 21078+ A? services.addons.mozilla.org. (45)
13:57:44.886789 IP 192.168.1.2.54334 > 192.168.1.100.53: 21078+ A? services.addons.mozilla.org. (45)
13:57:46.893584 IP 192.168.1.2.54334 > 192.168.1.100.53: 21078+ A? services.addons.mozilla.org. (45)
13:57:50.905696 IP 192.168.1.2.54334 > 192.168.1.100.53: 21078+ A? services.addons.mozilla.org. (45)
13:57:54.917530 IP 192.168.1.2.57850 > 192.168.1.100.53: 11729+ A? Home.Home. (27)
13:57:55.924767 IP 192.168.1.2.57850 > 192.168.1.100.53: 11729+ A? Home.Home. (27)
13:57:57.929346 IP 192.168.1.2.57850 > 192.168.1.100.53: 11729+ A? Home.Home. (27)
13:58:10.346963 IP 192.168.1.2.49900 > 192.168.1.100.53: 22480+ A? incoming.telemetry.mozilla.org. (48)
13:58:11.350531 IP 192.168.1.2.49900 > 192.168.1.100.53: 22480+ A? incoming.telemetry.mozilla.org. (48)
13:58:12.365703 IP 192.168.1.2.49900 > 192.168.1.100.53: 22480+ A? incoming.telemetry.mozilla.org. (48)
13:58:13.772651 IP 192.168.1.2.57016 > 192.168.1.100.53: 1914+ A? duckduckgo.com. (32)
13:58:14.378491 IP 192.168.1.2.49900 > 192.168.1.100.53: 22480+ A? incoming.telemetry.mozilla.org. (48)
13:58:14.780529 IP 192.168.1.2.57016 > 192.168.1.100.53: 1914+ A? duckduckgo.com. (32)
13:58:15.790443 IP 192.168.1.2.57016 > 192.168.1.100.53: 1914+ A? duckduckgo.com. (32)
13:58:17.796892 IP 192.168.1.2.57016 > 192.168.1.100.53: 1914+ A? duckduckgo.com. (32)
13:58:18.386932 IP 192.168.1.2.49900 > 192.168.1.100.53: 22480+ A? incoming.telemetry.mozilla.org. (48)
13:58:21.800833 IP 192.168.1.2.57016 > 192.168.1.100.53: 1914+ A? duckduckgo.com. (32)
13:58:22.395642 IP 192.168.1.2.53227 > 192.168.1.100.53: 15200+ A? pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com. (82)
13:58:23.406562 IP 192.168.1.2.53227 > 192.168.1.100.53: 15200+ A? pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com. (82)
13:58:24.420479 IP 192.168.1.2.53227 > 192.168.1.100.53: 15200+ A? pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com. (82)
13:58:26.431337 IP 192.168.1.2.53227 > 192.168.1.100.53: 15200+ A? pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com. (82)
13:58:26.648528 IP 192.168.1.2.49955 > 192.168.1.100.53: 10310+ AAAA? links.duckduckgo.com. (38)
13:58:27.515368 IP 192.168.1.2.52525 > 192.168.1.100.53: 2322+ AAAA? external-content.duckduckgo.com. (49)
13:58:27.662418 IP 192.168.1.2.49955 > 192.168.1.100.53: 10310+ AAAA? links.duckduckgo.com. (38)
13:58:28.517970 IP 192.168.1.2.52525 > 192.168.1.100.53: 2322+ AAAA? external-content.duckduckgo.com. (49)
13:58:28.672092 IP 192.168.1.2.49955 > 192.168.1.100.53: 10310+ AAAA? links.duckduckgo.com. (38)
13:58:29.525232 IP 192.168.1.2.52525 > 192.168.1.100.53: 2322+ AAAA? external-content.duckduckgo.com. (49)
13:58:30.432610 IP 192.168.1.2.53227 > 192.168.1.100.53: 15200+ A? pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com. (82)
13:58:30.679465 IP 192.168.1.2.49955 > 192.168.1.100.53: 10310+ AAAA? links.duckduckgo.com. (38)
13:58:31.535226 IP 192.168.1.2.52525 > 192.168.1.100.53: 2322+ AAAA? external-content.duckduckgo.com. (49)
13:58:34.434851 IP 192.168.1.2.59259 > 192.168.1.100.53: 63756+ A? Home.Home. (27)
13:58:34.687675 IP 192.168.1.2.49955 > 192.168.1.100.53: 10310+ AAAA? links.duckduckgo.com. (38)
13:58:35.438651 IP 192.168.1.2.59259 > 192.168.1.100.53: 63756+ A? Home.Home. (27)
13:58:35.546433 IP 192.168.1.2.52525 > 192.168.1.100.53: 2322+ AAAA? external-content.duckduckgo.com. (49)
13:58:37.452560 IP 192.168.1.2.59259 > 192.168.1.100.53: 63756+ A? Home.Home. (27)
13:58:39.561809 IP 192.168.1.2.52579 > 192.168.1.100.53: 6526+ AAAA? Home.Home. (27)
13:58:40.563689 IP 192.168.1.2.52579 > 192.168.1.100.53: 6526+ AAAA? Home.Home. (27)
13:58:42.574852 IP 192.168.1.2.52579 > 192.168.1.100.53: 6526+ AAAA? Home.Home. (27)
13:58:57.814338 IP 192.168.1.2.54828 > 192.168.1.100.53: 43320+ A? telemetry.dropbox.com. (39)
13:58:58.821829 IP 192.168.1.2.54828 > 192.168.1.100.53: 43320+ A? telemetry.dropbox.com. (39)
13:58:59.830547 IP 192.168.1.2.54828 > 192.168.1.100.53: 43320+ A? telemetry.dropbox.com. (39)
13:59:01.834569 IP 192.168.1.2.54828 > 192.168.1.100.53: 43320+ A? telemetry.dropbox.com. (39)
13:59:05.839382 IP 192.168.1.2.54828 > 192.168.1.100.53: 43320+ A? telemetry.dropbox.com. (39)
13:59:36.410438 IP 192.168.1.2.54268 > 192.168.1.100.53: 17851+ A? secure20.sync.com. (35)
13:59:37.419503 IP 192.168.1.2.54268 > 192.168.1.100.53: 17851+ A? secure20.sync.com. (35)
13:59:38.425796 IP 192.168.1.2.54268 > 192.168.1.100.53: 17851+ A? secure20.sync.com. (35)
13:59:40.438754 IP 192.168.1.2.54268 > 192.168.1.100.53: 17851+ A? secure20.sync.com. (35)
13:59:44.444015 IP 192.168.1.2.54268 > 192.168.1.100.53: 17851+ A? secure20.sync.com. (35)
14:00:40.087359 IP 192.168.1.2.58097 > 192.168.1.100.53: 475+ A? secure10.sync.com. (35)
14:00:40.130490 IP 192.168.1.2.58097 > 192.168.1.100.53: 475+ A? secure10.sync.com. (35)
14:00:41.131581 IP 192.168.1.2.58097 > 192.168.1.100.53: 475+ A? secure10.sync.com. (35)
14:00:43.134179 IP 192.168.1.2.58097 > 192.168.1.100.53: 475+ A? secure10.sync.com. (35)
14:00:43.404085 IP 192.168.1.2.60003 > 192.168.1.100.53: 65337+ A? duckduckgo.com. (32)
14:00:43.404260 IP 192.168.1.2.53561 > 192.168.1.100.53: 23914+ A? external-content.duckduckgo.com. (49)
14:00:43.448156 IP 192.168.1.2.53561 > 192.168.1.100.53: 23914+ A? external-content.duckduckgo.com. (49)
14:00:43.448177 IP 192.168.1.2.60003 > 192.168.1.100.53: 65337+ A? duckduckgo.com. (32)
14:00:44.455639 IP 192.168.1.2.60003 > 192.168.1.100.53: 65337+ A? duckduckgo.com. (32)
14:00:44.455656 IP 192.168.1.2.53561 > 192.168.1.100.53: 23914+ A? external-content.duckduckgo.com. (49)
14:00:46.458476 IP 192.168.1.2.53561 > 192.168.1.100.53: 23914+ A? external-content.duckduckgo.com. (49)
14:00:46.458493 IP 192.168.1.2.60003 > 192.168.1.100.53: 65337+ A? duckduckgo.com. (32)
14:00:47.138164 IP 192.168.1.2.58097 > 192.168.1.100.53: 475+ A? secure10.sync.com. (35)
14:00:50.463190 IP 192.168.1.2.60003 > 192.168.1.100.53: 65337+ A? duckduckgo.com. (32)
14:00:50.463218 IP 192.168.1.2.53561 > 192.168.1.100.53: 23914+ A? external-content.duckduckgo.com. (49)
14:00:52.123187 IP 192.168.1.2.49681 > 192.168.1.100.53: 57314+ A? incoming.telemetry.mozilla.org. (48)
14:00:52.163197 IP 192.168.1.2.49681 > 192.168.1.100.53: 57314+ A? incoming.telemetry.mozilla.org. (48)
14:00:53.169495 IP 192.168.1.2.49681 > 192.168.1.100.53: 57314+ A? incoming.telemetry.mozilla.org. (48)
14:00:55.186971 IP 192.168.1.2.49681 > 192.168.1.100.53: 57314+ A? incoming.telemetry.mozilla.org. (48)
14:00:59.192602 IP 192.168.1.2.49681 > 192.168.1.100.53: 57314+ A? incoming.telemetry.mozilla.org. (48)
14:01:03.208145 IP 192.168.1.2.49302 > 192.168.1.100.53: 10981+ A? Home.Home. (27)
14:01:04.214726 IP 192.168.1.2.49302 > 192.168.1.100.53: 10981+ A? Home.Home. (27)
14:01:06.221064 IP 192.168.1.2.49302 > 192.168.1.100.53: 10981+ A? Home.Home. (27)
14:01:18.972328 IP 192.168.1.2.56487 > 192.168.1.100.53: 54904+ A? img-getpocket.cdn.mozilla.net. (47)
14:01:19.014553 IP 192.168.1.2.56487 > 192.168.1.100.53: 54904+ A? img-getpocket.cdn.mozilla.net. (47)
14:01:20.023063 IP 192.168.1.2.56487 > 192.168.1.100.53: 54904+ A? img-getpocket.cdn.mozilla.net. (47)
14:01:22.032056 IP 192.168.1.2.56487 > 192.168.1.100.53: 54904+ A? img-getpocket.cdn.mozilla.net. (47)
14:01:26.038839 IP 192.168.1.2.56487 > 192.168.1.100.53: 54904+ A? img-getpocket.cdn.mozilla.net. (47)
14:01:27.986250 IP 192.168.1.2.59542 > 192.168.1.100.53: 55970+ A? profile.accounts.firefox.com. (46)
14:01:28.030811 IP 192.168.1.2.59542 > 192.168.1.100.53: 55970+ A? profile.accounts.firefox.com. (46)
14:01:29.042391 IP 192.168.1.2.59542 > 192.168.1.100.53: 55970+ A? profile.accounts.firefox.com. (46)
14:01:30.042575 IP 192.168.1.2.56481 > 192.168.1.100.53: 5905+ A? img-prod.pocket.prod.cloudops.mozgcp.net. (58)
14:01:30.082261 IP 192.168.1.2.56481 > 192.168.1.100.53: 5905+ A? img-prod.pocket.prod.cloudops.mozgcp.net. (58)
14:01:31.045828 IP 192.168.1.2.59542 > 192.168.1.100.53: 55970+ A? profile.accounts.firefox.com. (46)
14:01:31.092104 IP 192.168.1.2.56481 > 192.168.1.100.53: 5905+ A? img-prod.pocket.prod.cloudops.mozgcp.net. (58)
14:01:33.096122 IP 192.168.1.2.56481 > 192.168.1.100.53: 5905+ A? img-prod.pocket.prod.cloudops.mozgcp.net. (58)
14:01:35.077362 IP 192.168.1.2.59542 > 192.168.1.100.53: 55970+ A? profile.accounts.firefox.com. (46)
14:01:37.107212 IP 192.168.1.2.56481 > 192.168.1.100.53: 5905+ A? img-prod.pocket.prod.cloudops.mozgcp.net. (58)
14:01:41.110007 IP 192.168.1.2.54831 > 192.168.1.100.53: 16550+ A? Home.Home. (27)
14:01:42.125695 IP 192.168.1.2.54831 > 192.168.1.100.53: 16550+ A? Home.Home. (27)
14:01:42.506508 IP 192.168.1.2.61189 > 192.168.1.100.53: 40571+ A? getpocket.com. (31)
14:01:42.551864 IP 192.168.1.2.61189 > 192.168.1.100.53: 40571+ A? getpocket.com. (31)
14:01:42.567153 IP 192.168.1.2.57723 > 192.168.1.100.53: 55352+ AAAA? getpocket.com. (31)
14:01:42.613782 IP 192.168.1.2.57723 > 192.168.1.100.53: 55352+ AAAA? getpocket.com. (31)
14:01:42.983071 IP 192.168.1.2.51637 > 192.168.1.100.53: 6355+ AAAA? cdn.cookielaw.org. (35)
14:01:43.017365 IP 192.168.1.2.51637 > 192.168.1.100.53: 6355+ AAAA? cdn.cookielaw.org. (35)
14:01:43.559742 IP 192.168.1.2.61189 > 192.168.1.100.53: 40571+ A? getpocket.com. (31)
14:01:43.622497 IP 192.168.1.2.57723 > 192.168.1.100.53: 55352+ AAAA? getpocket.com. (31)
14:01:44.029378 IP 192.168.1.2.51637 > 192.168.1.100.53: 6355+ AAAA? cdn.cookielaw.org. (35)
14:01:44.138768 IP 192.168.1.2.54831 > 192.168.1.100.53: 16550+ A? Home.Home. (27)
14:01:45.574516 IP 192.168.1.2.61189 > 192.168.1.100.53: 40571+ A? getpocket.com. (31)
14:01:45.638110 IP 192.168.1.2.57723 > 192.168.1.100.53: 55352+ AAAA? getpocket.com. (31)
14:01:46.042101 IP 192.168.1.2.51637 > 192.168.1.100.53: 6355+ AAAA? cdn.cookielaw.org. (35)
14:01:49.583603 IP 192.168.1.2.61189 > 192.168.1.100.53: 40571+ A? getpocket.com. (31)
14:01:49.644537 IP 192.168.1.2.57723 > 192.168.1.100.53: 55352+ AAAA? getpocket.com. (31)
14:01:50.051302 IP 192.168.1.2.51637 > 192.168.1.100.53: 6355+ AAAA? cdn.cookielaw.org. (35)
14:01:53.660507 IP 192.168.1.2.54179 > 192.168.1.100.53: 11043+ A? use.typekit.net. (33)
14:01:53.706073 IP 192.168.1.2.54179 > 192.168.1.100.53: 11043+ A? use.typekit.net. (33)
14:01:53.751153 IP 192.168.1.2.64012 > 192.168.1.100.53: 12667+ AAAA? a1988.dscg1.akamai.net. (40)
14:01:53.784190 IP 192.168.1.2.64012 > 192.168.1.100.53: 12667+ AAAA? a1988.dscg1.akamai.net. (40)
14:01:54.720152 IP 192.168.1.2.54179 > 192.168.1.100.53: 11043+ A? use.typekit.net. (33)
14:01:54.797313 IP 192.168.1.2.64012 > 192.168.1.100.53: 12667+ AAAA? a1988.dscg1.akamai.net. (40)
14:01:56.721139 IP 192.168.1.2.54179 > 192.168.1.100.53: 11043+ A? use.typekit.net. (33)
14:01:56.797569 IP 192.168.1.2.64012 > 192.168.1.100.53: 12667+ AAAA? a1988.dscg1.akamai.net. (40)
14:02:00.723672 IP 192.168.1.2.54179 > 192.168.1.100.53: 11043+ A? use.typekit.net. (33)
14:02:00.802303 IP 192.168.1.2.64012 > 192.168.1.100.53: 12667+ AAAA? a1988.dscg1.akamai.net. (40)
14:02:04.732970 IP 192.168.1.2.49944 > 192.168.1.100.53: 30592+ A? Home.Home. (27)
14:02:04.809560 IP 192.168.1.2.60930 > 192.168.1.100.53: 59741+ AAAA? Home.Home. (27)
14:02:05.734166 IP 192.168.1.2.49944 > 192.168.1.100.53: 30592+ A? Home.Home. (27)
14:02:05.811679 IP 192.168.1.2.60930 > 192.168.1.100.53: 59741+ AAAA? Home.Home. (27)
14:02:07.742809 IP 192.168.1.2.49944 > 192.168.1.100.53: 30592+ A? Home.Home. (27)
500 packets captured
500 packets received by filter
0 packets dropped by kernel

Joulinar · 3 July 2021 20:44

hmm strange, your windows box 192.168.1.2 is sending quite a lot of DNS request to your RPi but it seems nothing happen with these request. There is no answer to the client nor AGH is not trying to resolve them. Looks like the request are blocked somewhere. Do you use an firewall software on the RPi?

Can you go to AGH web ui and try to change DNS server from https://dns10.quad9.net/dns-query to 9.9.9.9. There should be a button Test Upstream. Does this work?

Rhizome · 4 July 2021 16:59

Yes, I’m using GUFW on the Dietpi. I will disable.

Before doing this, in the AG web UI “DNS settings” page, I wasn’t sure where to change the server address. The “Upstream servers” are edited in Dietpi, so instead I did it in the “Bootstrap DNS servers” section which is editable in the web UI. Is this the correct place to change the server?

Changed the first entry from 9.9.9.10 to 9.9.9.9 then clicked “Test upstreams” and got the message “Specified servers are working correctly.”

I then disabled UFW and clicked “Test upstreams” again. Got the msg “Specified servers are working correctly.” Also worked correctly with 9.9.9.10.

Joulinar · 5 July 2021 08:21

so instead I did it in the “Bootstrap DNS servers” section

That’s the wrong place. Upstream DNS you would need to adjust on the first box on top of the page. Usually the first box should be editable as we disabled Unbound. But it doesn’t matter. I don’t think Upstream DNS is the issue. I guess it is your UFW firewall blocking incoming DNS traffic. Pls disabled UFW and perfrom the test again we did before Setting Up AdGuard: DNS Redirect doesn’t work - #10 by Rhizome

It’s enough to capture 100 lines instead of 500

tcpdump -i any -c100 -nn port 853 or port 53 or port 443

Rhizome · 5 July 2021 22:43

Hi Joulinard,
UFW is inactive, results below. Still unable to edit the first box in “DNS settings” however.
Also, redirecting my PC DNS to the Rpi gives me internet access! So that’s progress
AND, AdGuard is showing Dashboard results for the first time (for the PC only) !

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
23:29:04.168031 IP 192.168.1.100.38696 > 35.186.227.140.443: Flags [P.], seq 2492623951:2492623990, ack 4067559866, win 501, options [nop,nop,TS val 2747981122 ecr 1000936368], length 39
23:29:04.168719 IP 192.168.1.100.38696 > 35.186.227.140.443: Flags [P.], seq 39:63, ack 1, win 501, options [nop,nop,TS val 2747981123 ecr 1000936368], length 24
23:29:04.168848 IP 192.168.1.100.38696 > 35.186.227.140.443: Flags [F.], seq 63, ack 1, win 501, options [nop,nop,TS val 2747981123 ecr 1000936368], length 0
23:29:04.185992 IP 35.186.227.140.443 > 192.168.1.100.38696: Flags [.], ack 63, win 332, options [nop,nop,TS val 1000989396 ecr 2747981122], length 0
23:29:04.186096 IP 35.186.227.140.443 > 192.168.1.100.38696: Flags [F.], seq 1, ack 63, win 332, options [nop,nop,TS val 1000989396 ecr 2747981122], length 0
23:29:04.186169 IP 192.168.1.100.38696 > 35.186.227.140.443: Flags [.], ack 2, win 501, options [nop,nop,TS val 2747981140 ecr 1000989396], length 0
23:29:04.186706 IP 35.186.227.140.443 > 192.168.1.100.38696: Flags [.], ack 64, win 332, options [nop,nop,TS val 1000989396 ecr 2747981123], length 0
ip 23:31:01.926780 IP 192.168.1.2.58750 > 192.168.1.100.53: 43059+ A? secure20.sync.com. (35)
23:31:01.928565 IP 192.168.1.100.16245 > 205.251.198.27.53: 12762% [1au] A? SecuRe20.SYnC.COm. (46)
23:31:01.929035 IP 192.168.1.100.53 > 192.168.1.2.58750: 43059 4/0/0 A 34.202.86.107, A 50.17.80.65, A 52.21.182.194, A 50.17.142.229 (99)
23:31:01.957406 IP 205.251.198.27.53 > 192.168.1.100.16245: 12762*-$ 4/4/1 A 52.21.182.194, A 34.202.86.107, A 50.17.80.65, A 50.17.142.229 (247)
23:31:01.959148 IP 192.168.1.100.7578 > 192.52.178.30.53: 49614% [1au] DS? Sync.cOm. (37)
23:31:02.031842 IP 192.52.178.30.53 > 192.168.1.100.7578: 49614*- 0/6/1 (854)
23:31:02.032522 IP 192.168.1.100.8582 > 192.35.51.30.53: 23743% [1au] DS? Sync.com. (37)
23:31:02.073393 IP 192.35.51.30.53 > 192.168.1.100.8582: 23743*- 0/6/1 (854)
23:31:02.075219 IP 192.168.1.100.21741 > 192.12.94.30.53: 37775% [1au] DS? sYNC.com. (37)
23:31:02.153389 IP 192.12.94.30.53 > 192.168.1.100.21741: 37775*- 0/6/1 (854)
23:31:02.153866 IP 192.168.1.100.47516 > 192.54.112.30.53: 45435% [1au] DS? SyNC.COm. (37)
23:31:02.199359 IP 192.54.112.30.53 > 192.168.1.100.47516: 45435*- 0/6/1 (854)
23:31:02.199727 IP 192.168.1.100.38003 > 192.31.80.30.53: 18309% [1au] DS? sYnc.coM. (37)
23:31:02.278098 IP 192.31.80.30.53 > 192.168.1.100.38003: 18309*- 0/6/1 (854)
23:31:15.126916 IP 54.186.29.180.443 > 192.168.1.100.59752: Flags [P.], seq 1210272252:1210272283, ack 1782112776, win 118, options [nop,nop,TS val 3216363493 ecr 3497249902], length 31
23:31:15.127179 IP 192.168.1.100.59752 > 54.186.29.180.443: Flags [P.], seq 1:36, ack 31, win 501, options [nop,nop,TS val 3497549986 ecr 3216363493], length 35
23:31:15.205712 IP 54.186.29.180.443 > 192.168.1.100.59752: Flags [.], ack 36, win 118, options [nop,nop,TS val 3216363572 ecr 3497549986], length 0
23:32:36.387886 IP 192.168.1.2.51058 > 192.168.1.100.53: 18540+ A? d.dropbox.com. (31)
23:32:36.390000 IP 192.168.1.100.18396 > 192.31.80.30.53: 50304% [1au] A? DrOPBox.com. (40)
23:32:36.463441 IP 192.31.80.30.53 > 192.168.1.100.18396: 50304- 0/8/2 (742)
23:32:36.464018 IP 192.168.1.100.27864 > 205.251.193.59.53: 23669% [1au] A? d.drOpBoX.Com. (42)
23:32:36.464228 IP 192.168.1.100.51828 > 199.249.120.1.53: 47176% [1au] A? AwsDNs-17.oRg. (42)
23:32:36.464442 IP 192.168.1.100.16570 > 156.154.101.3.53: 4969% [1au] A? AwsDNs-51.co.uk. (44)
23:32:36.465172 IP 192.168.1.100.59760 > 192.42.93.30.53: 55999% [1au] A? AWsDNS-06.Net. (42)
23:32:36.465615 IP 192.168.1.100.14763 > 199.249.112.1.53: 42940% [1au] A? AWsDns-17.orG. (42)
23:32:36.465853 IP 192.168.1.100.23109 > 213.248.216.1.53: 36940% [1au] A? aWSdnS-51.Co.uK. (44)
23:32:36.466085 IP 192.168.1.100.51343 > 192.26.92.30.53: 56472% [1au] A? AWSDNs-06.net. (42)
23:32:36.481746 IP 199.249.120.1.53 > 192.168.1.100.51828: 47176- 0/8/9 (813)
23:32:36.482364 IP 192.168.1.100.12755 > 205.251.192.145.53: 56712% [1au] A? nS-1162.AwSDns-17.oRg. (50)
23:32:36.482408 IP 199.249.112.1.53 > 192.168.1.100.14763: 42940- 0/8/9 (813)
23:32:36.482812 IP 192.168.1.100.44549 > 205.251.198.81.53: 9274% [1au] A? nS-1162.awsDns-17.oRG. (50)
23:32:36.491903 IP 205.251.193.59.53 > 192.168.1.100.27864: 23669*-$ 1/4/1 CNAME d.v.drOpBoX.Com. (197)
23:32:36.492389 IP 156.154.101.3.53 > 192.168.1.100.16570: 4969- 0/8/9 (847)
23:32:36.492405 IP 192.168.1.100.61627 > 205.251.193.59.53: 29566% [1au] A? V.DRoPBOx.CoM. (42)
23:32:36.493271 IP 192.168.1.100.36746 > 192.31.80.30.53: 59140% [1au] A? AWsdNs-39.com. (42)
23:32:36.494477 IP 192.168.1.100.15273 > 205.251.195.179.53: 20606% [1au] A? nS-1949.AWSDNS-51.Co.Uk. (52)
23:32:36.502751 IP 213.248.216.1.53 > 192.168.1.100.23109: 36940- 0/8/9 (837)
23:32:36.503953 IP 192.168.1.100.28608 > 205.251.197.246.53: 42405% [1au] A? ns-1949.AwsDNs-51.cO.Uk. (52)
23:32:36.506448 IP 192.42.93.30.53 > 192.168.1.100.59760: 55999- 0/8/9 (861)
23:32:36.507385 IP 192.168.1.100.6680 > 205.251.199.134.53: 31950% [1au] A? nS-564.aWSDNs-06.net. (49)
23:32:36.509699 IP 205.251.192.145.53 > 192.168.1.100.12755: 56712*-$ 1/4/9 A 205.251.196.138 (336)
23:32:36.510037 IP 192.168.1.100.55443 > 205.251.192.145.53: 39380% [1au] AAAA? nS-1162.AWSdns-17.orG. (50)
23:32:36.510172 IP 205.251.198.81.53 > 192.168.1.100.44549: 9274*-$ 1/4/9 A 205.251.196.138 (336)
23:32:36.519680 IP 205.251.193.59.53 > 192.168.1.100.61627: 29566-$ 0/4/1 (178)
23:32:36.520251 IP 192.168.1.100.11122 > 205.251.199.160.53: 28468% [1au] A? NS-773.AwSdns-32.Net. (49)
23:32:36.520448 IP 192.168.1.100.59465 > 199.249.112.1.53: 48590% [1au] A? AwSDNs-31.ORg. (42)
23:32:36.520743 IP 192.168.1.100.16921 > 199.249.120.1.53: 62786% [1au] A? AwsDNs-31.Org. (42)
23:32:36.520953 IP 192.168.1.100.23504 > 156.154.101.3.53: 7949% [1au] A? awSdNS-48.Co.UK. (44)
23:32:36.521161 IP 192.168.1.100.45345 > 156.154.102.3.53: 29589% [1au] A? AWSDnS-48.CO.Uk. (44)
23:32:36.521322 IP 192.168.1.100.39618 > 205.251.195.34.53: 5672% [1au] A? ns-773.AWSdns-32.net. (49)
23:32:36.535193 IP 205.251.199.134.53 > 192.168.1.100.6680: 31950*-$ 1/4/9 A 205.251.194.52 (335)
23:32:36.535706 IP 192.168.1.100.18491 > 205.251.193.199.53: 25447% [1au] AAAA? NS-564.aWSdNs-06.nEt. (49)
23:32:36.535939 IP 205.251.195.179.53 > 192.168.1.100.15273: 20606*-$ 1/4/9 A 205.251.199.157 (338)
23:32:36.536966 IP 192.168.1.100.10916 > 205.251.199.55.53: 51224% [1au] A? Ns-1949.aWsDns-51.Co.UK. (52)
23:32:36.537152 IP 199.249.112.1.53 > 192.168.1.100.59465: 48590- 0/8/9 (813)
23:32:36.537487 IP 192.168.1.100.9660 > 205.251.198.95.53: 28231% [1au] A? ns-1276.awsdNS-31.ORG. (50)
23:32:36.537979 IP 199.249.120.1.53 > 192.168.1.100.16921: 62786- 0/8/9 (813)
23:32:36.538078 IP 205.251.192.145.53 > 192.168.1.100.55443: 39380*-$ 1/4/9 AAAA 2600:9000:5304:8a00::1 (348)
23:32:36.538292 IP 192.168.1.100.46154 > 205.251.192.159.53: 28859% [1au] A? Ns-1276.AWSdNS-31.ORG. (50)
23:32:36.539887 IP 192.26.92.30.53 > 192.168.1.100.51343: 56472- 0/8/9 (861)
23:32:36.540192 IP 192.168.1.100.40347 > 205.251.199.134.53: 24524% [1au] A? NS-564.aWsdns-06.net. (49)
23:32:36.547651 IP 205.251.199.160.53 > 192.168.1.100.11122: 28468*-$ 1/4/9 A 205.251.195.5 (335)
23:32:36.548079 IP 192.168.1.100.59201 > 205.251.193.225.53: 16234% [1au] AAAA? ns-773.AwsDNS-32.NET. (49)
23:32:36.548560 IP 156.154.101.3.53 > 192.168.1.100.23504: 7949- 0/8/9 (852)
23:32:36.549441 IP 192.168.1.100.62503 > 205.251.195.176.53: 57498% [1au] A? Ns-1926.AWsdnS-48.co.uK. (52)
23:32:36.553890 IP 156.154.102.3.53 > 192.168.1.100.45345: 29589- 0/8/9 (852)
23:32:36.554483 IP 192.168.1.100.48277 > 205.251.197.243.53: 61287% [1au] A? ns-1926.awsDns-48.Co.Uk. (52)
23:32:36.555710 IP 205.251.197.246.53 > 192.168.1.100.28608: 42405*-$ 1/4/9 A 205.251.199.157 (338)
23:32:36.556930 IP 192.168.1.100.40769 > 205.251.197.246.53: 27349% [1au] AAAA? NS-1949.awSDns-51.co.uk. (52)
23:32:36.561701 IP 205.251.195.34.53 > 192.168.1.100.39618: 5672*-$ 1/4/9 A 205.251.195.5 (335)
23:32:36.562198 IP 192.168.1.100.11269 > 205.251.195.5.53: 4430% [1au] A? D.V.dROPbOx.COM. (44)
23:32:36.563509 IP 205.251.193.199.53 > 192.168.1.100.18491: 25447*-$ 1/4/9 AAAA 2600:9000:5302:3400::1 (347)
23:32:36.564422 IP 205.251.199.55.53 > 192.168.1.100.10916: 51224*-$ 1/4/9 A 205.251.199.157 (338)
23:32:36.564555 IP 205.251.198.95.53 > 192.168.1.100.9660: 28231*-$ 1/4/9 A 205.251.196.252 (336)
23:32:36.564859 IP 192.168.1.100.47203 > 205.251.195.179.53: 47813% [1au] A? nS-1949.awSdns-51.Co.UK. (52)
23:32:36.565603 IP 192.168.1.100.18061 > 205.251.194.225.53: 63207% [1au] AAAA? nS-1276.AWSDNs-31.oRG. (50)
23:32:36.565731 IP 205.251.192.159.53 > 192.168.1.100.46154: 28859*-$ 1/4/9 A 205.251.196.252 (336)
23:32:36.567885 IP 205.251.199.134.53 > 192.168.1.100.40347: 24524*-$ 1/4/9 A 205.251.194.52 (335)
23:32:36.569632 IP 192.31.80.30.53 > 192.168.1.100.36746: 59140- 0/8/9 (860)
23:32:36.570030 IP 192.168.1.100.30141 > 205.251.196.167.53: 37288% [1au] A? NS-315.aWsdNs-39.cOm. (49)
23:32:36.575900 IP 205.251.193.225.53 > 192.168.1.100.59201: 16234*-$ 1/4/9 AAAA 2600:9000:5303:500::1 (347)
23:32:36.576179 IP 192.168.1.100.25615 > 205.251.195.34.53: 64086% [1au] AAAA? ns-773.AwsDnS-32.nEt. (49)
23:32:36.589695 IP 205.251.195.176.53 > 192.168.1.100.62503: 57498*-$ 1/4/9 A 205.251.199.134 (338)
23:32:36.590380 IP 192.168.1.100.17744 > 205.251.193.112.53: 18937% [1au] A? Ns-1926.AWsDNs-48.co.Uk. (52)
23:32:36.602502 IP 205.251.195.5.53 > 192.168.1.100.11269: 4430*-$ 2/4/1 CNAME d-edge.V.dROPbOx.COM., A 162.125.6.20 (217)
23:32:36.603032 IP 192.168.1.100.22424 > 205.251.199.134.53: 38086% [1au] A? d-EDge.v.Dropbox.CoM. (49)
23:32:36.603736 IP 192.168.1.100.25993 > 192.54.112.30.53: 2085% [1au] A? awsdns-07.cOM. (42)
23:32:36.603962 IP 192.168.1.100.46211 > 192.48.79.30.53: 10639% [1au] A? awsdnS-07.coM. (42)
23:32:36.606398 IP 205.251.195.179.53 > 192.168.1.100.47203: 47813*-$ 1/4/9 A 205.251.199.157 (338)
23:32:36.606551 IP 205.251.197.243.53 > 192.168.1.100.48277: 61287*-$ 1/4/9 A 205.251.199.134 (338)
23:32:36.607011 IP 192.168.1.100.45623 > 205.251.195.176.53: 10997% [1au] AAAA? NS-1926.AwsDns-48.Co.uK. (52)
23:32:36.607138 IP 205.251.194.225.53 > 192.168.1.100.18061: 63207*-$ 1/4/9 AAAA 2600:9000:5304:fc00::1 (348)
23:32:36.607971 IP 192.168.1.100.26479 > 205.251.198.95.53: 14575% [1au] AAAA? nS-1276.aWSDnS-31.orG. (50)
100 packets captured
100 packets received by filter
0 packets dropped by kernel

trendy · 6 July 2021 07:29

There is a successful resolution here:

23:31:01.926780 IP 192.168.1.2.58750 > 192.168.1.100.53: 43059+ A? secure20.sync.com. (35)
23:31:01.928565 IP 192.168.1.100.16245 > 205.251.198.27.53: 12762% [1au] A? SecuRe20.SYnC.COm. (46)
23:31:01.929035 IP 192.168.1.100.53 > 192.168.1.2.58750: 43059 4/0/0 A 34.202.86.107, A 50.17.80.65, A 52.21.182.194, A 50.17.142.229 (99)
23:31:01.957406 IP 205.251.198.27.53 > 192.168.1.100.16245: 12762*-$ 4/4/1 A 52.21.182.194, A 34.202.86.107, A 50.17.80.65, A 50.17.142.229 (247)

Another one later for dropbox just got ignored. Are you certain that you have not miconfigured the Adguard?

Joulinar · 6 July 2021 08:13

trendy
What is missing in the tcpdump capture is the communication between AGH and Unbound. I thought we disabled Unbound before but it’s seems still active. Therefore you are not able to edit the Upstream DNS Rhizome

Let’s verify. can you post content of your AGH config file AdGuardHome.yaml

cat /mnt/dietpi_userdata/adguardhome/AdGuardHome.yaml

Anyway, your issue was caused by your UFW. You would need to allow DNS traffic on UFW

Rhizome · 6 July 2021 12:15

Here’s the AdGuardHome.yaml config file contents (didn’t include the pswd or ids for the PC named “DESKTOP”):

bind_host: 0.0.0.0
bind_port: 8083
beta_bind_port: 0
users:
- name: admin
  password: xxxx
auth_attempts: 5
block_auth_min: 15
http_proxy: ""
language: ""
rlimit_nofile: 0
debug_pprof: false
web_session_ttl: 720
dns:
  bind_hosts:
  - 0.0.0.0
  port: 53
  statistics_interval: 1
  querylog_enabled: true
  querylog_file_enabled: true
  querylog_interval: 7
  querylog_size_memory: 1000
  anonymize_client_ip: false
  protection_enabled: true
  blocking_mode: default
  blocking_ipv4: ""
  blocking_ipv6: ""
  blocked_response_ttl: 10
  parental_block_host: family-block.dns.adguard.com
  safebrowsing_block_host: standard-block.dns.adguard.com
  ratelimit: 20
  ratelimit_whitelist: []
  refuse_any: true
  upstream_dns:
  - https://dns10.quad9.net/dns-query
  upstream_dns_file: /mnt/dietpi_userdata/adguardhome/dietpi-unbound.conf
  bootstrap_dns:
  - 9.9.9.10
  - 149.112.112.10
  - 2620:fe::10
  - 2620:fe::fe:10
  all_servers: false
  fastest_addr: false
  allowed_clients: []
  disallowed_clients: []
  blocked_hosts:
  - version.bind
  - id.server
  - hostname.bind
  cache_size: 4194304
  cache_ttl_min: 0
  cache_ttl_max: 0
  bogus_nxdomain: []
  aaaa_disabled: false
  enable_dnssec: false
  edns_client_subnet: false
  max_goroutines: 300
  ipset: []
  filtering_enabled: true
  filters_update_interval: 24
  parental_enabled: false
  safesearch_enabled: false
  safebrowsing_enabled: false
  safebrowsing_cache_size: 1048576
  safesearch_cache_size: 1048576
  parental_cache_size: 1048576
  cache_time: 30
  rewrites: []
  blocked_services: []
  local_domain_name: lan
  resolve_clients: true
  local_ptr_upstreams: []
tls:
  enabled: false
  server_name: ""
  force_https: false
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 784
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  allow_unencrypted_doh: false
  strict_sni_check: false
  certificate_chain: ""
  private_key: ""
  certificate_path: ""
  private_key_path: ""
filters:
- enabled: true
  url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
  name: AdGuard DNS filter
  id: 1
- enabled: true
  url: https://adaway.org/hosts.txt
  name: AdAway Default Blocklist
  id: 1625143630
whitelist_filters: []
user_rules: []
dhcp:
  enabled: false
  interface_name: eth0
  dhcpv4:
    gateway_ip: 192.168.1.1
    subnet_mask: 255.255.255.0
    range_start: 192.168.1.110
    range_end: 192.168.1.254
    lease_duration: 86400
    icmp_timeout_msec: 1000
    options: []
  dhcpv6:
    range_start: ""
    lease_duration: 86400
    ra_slaac_only: false
    ra_allow_slaac: false
clients:
- name: DESKTOP
  tags:
  - device_pc
  ids:
  - xxxx
  use_global_settings: true
  filtering_enabled: false
  parental_enabled: false
  safesearch_enabled: false
  safebrowsing_enabled: false
  use_global_blocked_services: true
  blocked_services: []
  upstreams: []

Joulinar · 6 July 2021 23:26

indeed Unbound is still active.

upstream_dns_file: /mnt/dietpi_userdata/adguardhome/dietpi-unbound.conf

That’s totally fine as this was your intention anyway.

Only thing left is to configure your UFW firewall to allow DNS traffic.

Rhizome · 7 July 2021 04:11

Thanks Joulinar,
For UFW is the DNS to allow, the one found in the unbound.conf file?

Joulinar · 7 July 2021 05:32

Not sure what you mean but setting UFW has nothing to do with AGH or unbound directly. You simply need to allow income traffic from local network on port 53.