[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

LimpingK · 2025-01-30T19:23:08Z

В первые минуты посте установки и запуска в nfqws.log появляются строки.
Смотрю в web-интерфейсе. Но когда набирается десяток строк за первые минуты, лог становится пустой. Я сначала думал, что проблема с веб-интерфейсом.
Но собственно файл тоже пустой, 0b.
Остальные файлы,
nfqws.conf
user.list
exclude.list
auto.list

сохраняю из веб-интерфейса нормально.

GL.iNet GL-MT3000
OpenWrt 21.02-SNAPSHOT r15812+908-46b6ee7ffc / LuCI openwrt-21.02 branch git-22.245.77575-63bfee6
Kernel Version 5.4.211

Провайдер
Повторяется в разных случаях: USB-модем, Repeater WiFi, ethernet.

Выполните команды и приложите их вывод
opkg info nfqws-keenetic

root@GL-MT3000:~# opkg info nfqws-keenetic
Package: nfqws-keenetic
Version: 2.7.6
Depends: libc, iptables, iptables-mod-extra, iptables-mod-nfqueue, iptables-mod-filter, iptables-mod-ipopt, iptables-mod-conntrack-extra, ip6tables, ip6tables-mod-nat, ip6tables-extra
Conflicts: tpws-keenetic
Status: install user installed
Architecture: all
Conffiles:
 /etc/nfqws/auto.list e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 /etc/nfqws/exclude.list 7b1d1ef573fe736f132520989a4b8534c611c0a7fdc9d10c323f4589f5e99e94
 /etc/nfqws/nfqws.conf 0e435265380ff191db056cea27e2472ab74cd8e3ef4d3facb994cf69e121393c
 /etc/nfqws/user.list 45dc2adaa172b86d73369c6ed12a8a0e648b851b66293b11514c3b1d4bd3fce6
Installed-Time: 1738174256

/opt/etc/init.d/S51nfqws restart

root@GL-MT3000:~# /etc/init.d/S51nfqws restart
-ash: /etc/init.d/S51nfqws: not found

cat /opt/etc/nfqws/nfqws.conf

root@GL-MT3000:~# cat /etc/nfqws/nfqws.conf
# Provider network interface, e.g. eth3
# You can specify multiple interfaces separated by space, e.g. ISP_INTERFACE="eth3 nwg1"
ISP_INTERFACE="eth2 eth1 br-lan"

# All arguments here: https://github.com/bol-van/zapret (search for `nfqws` on the page)
# HTTP(S) strategy
NFQWS_ARGS="--dpi-desync=fake --dpi-desync-ttl=12 --dpi-desync-fake-http=0x00000000"

# QUIC strategy
NFQWS_ARGS_QUIC="--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=/etc/nfqws/quic_initial.bin"

# UDP strategy (doesn't use lists from NFQWS_EXTRA_ARGS)
NFQWS_ARGS_UDP="--filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-repeats=6 --dpi-desync-cutoff=n2"

# auto - automatically detects blocked resources and adds them to the auto.list
NFQWS_EXTRA_ARGS="--hostlist=/etc/nfqws/user.list --hostlist-auto=/etc/nfqws/auto.list --hostlist-auto-debug=/var/log/nfqws.log --hostlist-exclude=/etc/nfqws/exclude.list"

# list - applies rules only to domains in the user.list
#NFQWS_EXTRA_ARGS="--hostlist=/etc/nfqws/user.list"

# all  - applies rules to all traffic except domains from exclude.list
#NFQWS_EXTRA_ARGS="--hostlist-exclude=/etc/nfqws/exclude.list"

# IPv6 support
IPV6_ENABLED=0

# TCP ports for iptables rules
TCP_PORTS=443

# UDP ports for iptables rules
UDP_PORTS=443,50000:50099

# Keenetic policy name
POLICY_NAME="nfqws"
# Policy mode (0 - include, 1 - exclude)
POLICY_EXCLUDE=0

# Syslog logging level (0 - silent, 1 - debug)
LOG_LEVEL=0

NFQUEUE_NUM=200
USER=nobody
CONFIG_VERSION=5

ps | grep nfqws

root@GL-MT3000:~# ps | grep nfqws
 4787 nobody     660 S    /usr/bin/nfqws --user=nobody --qnum=200 --bind-fix4 --filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-p
20627 root      1232 S    grep nfqws

iptables-save | grep 200

root@GL-MT3000:~# iptables-save | grep 200
-A OUTPUT -m owner --gid-owner 20000 -m comment --comment "!fw3: process_explict_vpn" -j MARK --set-xmark 0x20000/0x20000
-A POSTROUTING -o eth2 -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth2 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth2 -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth2 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth1 -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth1 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth1 -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth1 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o br-lan -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o br-lan -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o br-lan -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o br-lan -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass

sysctl net.netfilter.nf_conntrack_checksum

root@GL-MT3000:~# sysctl net.netfilter.nf_conntrack_checksum
net.netfilter.nf_conntrack_checksum = 0

The text was updated successfully, but these errors were encountered:

vemneyy · 2025-02-10T21:45:06Z

Такое ощущение, что проблема смежная c #141

LimpingK · 2025-02-11T04:10:15Z

Такое ощущение, что проблема смежная c #141

Ох, спасибо!
На второй месяц Зоркий глаз заметил, что LOG_LEVEL=0 [рыдает]
переделаю сегодня на LOG_LEVEL=1

LimpingK · 2025-02-11T06:36:36Z

P.S. Нет, выставил

# Syslog logging level (0 - silent, 1 - debug)
LOG_LEVEL=1

но всё равно nfqws.log остаётся пустой.
При этом сабж точно работает, на yota играет yputube.

LimpingK · 2025-02-11T10:59:49Z

Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:49004 dst=142.250.181.170:443
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 48 04 23 D9 D8 81 3D 03 7C 55 C7 31 EF A4 5B 93 53 41 3B 73 A4 ... : ........�..H.#...=.|U.1..[.SA;s. ...
Tue Feb 11 13:57:10 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:10 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:10 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:10 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: packet: id=136978 drop
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: packet: id=136979 len=60 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 192.178.24.170 proto=tcp ttl=62 sport=49060 dport=443 flags=S seq=3055924087 ack_seq=0
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: desync profile search for tcp target=192.178.24.170:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:10 2025 user.debug nfqws[17427]: packet: id=136979 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136980 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 192.178.24.170 proto=tcp ttl=62 sport=49060 dport=443 flags=A seq=3055924088 ack_seq=4261219264
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136980 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136981 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 192.178.24.170 proto=tcp ttl=62 sport=49060 dport=443 flags=AP seq=3055924088 ack_seq=4261219264
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 EB 76 43 0A 7A E9 59 E2 65 B5 DD 4D E3 CE 65 AA CC 31 5E 95 50 ... : ............vC.z.Y.e..M..e..1^.P ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: req retrans : seq interval 3055924088-3055924604
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostname: firebaseinstallations.googleapis.com
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=192.178.24.170:443 l7proto=tls hostname='firebaseinstallations.googleapis.com'
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:49060 dst=192.178.24.170:443
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 C3 D9 2B C6 24 DF 40 2F F2 F7 13 84 9B C2 45 39 4E F7 40 E5 3D ... : ........�....+.$.@/......E9N.@.= ...
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136981 drop
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136982 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=S seq=1228169023 ack_seq=0
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.163.59.251:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136982 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136983 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=A seq=1228169024 ack_seq=2975168363
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136983 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136984 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=AP seq=1228169024 ack_seq=2975168363
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 3E 9E BD 5D 57 BE 1F A9 04 BC E1 89 8D B7 D4 EB 86 86 75 32 66 ... : ...........>..]W.............u2f ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: req retrans : seq interval 1228169024-1228169540
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostname: cloud.radar.imgsmail.ru
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.163.59.251:443 l7proto=tls hostname='cloud.radar.imgsmail.ru'
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: not applying tampering to this request
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136984 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136985 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=A seq=1228169541 ack_seq=2975168520
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136985 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136986 len=103 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=AP seq=1228169541 ack_seq=2975168520
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=51 : 14 03 03 00 01 01 16 03 03 00 28 D7 52 DD E9 95 C4 F1 B8 94 D0 F0 83 CB 1D 86 83 B7 BB 1B 27 CF ... : ..........(.R.................'. ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: req retrans : tcp seq 1228169541 not within the req range 1228169024-1228169540. stop tracking.
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136986 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136987 len=315 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=AP seq=1228169592 ack_seq=2975168520
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=263 : 17 03 03 01 02 D7 52 DD E9 95 C4 F1 B9 C2 9B DD C9 1D BC 02 91 D6 43 F0 0E CA 3D 56 5A 6D 48 05 ... : ......R...............C...=VZmH. ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136987 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136988 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=A seq=1228169855 ack_seq=2975168950
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136988 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136989 len=327 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.251 proto=tcp ttl=62 sport=63803 dport=443 flags=AP seq=1228169855 ack_seq=2975168950
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=275 : 17 03 03 01 0E D7 52 DD E9 95 C4 F1 BA B8 CB D5 24 22 A2 7E AC 4E 4B E2 71 A9 D5 F0 C8 B7 26 A2 ... : ......R.........$".~.NK.q.....&. ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136989 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136990 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=S seq=1921303854 ack_seq=0
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.161.76.101:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136990 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136991 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=A seq=1921303855 ack_seq=3794345391
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136991 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136992 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=AP seq=1921303855 ack_seq=3794345391
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 02 AA 30 47 32 62 62 B3 24 40 D2 1E 9C F1 D8 E4 7E 10 3F AC 7E ... : .............0G2bb.$@......~.?.~ ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: req retrans : seq interval 1921303855-1921304371
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostname: www.google.com
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.161.76.101:443 l7proto=tls hostname='www.google.com'
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for www.google.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for google.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for www.google.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for google.com : positive
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:63804 dst=95.161.76.101:443
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 C9 D6 07 86 AE 12 BB CE 1B 0A 4A D5 01 08 69 01 8A BA 3E DB 7A ... : ........�............J...i...>.z ...
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136992 drop
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136993 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 192.178.24.170 proto=tcp ttl=62 sport=49060 dport=443 flags=AP seq=3055924088 ack_seq=4261219264
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 EB 76 43 0A 7A E9 59 E2 65 B5 DD 4D E3 CE 65 AA CC 31 5E 95 50 ... : ............vC.z.Y.e..M..e..1^.P ...
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostname: firebaseinstallations.googleapis.com
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for firebaseinstallations.googleapis.com : negative
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:49060 dst=192.178.24.170:443
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 ED D1 5D 15 B3 85 08 DC A7 EA B4 8D 71 DD 31 A5 F2 68 EC D9 3D ... : ........�....].........q.1..h..= ...
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:11 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136993 drop
Tue Feb 11 13:57:11 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136994 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=A seq=1921304372 ack_seq=3794345391
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136994 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136995 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=A seq=1921304372 ack_seq=3794345391
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136995 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136996 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63804 dport=443 flags=A seq=1921304372 ack_seq=3794345391
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136996 pass unmodified
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136997 len=60 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.180.42 proto=tcp ttl=62 sport=41546 dport=443 flags=S seq=4029119181 ack_seq=0
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile search for tcp target=142.250.180.42:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:11 2025 user.debug nfqws[17427]: packet: id=136997 pass unmodified
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=136998 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.180.42 proto=tcp ttl=62 sport=41546 dport=443 flags=A seq=4029119182 ack_seq=288503872
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=136998 pass unmodified
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=136999 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.180.42 proto=tcp ttl=62 sport=41546 dport=443 flags=AP seq=4029119182 ack_seq=288503872
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 12 31 01 3A 1D B9 28 40 40 ED 1C BB 99 D9 9E 35 45 A7 69 79 7B ... : ............1.:..(@@......5E.iy{ ...
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: req retrans : seq interval 4029119182-4029119698
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostname: people-pa.googleapis.com
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: desync profile search for tcp target=142.250.180.42:443 l7proto=tls hostname='people-pa.googleapis.com'
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:41546 dst=142.250.180.42:443
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 DB 60 A8 BF 12 53 82 4B 5C 4D 83 30 B3 F0 4F B6 6F 0A F0 B4 F5 ... : ........�...`...S.K\M.0..O.o.... ...
Tue Feb 11 13:57:12 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:12 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=136999 drop
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=137000 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.180.42 proto=tcp ttl=62 sport=41546 dport=443 flags=AP seq=4029119182 ack_seq=288503872
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 12 31 01 3A 1D B9 28 40 40 ED 1C BB 99 D9 9E 35 45 A7 69 79 7B ... : ............1.:..(@@......5E.iy{ ...
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostname: people-pa.googleapis.com
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:41546 dst=142.250.180.42:443
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 46 D3 76 11 63 F9 A2 20 F9 41 17 EA F1 D6 69 4C 07 9F E6 01 59 ... : ........�..F.v.c.. .A....iL....Y ...
Tue Feb 11 13:57:12 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:12 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:12 2025 user.debug nfqws[17427]: packet: id=137000 drop
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137001 len=1278 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=1250 : CC 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 40 47 00 D6 B3 54 A0 86 E2 CD C2 DF 66 B8 D7 C4 02 ... : .......U.\[email protected].... ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: desync profile search for udp target=142.250.201.131:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: desync profile 2 matches
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains QUIC initial
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains partial TLS ClientHello
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: starting reassemble. now we have 1143/16384
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: DELAY desync until reasm is complete (#1)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: applying linux postnat conntrack workaround
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137001 pass modified. len=28
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137002 len=1278 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=1250 : C2 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 40 47 00 D6 B3 54 A0 86 E2 CD C2 DF 66 B8 D7 C4 02 ... : .......U.\[email protected].... ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: using cached desync profile 2
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains QUIC initial
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: reassemble : feeding data payload size=1143. now we have 2286/16384
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: DELAY desync until reasm is complete (#2)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: REPLAYING delayed packet #1 offset 0
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: REPLAY IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=1250 : CC 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 40 47 00 D6 B3 54 A0 86 E2 CD C2 DF 66 B8 D7 C4 02 ... : .......U.\[email protected].... ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: using cached desync profile 2
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains QUIC initial
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostname: ssl.gstatic.com
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: desync profile search for udp target=142.250.201.131:443 l7proto=quic hostname='ssl.gstatic.com'
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: desync profile 2 matches
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: * hostlist check for profile 2
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for ssl.gstatic.com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostlist check for gstatic.com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for ssl.gstatic.com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostlist check for gstatic.com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for ssl.gstatic.com : negative
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: hostlist check for gstatic.com : positive
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:54507 dst=142.250.201.131:443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: sending fake : C3 00 00 00 01 08 78 E7 98 46 BB F3 79 84 00 00 44 9E B2 E2 1B 4D 8B CC 2F C9 3E EF 81 49 95 4A ... : ......x..F..y...D....M../.>..I.J ...
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: reinjecting original packet. len=1278 len_payload=1250
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: DROPPING delayed packet #1
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: REPLAYING delayed packet #2 offset 1250
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: REPLAY IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=1250 : C2 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 40 47 00 D6 B3 54 A0 86 E2 CD C2 DF 66 B8 D7 C4 02 ... : .......U.\[email protected].... ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: SENDING delayed packet #2 unmodified
Tue Feb 11 13:57:15 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: reassemble session finished
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137002 drop
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137003 len=107 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=79 : DC 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 40 3E 83 2F 0D 20 D7 05 83 84 1C 10 97 DB EA 9A 39 ... : .......U.\.K...@>./. ..........9 ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: using cached desync profile 2
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137003 pass unmodified
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137004 len=592 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 142.250.201.131 proto=udp ttl=62 sport=54507 dport=443
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: UDP: len=564 : D0 00 00 00 01 08 A5 55 03 5C C4 4B 92 EC 00 42 23 7C 29 A3 4C D7 EB 9B 3D 8A FA 4B C7 2A C7 C3 ... : .......U.\.K...B#|).L...=..K.*.. ...
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: using cached desync profile 2
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137004 pass unmodified
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137005 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: IP4: 192.168.9.248 => 76.76.2.22 proto=tcp ttl=63 sport=65497 dport=443 flags=A seq=2647772786 ack_seq=2416056258
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:15 2025 user.debug nfqws[17427]: packet: id=137005 pass unmodified
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137006 len=60 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 172.217.18.138 proto=tcp ttl=62 sport=41802 dport=443 flags=S seq=3063944039 ack_seq=0
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: desync profile search for tcp target=172.217.18.138:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137006 pass unmodified
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137007 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 172.217.18.138 proto=tcp ttl=62 sport=41802 dport=443 flags=A seq=3063944040 ack_seq=3759416263
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137007 pass unmodified
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137008 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 172.217.18.138 proto=tcp ttl=62 sport=41802 dport=443 flags=AP seq=3063944040 ack_seq=3759416263
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 70 EE 7F 9B D3 48 90 F6 4C E3 F1 98 1B 90 E3 79 17 00 47 CC CA ... : ...........p.�..H..L......y..G.. ...
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: req retrans : seq interval 3063944040-3063944556
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostname: people-pa.googleapis.com
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: desync profile search for tcp target=172.217.18.138:443 l7proto=tls hostname='people-pa.googleapis.com'
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:41802 dst=172.217.18.138:443
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 0D B8 7C 2E 65 9B 06 FA 93 18 56 72 6F 46 9B B7 3D 74 C8 04 BF ... : ........�....|.e.....VroF..=t... ...
Tue Feb 11 13:57:16 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:16 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137008 drop
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137009 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 172.217.18.138 proto=tcp ttl=62 sport=41802 dport=443 flags=AP seq=3063944040 ack_seq=3759416263
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 70 EE 7F 9B D3 48 90 F6 4C E3 F1 98 1B 90 E3 79 17 00 47 CC CA ... : ...........p.�..H..L......y..G.. ...
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostname: people-pa.googleapis.com
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for people-pa.googleapis.com : negative
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: hostlist check for googleapis.com : positive
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:41802 dst=172.217.18.138:443
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 4C B8 B6 F2 6E D4 DF D0 0C 65 DD 1A 7A 88 49 D9 A6 1F 39 A6 28 ... : ........�..L...n....e..z.I...9.( ...
Tue Feb 11 13:57:16 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:16 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:16 2025 user.debug nfqws[17427]: packet: id=137009 drop
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137010 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=S seq=685943278 ack_seq=0
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.161.76.101:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137010 pass unmodified
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137011 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=A seq=685943279 ack_seq=749398694
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137011 pass unmodified
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137012 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=AP seq=685943279 ack_seq=749398694
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 32 B4 31 01 6C C2 56 AD 05 34 7A 53 11 5A C6 1D C6 AE B2 4A E7 ... : ...........2.1.l.V..4zS.Z.....J. ...
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: req retrans : seq interval 685943279-685943795
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: hostname: www.google.com
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.161.76.101:443 l7proto=tls hostname='www.google.com'
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for www.google.com : negative
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: hostlist check for google.com : negative
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: hostlist check for com : negative
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for www.google.com : negative
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: hostlist check for google.com : positive
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: dpi desync src=192.168.9.140:63808 dst=95.161.76.101:443
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 C4 5A 15 AC F0 C0 D0 BF F3 C6 6B 49 1A 99 99 E6 A4 EF 42 5C 0D ... : ........�...Z........kI......B\. ...
Tue Feb 11 13:57:17 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:17 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: reinjecting original packet. len=569 len_payload=517
Tue Feb 11 13:57:17 2025 user.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137012 drop
Tue Feb 11 13:57:17 2025 daemon.err nfqws[17427]: rawsend: bind (ignoring): Address not available
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137013 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=A seq=685943796 ack_seq=749398694
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137013 pass unmodified
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137014 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=A seq=685943796 ack_seq=749398694
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137014 pass unmodified
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137015 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.161.76.101 proto=tcp ttl=62 sport=63808 dport=443 flags=A seq=685943796 ack_seq=749398694
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:17 2025 user.debug nfqws[17427]: packet: id=137015 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137016 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=S seq=1525048984 ack_seq=0
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile search for tcp target=149.112.112.112:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137016 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137017 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=AP seq=1525048985 ack_seq=3430047515
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 FF 23 47 7C B0 F2 CF 6A A7 FB EC 3D 21 C6 69 F7 88 93 F8 02 AD ... : ............#G|...j...=!.i...... ...
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: req retrans : seq interval 1525048985-1525049501
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostname: dns.quad9.net
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile search for tcp target=149.112.112.112:443 l7proto=tls hostname='dns.quad9.net'
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for dns.quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for dns.quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for dns.quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for quad9.net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for net : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: not applying tampering to this request
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137017 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137018 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=A seq=1525049502 ack_seq=3430050211
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137018 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137019 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=A seq=1525049502 ack_seq=3430051122
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137019 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137020 len=132 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=AP seq=1525049502 ack_seq=3430051122
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: TCP: len=80 : 14 03 03 00 01 01 17 03 03 00 45 4D EE 0A F5 E6 2E 94 C7 38 C6 CF 55 F8 0E 29 F7 BA BE A1 E9 31 ... : ..........EM.......8..U..).....1 ...
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: req retrans : tcp seq 1525049502 not within the req range 1525048985-1525049501. stop tracking.
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137020 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137021 len=349 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=AP seq=1525049582 ack_seq=3430051122
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: TCP: len=297 : 17 03 03 01 24 4E 2D DD AE 71 87 F1 D8 CF 10 C2 F6 F0 C3 7A 03 1D 0F 96 E5 E3 E9 CC 86 B5 4F 7B ... : ....$N-..q.........z..........O{ ...
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137021 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137022 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=A seq=1525049879 ack_seq=3430051664
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137022 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137023 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 149.112.112.112 proto=tcp ttl=62 sport=63110 dport=443 flags=A seq=1525049879 ack_seq=3430051912
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137023 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137024 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=S seq=3829705485 ack_seq=0
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.163.59.244:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137024 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137025 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=A seq=3829705486 ack_seq=2513073082
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137025 pass unmodified
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137026 len=569 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=AP seq=3829705486 ack_seq=2513073082
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 E8 19 03 D3 DC EF 4D D7 FF 77 D9 BD 16 C7 56 47 CD F6 57 37 AD ... : .................M..w....VG..W7. ...
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: req retrans : seq interval 3829705486-3829706002
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostname: cloud.radar.imgsmail.ru
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile search for tcp target=95.163.59.244:443 l7proto=tls hostname='cloud.radar.imgsmail.ru'
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for radar.imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for imgsmail.ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: hostlist check for ru : negative
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: not applying tampering to this request
Tue Feb 11 13:57:18 2025 user.debug nfqws[17427]: packet: id=137026 pass unmodified
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137027 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=A seq=3829706003 ack_seq=2513074430
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137027 pass unmodified
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137028 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=A seq=3829706003 ack_seq=2513075778
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137028 pass unmodified
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137029 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=A seq=3829706003 ack_seq=2513077405
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137029 pass unmodified
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137030 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=A seq=3829706003 ack_seq=2513077405
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137030 pass unmodified
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137031 len=178 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 95.163.59.244 proto=tcp ttl=62 sport=63811 dport=443 flags=AP seq=3829706003 ack_seq=2513077405
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: TCP: len=126 : 16 03 03 00 46 10 00 00 42 41 04 8A 3E 4C 06 C3 8D 48 21 DD 03 E1 FA 9A 92 B9 28 42 B9 27 F9 14 ... : ....F...BA..>L...H!.......(B.'.. ...
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: req retrans : tcp seq 3829706003 not within the req range 3829705486-3829706002. stop tracking.
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:19 2025 user.debug nfqws[17427]: packet: id=137031 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137032 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=S seq=2547124852 ack_seq=0
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: desync profile search for tcp target=104.22.75.213:443 l7proto=unknown hostname=''
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137032 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137033 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=A seq=2547124853 ack_seq=3491025666
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137033 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137034 len=240 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=AP seq=2547124853 ack_seq=3491025666
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: TCP: len=188 : 16 03 01 00 B7 01 00 00 B3 03 03 67 AB 2D 10 40 DC D0 87 A1 00 6F 06 AE EE F2 B6 ED 33 AA 75 1E ... : [email protected]. ...
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet contains full TLS ClientHello
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: req retrans : seq interval 2547124853-2547125040
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostname: api.imem.app
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: discovered l7 protocol
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: discovered hostname
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: desync profile search for tcp target=104.22.75.213:443 l7proto=tls hostname='api.imem.app'
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: desync profile 3 matches
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: * hostlist check for profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: [/etc/nfqws/exclude.list] exclude hostlist check for api.imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: [/etc/nfqws/auto.list] include hostlist check for api.imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: [/etc/nfqws/user.list] include hostlist check for api.imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for imem.app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: hostlist check for app : negative
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: not applying tampering to this request
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137034 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137035 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=A seq=2547125041 ack_seq=3491027014
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137035 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137036 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=A seq=2547125041 ack_seq=3491028693
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137036 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137037 len=178 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=AP seq=2547125041 ack_seq=3491028693
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: TCP: len=126 : 16 03 03 00 46 10 00 00 42 41 04 B0 F0 96 3C 62 85 74 42 27 CF B0 5A 4B 76 40 7E 0E 68 32 C5 08 ... : ....F...BA....<b.tB'..ZKv@~.h2.. ...
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: req retrans : tcp seq 2547125041 not within the req range 2547124853-2547125040. stop tracking.
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137037 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137038 len=52 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=A seq=2547125167 ack_seq=3491028813
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137038 pass unmodified
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137039 len=496 mark=00000000 ifin=(0) ifout=eth2(5)
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: IP4: 192.168.9.140 => 104.22.75.213 proto=tcp ttl=62 sport=63812 dport=443 flags=AP seq=2547125167 ack_seq=3491028813
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: TCP: len=444 : 17 03 03 01 B7 61 8C F7 74 A4 A4 39 2A 8F 12 D2 DE AB AC D4 A3 09 19 0B FF D5 B0 EA 90 F3 0E 68 ... : .....a..t..9*..................h ...
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: using cached desync profile 3
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: not applying tampering to unknown protocol
Tue Feb 11 13:57:20 2025 user.debug nfqws[17427]: packet: id=137039 pass unmodified

LimpingK · 2025-02-13T15:06:27Z

Вот правду говорят: четверг - рыбный день.
3 пары записей за рабочее время (за компьютером всё это время сидел)

13.02.2025 17:33:31 :  : profile 2 : client 192.168.9.139:61882 : proto quic : fail counter 1/3
13.02.2025 17:33:31 :  : profile 2 : client 192.168.9.139:61882 : proto quic : retrans threshold reached
13.02.2025 16:05:29 : app.franztodos.com : profile 2 : client 192.168.9.139:59570 : proto quic : fail counter 1/3
13.02.2025 16:05:29 : app.franztodos.com : profile 2 : client 192.168.9.139:59570 : proto quic : retrans threshold reached
13.02.2025 12:38:18 : calckey.dvd.moe : profile 2 : client 192.168.9.139:61531 : proto quic : fail counter 1/3
13.02.2025 12:38:18 : calckey.dvd.moe : profile 2 : client 192.168.9.139:61531 : proto quic : retrans threshold reached

LimpingK · 2025-02-17T07:33:31Z

И вот сейчас опять. После загрузки роутера.
Сначала три строчки в свой лог - и потом молчок:

17.02.2025 10:15:12 : dns.controld.com : profile 3 : client 192.168.9.248:63439 : proto tls : fail counter reset. website is working.
17.02.2025 10:15:11 : dns.controld.com : profile 3 : client 192.168.9.248:63436 : proto tls : fail counter 1/3
17.02.2025 10:15:11 : dns.controld.com : profile 3 : client 192.168.9.248:63436 : proto tls : retrans threshold reached

И после этого в System log:

Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40160 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40161 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53175 dport=443 flags=A seq=1802684440 ack_seq=1879350570
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40161 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40162 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53176 dport=443 flags=A seq=1395132356 ack_seq=3501515088
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40162 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40163 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53176 dport=443 flags=A seq=1395132356 ack_seq=3501515088
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40163 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40164 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53176 dport=443 flags=A seq=1395132356 ack_seq=3501515088
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40164 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40165 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=S seq=1254434307 ack_seq=0
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: desync profile search for tcp target=95.163.59.230:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40165 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40166 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=A seq=1254434308 ack_seq=3221786139
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40166 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40167 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=AP seq=1254434308 ack_seq=3221786139
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 67 17 4D 98 F1 BB A9 0D 5D 3A 32 27 67 A4 D9 2E 0E 8B E9 5E EA ... : ...........g.M.....]:2'g......^. ...
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: req retrans : seq interval 1254434308-1254434824
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostname: cloud.radar.imgsmail.ru
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: desync profile search for tcp target=95.163.59.230:443 l7proto=tls hostname='cloud.radar.imgsmail.ru'
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for cloud.radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: [/etc/nfqws/user.list] include hostlist check for cloud.radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for radar.imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for imgsmail.ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: hostlist check for ru : negative
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: not applying tampering to this request
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40167 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40168 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53175 dport=443 flags=A seq=1802684440 ack_seq=1879350570
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40168 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40169 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=A seq=1254434825 ack_seq=3221787499
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40169 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40170 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=A seq=1254434825 ack_seq=3221790462
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40170 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40171 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=A seq=1254434825 ack_seq=3221790462
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40171 pass unmodified
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40172 len=166 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=AP seq=1254434825 ack_seq=3221790462
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: TCP: len=126 : 16 03 03 00 46 10 00 00 42 41 04 FC 28 96 09 12 2E 22 E0 E4 E1 31 0A EF 38 9D E2 ED EC A1 EA 65 ... : ....F...BA..(...."...1..8......e ...
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: req retrans : tcp seq 1254434825 not within the req range 1254434308-1254434824. stop tracking.
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: not applying tampering to unknown protocol
Mon Feb 17 10:30:53 2025 user.debug nfqws[6224]: packet: id=40172 pass unmodified
Mon Feb 17 10:30:54 2025 user.debug nfqws[6224]: packet: id=40173 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:54 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 95.163.59.230 proto=tcp ttl=63 sport=50634 dport=443 flags=A seq=1254434951 ack_seq=3221790513
Mon Feb 17 10:30:54 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:54 2025 user.debug nfqws[6224]: packet: id=40173 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40174 len=60 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=S seq=3504517276 ack_seq=0
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=3.165.239.109:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40174 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40175 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=A seq=3504517277 ack_seq=3644289239
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40175 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40176 len=356 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=AP seq=3504517277 ack_seq=3644289239
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: TCP: len=316 : 16 03 01 01 37 01 00 01 33 03 03 61 3E CF 58 EA 31 87 AE 94 23 32 9A BD 32 B1 B7 33 33 41 57 01 ... : ....7...3..a>.X.1...#2..2..33AW. ...
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: req retrans : seq interval 3504517277-3504517592
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostname: fw.gl-inet.com
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=3.165.239.109:443 l7proto=tls hostname='fw.gl-inet.com'
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for fw.gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for fw.gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/user.list] include hostlist check for fw.gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for gl-inet.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: not applying tampering to this request
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40176 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40177 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=A seq=3504517593 ack_seq=3644290599
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40177 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40178 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=A seq=3504517593 ack_seq=3644291959
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40178 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40179 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=A seq=3504517593 ack_seq=3644293319
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40179 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40180 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=A seq=3504517593 ack_seq=3644293573
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40180 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40181 len=104 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.8.100 => 3.165.239.109 proto=tcp ttl=64 sport=38018 dport=443 flags=AP seq=3504517593 ack_seq=3644293573
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: TCP: len=64 : 14 03 03 00 01 01 17 03 03 00 35 01 47 0A DB AC 01 D3 19 4C 45 37 97 0D 0F C6 CB 8B 48 B9 74 D0 ... : ..........5.G......LE7......H.t. ...
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: req retrans : tcp seq 3504517593 not within the req range 3504517277-3504517592. stop tracking.
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: not applying tampering to unknown protocol
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40181 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40182 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=S seq=3572502630 ack_seq=0
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.72:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40182 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40183 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=S seq=3528873974 ack_seq=0
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.72:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40183 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40184 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=A seq=3572502631 ack_seq=2237543426
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40184 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40185 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=AP seq=3572502631 ack_seq=2237543426
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 67 02 2F 8E 39 7A 44 3F 26 33 13 DC 82 8F 61 AC E3 20 7F 4B 1F ... : ...........g./.9zD?&3....a.. �K. ...
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: req retrans : seq interval 3572502631-3572503147
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.72:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:53184 dst=17.248.209.72:443
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 8E 95 1E 3C 85 81 A0 D8 C5 E3 71 60 E6 57 E4 E9 01 88 26 B8 A7 ... : ........�.....<......q`.W....&.. ...
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40185 drop
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40186 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=A seq=3528873975 ack_seq=4210739663
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40186 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40187 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=AP seq=3528873975 ack_seq=4210739663
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 29 65 32 E8 76 74 57 8C D7 D7 65 D3 90 3B AA 3D FF 0A 9D AE CF ... : ...........)e2.vtW...e..;.=..... ...
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: req retrans : seq interval 3528873975-3528874491
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.72:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:53185 dst=17.248.209.72:443
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 38 6F 1F 52 44 FE FD 52 90 B2 2A 56 E1 3C 92 3A 50 0E 88 4A 9D ... : ........�..8o.RD..R..*V.<.:P..J. ...
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40187 drop
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40188 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=S seq=801717427 ack_seq=0
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.214.67:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40188 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40189 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=A seq=3528874492 ack_seq=4210739663
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40189 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40190 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=A seq=3572503148 ack_seq=2237543426
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40190 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40191 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=A seq=3528874492 ack_seq=4210739663
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40191 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40192 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53185 dport=443 flags=A seq=3528874492 ack_seq=4210739663
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40192 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40193 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=A seq=3572503148 ack_seq=2237543426
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40193 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40194 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=A seq=801717428 ack_seq=30010769
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40194 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40195 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=AP seq=801717428 ack_seq=30010769
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 12 C5 EB 56 A8 2B 7D 64 DD 79 E0 3A 18 38 5E 93 5E AD 7A 11 6D ... : ..............V.+}d.y.:.8^.^.z.m ...
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: req retrans : seq interval 801717428-801717944
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.214.67:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.129:63626 dst=17.248.214.67:443
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 ED 6E 48 2E 19 52 7D 21 73 84 FB 8E 0F 5C C3 92 83 D9 AC BF 55 ... : ........�...nH..R}!s....\......U ...
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:55 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40195 drop
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40196 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.72 proto=tcp ttl=63 sport=53184 dport=443 flags=A seq=3572503148 ack_seq=2237543426
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40196 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40197 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=A seq=801717945 ack_seq=30010769
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40197 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40198 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=A seq=801717945 ack_seq=30010769
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40198 pass unmodified
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40199 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.67 proto=tcp ttl=63 sport=63626 dport=443 flags=A seq=801717945 ack_seq=30010769
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:55 2025 user.debug nfqws[6224]: packet: id=40199 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40200 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=S seq=2884567583 ack_seq=0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.69:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40200 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40201 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=A seq=2884567584 ack_seq=1149917649
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40201 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40202 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=AP seq=2884567584 ack_seq=1149917649
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 34 A1 32 97 61 98 43 5B D2 E3 2E 4D F8 86 09 FA F9 67 90 D7 C5 ... : ...........4.2.a.C[...M.....g... ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: req retrans : seq interval 2884567584-2884568100
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.69:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:53186 dst=17.248.209.69:443
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 C2 CB A3 40 4C 80 35 50 9E CF 5C DC F9 E2 21 A9 08 9C 4E 57 FF ... : ........�[email protected]..\...!...NW. ...
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40202 drop
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40203 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=A seq=2884568101 ack_seq=1149917649
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40203 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40204 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=A seq=2884568101 ack_seq=1149917649
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40204 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40205 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.69 proto=tcp ttl=63 sport=53186 dport=443 flags=A seq=2884568101 ack_seq=1149917649
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40205 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40206 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=S seq=3312883563 ack_seq=0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=64.233.161.102:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40206 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40207 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=A seq=3312883564 ack_seq=3450143092
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40207 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40208 len=1400 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=A seq=3312883564 ack_seq=3450143092
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=1360 : 16 03 01 06 C3 01 00 06 BF 03 03 9F 4C 2C C8 76 12 17 DA 63 D5 B3 98 96 E0 1D 6C 8E 62 A2 BC ED ... : ............L,.v...c......l.b... ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains partial TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: starting reassemble. now we have 1360/1736
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: req retrans : seq interval 3312883564-3312884923
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DELAY desync until reasm is complete (#1)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40208 drop
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40209 len=416 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=AP seq=3312884924 ack_seq=3450143092
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=376 : 13 EA 00 B4 B1 68 5E 07 67 4F FD 54 31 6D 93 96 81 E8 3D 75 C8 97 30 EB AC C2 35 28 12 B6 69 24 ... : .....h^.gO.T1m....=u..0...5(..i$ ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reassemble : feeding data payload size=376. now we have 1736/1736
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: req retrans : seq interval 3312883564-3312885299
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DELAY desync until reasm is complete (#2)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAYING delayed packet #1 offset 0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAY IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=A seq=3312883564 ack_seq=3450143092
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=1360 : 16 03 01 06 C3 01 00 06 BF 03 03 9F 4C 2C C8 76 12 17 DA 63 D5 B3 98 96 E0 1D 6C 8E 62 A2 BC ED ... : ............L,.v...c......l.b... ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostname: android.clients.google.com
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=64.233.161.102:443 l7proto=tls hostname='android.clients.google.com'
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : positive
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:50641 dst=64.233.161.102:443
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 AF 51 04 A1 F4 DD 4D 21 60 7D ED C0 6E CA 69 19 3B 18 6D 45 82 ... : ........�...Q....M!`}..n.i.;.mE. ...
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reinjecting original packet. len=1400 len_payload=1360
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DROPPING delayed packet #1
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAYING delayed packet #2 offset 1360
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAY IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=AP seq=3312884924 ack_seq=3450143092
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=376 : 13 EA 00 B4 B1 68 5E 07 67 4F FD 54 31 6D 93 96 81 E8 3D 75 C8 97 30 EB AC C2 35 28 12 B6 69 24 ... : .....h^.gO.T1m....=u..0...5(..i$ ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostname: android.clients.google.com
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : positive
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:50641 dst=64.233.161.102:443
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: SENDING delayed packet #2 unmodified
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reassemble session finished
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40209 drop
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40210 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50641 dport=443 flags=A seq=3312885300 ack_seq=3450145812
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40210 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40211 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=S seq=2611354493 ack_seq=0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=64.233.161.102:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40211 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40212 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=A seq=2611354494 ack_seq=3809503850
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40212 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40213 len=1400 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=A seq=2611354494 ack_seq=3809503850
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=1360 : 16 03 01 06 E3 01 00 06 DF 03 03 61 29 04 7A 74 BF D7 CE 03 9D 23 3B DC FC 36 5C B9 AC BE 78 D8 ... : ...........a).zt.....#;..6\...x. ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains partial TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: starting reassemble. now we have 1360/1768
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: req retrans : seq interval 2611354494-2611355853
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DELAY desync until reasm is complete (#1)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40213 drop
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40214 len=448 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=AP seq=2611355854 ack_seq=3809503850
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=408 : 60 13 C1 89 90 B6 52 92 61 E2 D6 5F C3 62 2E B7 D0 66 06 47 8E 77 B7 C3 51 8C A0 CA 7C C1 86 57 ... : `.....R.a.._.b...f.G.w..Q...|..W ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reassemble : feeding data payload size=408. now we have 1768/1768
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: req retrans : seq interval 2611354494-2611356261
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DELAY desync until reasm is complete (#2)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAYING delayed packet #1 offset 0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAY IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=A seq=2611354494 ack_seq=3809503850
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=1360 : 16 03 01 06 E3 01 00 06 DF 03 03 61 29 04 7A 74 BF D7 CE 03 9D 23 3B DC FC 36 5C B9 AC BE 78 D8 ... : ...........a).zt.....#;..6\...x. ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostname: android.clients.google.com
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=64.233.161.102:443 l7proto=tls hostname='android.clients.google.com'
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : positive
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:50642 dst=64.233.161.102:443
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 4C 53 68 1A 17 B3 BB 53 93 24 AF 5A 65 6C 2C 74 C9 3A 0C 79 E5 ... : ........�..LSh....S.$.Zel,t.:.y. ...
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reinjecting original packet. len=1400 len_payload=1360
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: DROPPING delayed packet #1
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAYING delayed packet #2 offset 1360
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: REPLAY IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=AP seq=2611355854 ack_seq=3809503850
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: TCP: len=408 : 60 13 C1 89 90 B6 52 92 61 E2 D6 5F C3 62 2E B7 D0 66 06 47 8E 77 B7 C3 51 8C A0 CA 7C C1 86 57 ... : `.....R.a.._.b...f.G.w..Q...|..W ...
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostname: android.clients.google.com
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for android.clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for clients.google.com : negative
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: hostlist check for google.com : positive
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:50642 dst=64.233.161.102:443
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: SENDING delayed packet #2 unmodified
Mon Feb 17 10:30:56 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: reassemble session finished
Mon Feb 17 10:30:56 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40214 drop
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40215 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 64.233.161.102 proto=tcp ttl=63 sport=50642 dport=443 flags=A seq=2611356262 ack_seq=3809505210
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40215 pass unmodified
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40216 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=S seq=1502612251 ack_seq=0
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.73:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:56 2025 user.debug nfqws[6224]: packet: id=40216 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40217 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=A seq=1502612252 ack_seq=1263805896
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40217 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40218 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=AP seq=1502612252 ack_seq=1263805896
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 8D 6B 85 4E 1E 88 BB AD 39 A3 B3 75 7D 2B A6 37 8D 82 29 76 FB ... : ............k.N....9..u}+.7..)v. ...
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: req retrans : seq interval 1502612252-1502612768
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.73:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:53187 dst=17.248.209.73:443
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 03 8F C3 B0 F6 77 2E 6E 78 F8 F6 90 23 88 3A B9 DB E4 C3 7E CB ... : ........�.......w.nx...#.:....~. ...
Mon Feb 17 10:30:57 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:57 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40218 drop
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40219 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=A seq=1502612769 ack_seq=1263805896
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40219 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40220 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=A seq=1502612769 ack_seq=1263805896
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40220 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40221 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.73 proto=tcp ttl=63 sport=53187 dport=443 flags=A seq=1502612769 ack_seq=1263805896
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40221 pass unmodified
Mon Feb 17 10:30:57 2025 daemon.info gl-repeater[3044]: (repeater.lua:278) scanning...
Mon Feb 17 10:30:57 2025 kern.info kernel: [ 1954.667197] Set ScanSSID =
Mon Feb 17 10:30:57 2025 kern.debug kernel: [ 1954.670317] Number of channels to scan = 5
Mon Feb 17 10:30:57 2025 kern.debug kernel: [ 1954.674710] bScanning = 1
Mon Feb 17 10:30:57 2025 kern.info kernel: [ 1954.678216] Set ScanSSID =
Mon Feb 17 10:30:57 2025 kern.debug kernel: [ 1954.681057] Number of channels to scan = 5
Mon Feb 17 10:30:57 2025 kern.debug kernel: [ 1954.685312] bScanning = 1
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40222 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=S seq=2264708676 ack_seq=0
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.67:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40222 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40223 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=A seq=2264708677 ack_seq=2768836155
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40223 pass unmodified
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40224 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=AP seq=2264708677 ack_seq=2768836155
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 66 7C D4 B1 30 ED 8A 6B 63 73 C2 A7 3B 3C 68 A8 6E 14 E4 21 22 ... : ...........f|..0..kcs..;<h.n..!" ...
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: req retrans : seq interval 2264708677-2264709193
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.67:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.139:53188 dst=17.248.209.67:443
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 50 89 C5 B9 06 67 C8 81 BB 4A 29 EF 02 3B 97 2F EC 6D CE 7E 43 ... : ........�..P....g...J)..;./.m.~C ...
Mon Feb 17 10:30:57 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:57 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:57 2025 user.debug nfqws[6224]: packet: id=40224 drop
Mon Feb 17 10:30:57 2025 kern.warn kernel: [ 1954.974031] 7981@C03L2,ExtEventBeaconLostHandler() 170: FW EVENT (9a:3f:ce:de:fe:c1), Reason 0x10
Mon Feb 17 10:30:57 2025 kern.err kernel: [ 1954.982904] 7981@C03L1,ExtEventBeaconLostHandler() 176:   AP Beacon OFF!!!
Mon Feb 17 10:30:57 2025 kern.warn kernel: [ 1954.990916] 7981@C03L2,ExtEventBeaconLostHandler() 170: FW EVENT (82:ad:c2:27:2c:3a), Reason 0x10
Mon Feb 17 10:30:57 2025 kern.err kernel: [ 1954.999866] 7981@C03L1,ExtEventBeaconLostHandler() 176:   AP Beacon OFF!!!
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40225 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=S seq=3523875133 ack_seq=0
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.214.70:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40225 pass unmodified
Mon Feb 17 10:30:58 2025 kern.notice kernel: [ 1955.874643] 7981@C08L3,UpdateBeaconHandler() 2087: BCN_UPDATE_ENABLE_TX, OmacIdx = 0 (ra0)
Mon Feb 17 10:30:58 2025 kern.notice kernel: [ 1955.883027] 7981@C08L3,UpdateBeaconHandler() 2092: 	Band0 BcnInitedRnd = 18569
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40226 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=A seq=3523875134 ack_seq=2835819537
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40226 pass unmodified
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40227 len=557 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=AP seq=3523875134 ack_seq=2835819537
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 33 C1 C8 5E 37 68 6D 7B 56 3C 22 48 22 D6 88 61 3F 4A DE 5D A2 ... : ...........3..^7hm{V<"H"..a?J.]. ...
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet contains full TLS ClientHello
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: req retrans : seq interval 3523875134-3523875650
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: hostname: gateway.icloud.com
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: discovered l7 protocol
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: discovered hostname
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.214.70:443 l7proto=tls hostname='gateway.icloud.com'
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: * hostlist check for profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: [/etc/nfqws/exclude.list] exclude hostlist check for gateway.icloud.com : negative
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: hostlist check for icloud.com : negative
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: hostlist check for com : negative
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: [/etc/nfqws/auto.list] include hostlist check for gateway.icloud.com : positive
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: dpi desync src=192.168.9.129:63627 dst=17.248.214.70:443
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: sending fake : 16 03 01 02 83 01 00 02 7F 03 03 16 B0 F1 B1 20 3E D1 FA 1B A1 22 79 68 2A 07 0F F0 F7 AC 76 77 ... : ........�...... >...."yh*.....vw ...
Mon Feb 17 10:30:58 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: reinjecting original packet. len=557 len_payload=517
Mon Feb 17 10:30:58 2025 user.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:58 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40227 drop
Mon Feb 17 10:30:58 2025 daemon.err nfqws[6224]: rawsend: bind (ignoring): Address not available
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40228 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=A seq=3523875651 ack_seq=2835819537
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40228 pass unmodified
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40229 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=A seq=3523875651 ack_seq=2835819537
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40229 pass unmodified
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40230 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.129 => 17.248.214.70 proto=tcp ttl=63 sport=63627 dport=443 flags=A seq=3523875651 ack_seq=2835819537
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40230 pass unmodified
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40231 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=A seq=2264709194 ack_seq=2768836155
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40231 pass unmodified
Mon Feb 17 10:30:58 2025 kern.notice kernel: [ 1956.094662] 7981@C08L3,UpdateBeaconHandler() 2087: BCN_UPDATE_ENABLE_TX, OmacIdx = 0 (rax0)
Mon Feb 17 10:30:58 2025 kern.notice kernel: [ 1956.103983] 7981@C08L3,UpdateBeaconHandler() 2092: 	Band1 BcnInitedRnd = 18571
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40232 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=A seq=2264709194 ack_seq=2768836155
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40232 pass unmodified
Mon Feb 17 10:30:58 2025 kern.warn kernel: [ 1956.124728] 7981@C03L2,ExtEventBeaconLostHandler() 170: FW EVENT (9a:3f:ce:de:fe:c1), Reason 0x10
Mon Feb 17 10:30:58 2025 kern.err kernel: [ 1956.133604] 7981@C03L1,ExtEventBeaconLostHandler() 176:   AP Beacon OFF!!!
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40233 len=40 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.67 proto=tcp ttl=63 sport=53188 dport=443 flags=A seq=2264709194 ack_seq=2768836155
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: using cached desync profile 3
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40233 pass unmodified
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40234 len=64 mark=00000000 ifin=(0) ifout=eth2(5)
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: IP4: 192.168.9.139 => 17.248.209.65 proto=tcp ttl=63 sport=53190 dport=443 flags=S seq=4292051629 ack_seq=0
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile search for tcp target=17.248.209.65:443 l7proto=unknown hostname=''
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: desync profile 3 matches
Mon Feb 17 10:30:58 2025 user.debug nfqws[6224]: packet: id=40234 pass unmodified

LimpingK · 2025-02-17T10:39:57Z

Интересное дело: потом впервые добавил в auto.list

17.02.2025 12:33:08 : api.mixpanel.com : profile 3 : client 192.168.9.129:64640 : proto tls : adding to /etc/nfqws/auto.list
17.02.2025 12:33:08 : api.mixpanel.com : profile 3 : client 192.168.9.129:64640 : proto tls : fail counter 3/3
17.02.2025 12:33:08 : api.mixpanel.com : profile 3 : client 192.168.9.129:64640 : proto tls : retrans threshold reached
17.02.2025 12:33:06 : api.mixpanel.com : profile 3 : client 192.168.9.129:64636 : proto tls : fail counter 2/3
17.02.2025 12:33:06 : api.mixpanel.com : profile 3 : client 192.168.9.129:64636 : proto tls : retrans threshold reached
17.02.2025 12:33:03 : api.mixpanel.com : profile 3 : client 192.168.9.129:64630 : proto tls : fail counter 1/3
17.02.2025 12:33:03 : api.mixpanel.com : profile 3 : client 192.168.9.129:64630 : proto tls : retrans threshold reached
17.02.2025 12:25:19 : www.microsoft.com : profile 3 : client 192.168.9.129:49431 : proto tls : fail counter 1/3
17.02.2025 12:25:19 : www.microsoft.com : profile 3 : client 192.168.9.129:49431 : proto tls : retrans threshold reached
17.02.2025 10:15:12 : dns.controld.com : profile 3 : client 192.168.9.248:63439 : proto tls : fail counter reset. website is working.
17.02.2025 10:15:11 : dns.controld.com : profile 3 : client 192.168.9.248:63436 : proto tls : fail counter 1/3
17.02.2025 10:15:11 : dns.controld.com : profile 3 : client 192.168.9.248:63436 : proto tls : retrans threshold reached

LimpingK · 2025-03-21T11:11:45Z

Отпишу.
У меня эта проблема сохраняется. Иногда вижу в nfqws.log пару строчек даже не за этот день, а с вчерашними датами. То-есть что-то в файл пишется и иногда он обнуляется.

Думаю обновить сам роутер на бета-прошивку, в которой исправляют другие баги.
Посмотрю, изменится ли что-то в работе сабжа.

В принципе можно и обновить OpenWrt 21.02 до более свежей, потому что автоматическое добавление заблокированных прям очень даже актуально для меня.
Но это — если точно представлять, что проблема связана с 21.02 и я не огребу новых проблем с ванильной...

LimpingK mentioned this issue Apr 10, 2025

[BUG] перестали приходить логи в web nfqws #194

Closed

Anonym-tsk marked this as a duplicate of #194 Apr 11, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

LimpingK commented Jan 30, 2025

vemneyy commented Feb 10, 2025

LimpingK commented Feb 11, 2025 •

edited

Loading

LimpingK commented Feb 11, 2025

LimpingK commented Feb 11, 2025

LimpingK commented Feb 13, 2025

LimpingK commented Feb 17, 2025 •

edited

Loading

LimpingK commented Feb 17, 2025

LimpingK commented Mar 21, 2025 •

edited

Loading

[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

Comments

LimpingK commented Jan 30, 2025

vemneyy commented Feb 10, 2025

LimpingK commented Feb 11, 2025 • edited Loading

LimpingK commented Feb 11, 2025

LimpingK commented Feb 11, 2025

LimpingK commented Feb 13, 2025

LimpingK commented Feb 17, 2025 • edited Loading

LimpingK commented Feb 17, 2025

LimpingK commented Mar 21, 2025 • edited Loading

LimpingK commented Feb 11, 2025 •

edited

Loading

LimpingK commented Feb 17, 2025 •

edited

Loading

LimpingK commented Mar 21, 2025 •

edited

Loading