read 662 bytes from /opt/zapret/files/fake/tls_clienthello_google_com.bin adding low-priority default empty desync profile we have 2 user defined desync profile(s) and default low priority profile 0 Loading hostlist /opt/zapret/ipset/zapret-hosts-youtube.txt loading plain text list Loaded 29 hosts from /opt/zapret/ipset/zapret-hosts-youtube.txt Loading hostlist /opt/zapret/ipset/zapret-hosts-auto.txt loading plain text list Loaded 0 hosts from /opt/zapret/ipset/zapret-hosts-auto.txt Loading hostlist /opt/zapret/ipset/zapret-hosts-user.txt loading plain text list Loaded 51 hosts from /opt/zapret/ipset/zapret-hosts-user.txt Loading hostlist /opt/zapret/ipset/zapret-hosts-user-exclude.txt loading plain text list Loaded 55 hosts from /opt/zapret/ipset/zapret-hosts-user-exclude.txt initializing conntrack with timeouts tcp=60:300:60 udp=60 opening library handle unbinding existing nf_queue handler for AF_INET (if any) binding nfnetlink_queue as nf_queue handler for AF_INET binding this socket to queue '200' setting copy_packet mode initializing raw sockets bind-fix4=0 bind-fix6=0 set_socket_buffers fd=5 rcvbuf=2048 sndbuf=32768 fd=5 SO_RCVBUF=4096 fd=5 SO_SNDBUF=65536 set_socket_buffers fd=6 rcvbuf=2048 sndbuf=32768 fd=6 SO_RCVBUF=4096 fd=6 SO_SNDBUF=65536 Running as UID=1 GID=1 set_socket_buffers fd=4 rcvbuf=65536 sndbuf=32768 fd=4 SO_RCVBUF=131072 fd=4 SO_SNDBUF=65536 packet: id=1 len=60 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=S seq=2092173917 ack_seq=0 desync profile search for tcp target=206.253.89.79:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1 pass unmodified packet: id=2 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=S seq=662601587 ack_seq=0 desync profile search for tcp target=216.58.211.227:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=2 pass unmodified packet: id=3 len=60 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=SA seq=2068848316 ack_seq=2092173918 using cached desync profile 2 incoming TTL 53 packet: id=3 pass unmodified packet: id=4 len=52 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=A seq=2092173918 ack_seq=2068848317 using cached desync profile 2 packet: id=4 pass unmodified packet: id=5 len=627 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=AP seq=2092173918 ack_seq=2068848317 TCP: 16 03 01 02 3A 01 00 02 36 03 03 4B 3C 70 C9 6F 0B FE 2F 8C 0F D6 A0 50 C3 F2 A0 C5 C0 DA F6 26 ... : ....:...6..K 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=SA seq=4139575618 ack_seq=662601588 using cached desync profile 2 incoming TTL 56 packet: id=6 pass unmodified packet: id=7 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=A seq=662601588 ack_seq=4139575619 using cached desync profile 2 packet: id=7 pass unmodified packet: id=8 len=593 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=AP seq=662601588 ack_seq=4139575619 TCP: 16 03 01 02 18 01 00 02 14 03 03 E3 89 F8 90 E2 4E D4 20 EF 4C 45 5E 18 3E E1 7F 64 B2 82 01 40 ... : ................N. .LE^.>.d...@ ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 662601588-662602128 hostname: update.googleapis.com discovered l7 protocol discovered hostname desync profile search for tcp target=216.58.211.227:443 l7proto=tls hostname='update.googleapis.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for update.googleapis.com : negative Hostlist check for googleapis.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:53124 dst=216.58.211.227:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-540 len=540 : 03 01 02 18 01 00 02 14 03 03 E3 89 F8 90 E2 4E D4 20 EF 4C 45 5E 18 3E E1 7F 64 B2 82 01 40 02 ... : ...............N. .LE^.>.d...@. ... packet: id=8 drop packet: id=9 len=52 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139575619 ack_seq=662601589 using cached desync profile 1 packet: id=9 pass unmodified packet: id=10 len=52 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139575619 ack_seq=662602129 using cached desync profile 1 packet: id=10 pass unmodified packet: id=11 len=1452 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139575619 ack_seq=662602129 TCP: 16 03 03 00 7A 02 00 00 76 03 03 0B D7 9A A2 41 65 A8 66 1D 2C D1 15 3C E5 19 26 56 BF EC 5D F8 ... : ....z...v......Ae.f.,..<..&V..]. ... using cached desync profile 1 packet: id=11 pass unmodified packet: id=12 len=1452 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=AP seq=4139577019 ack_seq=662602129 TCP: 92 C7 71 5A 68 B0 9B A4 FC 14 E2 82 4E 89 07 B1 94 25 42 B5 EF 94 6C 70 6A 62 1F E0 DB 10 2E DC ... : ..qZh.......N....%B...lpjb...... ... using cached desync profile 1 packet: id=12 pass unmodified packet: id=13 len=1452 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139578419 ack_seq=662602129 TCP: 2A 3E 3E EB DC E6 59 5C E3 54 BD C1 25 26 71 6F 42 D4 24 42 39 49 44 D1 6F CB D6 DA F7 FD 49 F5 ... : *>>...Y\.T..%&qoB.$B9ID.o.....I. ... using cached desync profile 1 packet: id=13 pass unmodified packet: id=14 len=518 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=AP seq=4139579819 ack_seq=662602129 TCP: DC C9 9F 38 65 02 4F A4 B9 B4 57 32 DE 18 64 FF 23 F8 79 32 08 C5 1C 0E 40 BF 4C 65 98 9A F0 E6 ... : ...8e.O...W2..d.#.y2....@.Le.... ... using cached desync profile 1 packet: id=14 pass unmodified packet: id=15 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=A seq=662602129 ack_seq=4139577019 using cached desync profile 1 packet: id=15 pass unmodified packet: id=16 len=52 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=A seq=2068848317 ack_seq=2092174493 using cached desync profile 2 packet: id=16 pass unmodified packet: id=17 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=A seq=662602129 ack_seq=4139578419 using cached desync profile 1 packet: id=17 pass unmodified packet: id=18 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=A seq=662602129 ack_seq=4139579819 using cached desync profile 1 packet: id=18 pass unmodified packet: id=19 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=A seq=662602129 ack_seq=4139580285 using cached desync profile 1 packet: id=19 pass unmodified packet: id=20 len=126 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=AP seq=662602129 ack_seq=4139580285 TCP: 14 03 03 00 01 01 17 03 03 00 3F DA B5 43 BD 88 31 64 B5 E1 6B 24 29 B1 E4 39 2E 52 2C 08 95 15 ... : ..........?..C..1d..k$)..9.R,... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=20 pass unmodified packet: id=21 len=1022 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=AP seq=4139580285 ack_seq=662602203 TCP: 17 03 03 03 87 F1 C7 4C 82 F4 5B 06 AB 75 55 05 82 3D 0E F6 9F 6D 3B 63 9F B1 C0 C3 E0 B1 2E 68 ... : .......L..[..uU..=...m;c.......h ... using cached desync profile 1 packet: id=21 pass unmodified packet: id=22 len=144 mark=20000000 IP4: 192.168.1.8 => 216.58.211.227 proto=tcp ttl=63 sport=53124 dport=443 flags=AP seq=662602203 ack_seq=4139581255 TCP: 17 03 03 00 57 65 43 25 B0 44 B3 AF FD D8 26 D3 A0 DB 16 9A BD 94 BB DC 6B B5 4B BC DF 57 CE A1 ... : ....WeC%.D....&.........k.K..W.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=22 pass unmodified packet: id=23 len=64 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139581255 ack_seq=662602203 using cached desync profile 1 packet: id=23 pass unmodified packet: id=24 len=52 mark=00000000 IP4: 216.58.211.227 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=53124 flags=A seq=4139581255 ack_seq=662602326 using cached desync profile 1 packet: id=24 pass unmodified packet: id=25 len=322 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=AP seq=2068848317 ack_seq=2092174493 TCP: 16 03 03 00 80 02 00 00 7C 03 03 D5 6C C1 52 8C 77 B8 54 2E DD E0 0C 42 D6 22 60 AF C3 8D A3 09 ... : ........|...l.R.w.T....B."`..... ... using cached desync profile 2 packet: id=25 pass unmodified packet: id=26 len=52 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=A seq=2092174493 ack_seq=2068848587 using cached desync profile 2 packet: id=26 pass unmodified packet: id=27 len=132 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=AP seq=2092174493 ack_seq=2068848587 TCP: 14 03 03 00 01 01 17 03 03 00 45 A9 EE D2 CF B3 D3 1A E8 E3 E1 42 E2 67 AD 82 34 15 3C 1C 6B 06 ... : ..........E..........B.g..4.<.k. ... using cached desync profile 2 req retrans : tcp seq 2092174493 not within the req range 2092173918-2092174492. stop tracking. not applying tampering to unknown protocol packet: id=27 pass unmodified packet: id=28 len=60 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=S seq=3214432731 ack_seq=0 desync profile search for tcp target=34.104.35.123:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=28 pass unmodified packet: id=29 len=52 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=A seq=2068848587 ack_seq=2092174573 using cached desync profile 2 packet: id=29 pass unmodified packet: id=30 len=341 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=AP seq=2092174573 ack_seq=2068848587 TCP: 17 03 03 01 1C 88 F3 7D F2 F6 5A A3 3F 63 3A 3A 91 B7 9F 48 25 80 86 07 12 9A BB 7E 04 51 53 73 ... : .......}..Z.?c::...H%......~.QSs ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=30 pass unmodified packet: id=31 len=60 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=57 sport=80 dport=44670 flags=SA seq=1341877820 ack_seq=3214432732 using cached desync profile 2 incoming TTL 57 packet: id=31 pass unmodified packet: id=32 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214432732 ack_seq=1341877821 using cached desync profile 2 packet: id=32 pass unmodified packet: id=33 len=483 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=AP seq=3214432732 ack_seq=1341877821 TCP: 47 45 54 20 2F 65 64 67 65 64 6C 2F 64 69 66 66 67 65 6E 2D 70 75 66 66 69 6E 2F 65 66 6E 69 6F ... : GET /edgedl/diffgen-puffin/efnio ... using cached desync profile 2 packet contains HTTP request req retrans : tcp seq interval 3214432732-3214433162 hostname: edgedl.me.gvt1.com discovered l7 protocol discovered hostname desync profile search for tcp target=34.104.35.123:80 l7proto=http hostname='edgedl.me.gvt1.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for edgedl.me.gvt1.com : negative Hostlist check for me.gvt1.com : negative Hostlist check for gvt1.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:44670 dst=34.104.35.123:80 split pos 1 sending fake request : 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 74 3A 20 77 77 77 2E 69 61 6E 61 2E 6F ... : GET / HTTP/1.1..Host: www.iana.o ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 47 : G sending 2nd tcp segment 1-430 len=430 : 45 54 20 2F 65 64 67 65 64 6C 2F 64 69 66 66 67 65 6E 2D 70 75 66 66 69 6E 2F 65 66 6E 69 6F 6A ... : ET /edgedl/diffgen-puffin/efnioj ... packet: id=33 drop packet: id=34 len=339 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=AP seq=2068848587 ack_seq=2092174573 TCP: 17 03 03 01 1A 3A 3E 8E 27 EE 1E 59 31 45 BD 98 C1 BB D0 CC A5 38 0E 12 B6 56 A8 5D F4 2E 76 93 ... : .....:>.'..Y1E.......8...V.]..v. ... using cached desync profile 2 packet: id=34 pass unmodified packet: id=35 len=52 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=A seq=2068848874 ack_seq=2092174862 using cached desync profile 2 packet: id=35 pass unmodified packet: id=36 len=52 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=57 sport=80 dport=44670 flags=A seq=1341877821 ack_seq=3214432733 using cached desync profile 1 packet: id=36 pass unmodified packet: id=37 len=52 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=57 sport=80 dport=44670 flags=A seq=1341877821 ack_seq=3214433163 using cached desync profile 1 packet: id=37 pass unmodified packet: id=38 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=A seq=1341877821 ack_seq=3214433163 TCP: 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 61 63 63 65 70 74 2D 72 61 6E 67 65 73 3A 20 ... : HTTP/1.1 200 OK..accept-ranges: ... using cached desync profile 1 packet: id=38 pass unmodified packet: id=39 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=AP seq=1341879241 ack_seq=3214433163 TCP: 20 C1 26 8A DE 50 22 51 AC 12 2D A4 B2 82 3B B3 3D BA A7 97 76 4F 92 C4 44 48 DD EC E5 D8 24 62 ... : .&..P"Q..-...;.=...vO..DH....$b ... using cached desync profile 1 packet: id=39 pass unmodified packet: id=40 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=A seq=1341880661 ack_seq=3214433163 TCP: 10 D1 D2 21 DA 51 48 E8 F9 6E 82 64 A0 45 61 A1 66 FB 96 CC DD 37 97 51 08 AC DF C2 F3 CC 44 84 ... : ...!.QH..n.d.Ea.f....7.Q......D. ... using cached desync profile 1 packet: id=40 pass unmodified packet: id=41 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=AP seq=1341882081 ack_seq=3214433163 TCP: 3D FB D9 00 49 12 FE F6 F8 B8 EB 6C EF 2D 10 79 84 7E 7A 57 7C F2 67 01 5B D3 6B 8D 45 01 0B 31 ... : =...I......l.-.y.~zW|.g.[.k.E..1 ... using cached desync profile 1 packet: id=41 pass unmodified packet: id=42 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=A seq=1341883501 ack_seq=3214433163 TCP: 72 C5 2D 43 26 AB A5 78 C5 0F D0 A5 03 D9 DB 6F 7B 1C 47 88 15 AF 0D 2E BC 1F 9D 6E 31 04 A2 86 ... : r.-C&..x.......o{.G........n1... ... using cached desync profile 1 packet: id=42 pass unmodified packet: id=43 len=1472 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=AP seq=1341884921 ack_seq=3214433163 TCP: C9 3F 77 F9 CB 5B 74 B6 45 4E 7C DE 72 E2 D8 C2 D8 E3 6D 8F 8A 3E 75 EA 0C 07 EC E7 06 E3 47 3D ... : .?w..[t.EN|.r.....m..>u.......G= ... using cached desync profile 1 packet: id=43 pass unmodified packet: id=44 len=939 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=AP seq=1341886341 ack_seq=3214433163 TCP: 65 3C 72 6B 34 04 95 C7 19 FB ED 67 DA A9 6B F2 31 55 2E 0F C7 B2 20 5F 88 8B BB A5 2D 4C 2E 2B ... : e 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=A seq=2092174862 ack_seq=2068848874 using cached desync profile 2 packet: id=45 pass unmodified packet: id=46 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341879241 using cached desync profile 1 packet: id=46 pass unmodified packet: id=47 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341880661 using cached desync profile 1 packet: id=47 pass unmodified packet: id=48 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341882081 using cached desync profile 1 packet: id=48 pass unmodified packet: id=49 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341883501 using cached desync profile 1 packet: id=49 pass unmodified packet: id=50 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341884921 using cached desync profile 1 packet: id=50 pass unmodified packet: id=51 len=52 mark=20000000 IP4: 192.168.1.8 => 34.104.35.123 proto=tcp ttl=63 sport=44670 dport=80 flags=A seq=3214433163 ack_seq=1341886341 using cached desync profile 1 packet: id=51 pass unmodified packet: id=52 len=601 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=AP seq=2068848874 ack_seq=2092174862 TCP: 17 03 03 02 20 D3 AC 0F 72 D5 F4 43 B8 65 B3 CD 27 05 CF CD 01 62 20 1D AD 12 C2 86 9B 1B F7 D3 ... : .... ...r..C.e..'....b ......... ... using cached desync profile 2 packet: id=52 pass unmodified packet: id=53 len=52 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=A seq=2092174862 ack_seq=2068849423 using cached desync profile 2 packet: id=53 pass unmodified packet: id=54 len=578 mark=20000000 IP4: 192.168.1.8 => 206.253.89.79 proto=tcp ttl=63 sport=54222 dport=443 flags=AP seq=2092174862 ack_seq=2068849423 TCP: 17 03 03 02 09 B1 45 33 E9 E2 FA B3 53 F3 AC 99 90 DF 5D A8 7D AA 27 07 87 52 5F 14 3F B8 C2 BB ... : ......E3....S.....].}.'..R_.?... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=54 pass unmodified packet: id=55 len=52 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=A seq=2068849423 ack_seq=2092175388 using cached desync profile 2 packet: id=55 pass unmodified packet: id=56 len=1352 mark=00000000 IP4: 206.253.89.79 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=54222 flags=AP seq=2068849423 ack_seq=2092175388 TCP: 17 03 03 1A E7 BB 14 E2 F8 41 4E C7 4E 76 A4 7D FC 95 2F CF 46 CD 66 32 F2 C7 C1 A0 0B 76 24 C2 ... : .........AN.Nv.}../.F.f2.....v$. ... using cached desync profile 2 packet: id=56 pass unmodified packet: id=57 len=83 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34736 flags=AP seq=1607626583 ack_seq=2958629280 TCP: 15 03 03 00 1A BF 2A 09 D5 A1 24 05 C6 C2 15 F1 C4 5C 33 D5 69 0F 8C F5 EA 97 B5 B1 B5 91 9F : ......*...$......\3.i.......... desync profile search for tcp target=192.168.1.8:34736 l7proto=unknown hostname='' desync profile 2 matches not applying tampering to unknown protocol packet: id=57 pass unmodified packet: id=58 len=60 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=S seq=2857024005 ack_seq=0 desync profile search for tcp target=213.180.193.234:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=58 pass unmodified packet: id=59 len=60 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=SA seq=4290652827 ack_seq=2857024006 using cached desync profile 2 incoming TTL 56 packet: id=59 pass unmodified packet: id=60 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=A seq=2857024006 ack_seq=4290652828 using cached desync profile 2 packet: id=60 pass unmodified packet: id=61 len=569 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=AP seq=2857024006 ack_seq=4290652828 TCP: 16 03 01 02 00 01 00 01 FC 03 03 1D DB 8A CB C5 90 8D F5 1D 60 98 36 D2 AE D0 77 65 4A 98 5B 5D ... : ....................`.6...weJ.[] ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2857024006-2857024522 hostname: api.browser.yandex.ru discovered l7 protocol discovered hostname desync profile search for tcp target=213.180.193.234:443 l7proto=tls hostname='api.browser.yandex.ru' * hostlist check for profile 1 Checking include hostlist Hostlist check for api.browser.yandex.ru : negative Hostlist check for browser.yandex.ru : negative Hostlist check for yandex.ru : negative Hostlist check for ru : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for api.browser.yandex.ru : negative Hostlist check for browser.yandex.ru : negative Hostlist check for yandex.ru : positive not applying tampering to this request packet: id=61 pass unmodified packet: id=62 len=52 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=A seq=4290652828 ack_seq=2857024523 using cached desync profile 2 packet: id=62 pass unmodified packet: id=63 len=1260 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=A seq=4290652828 ack_seq=2857024523 TCP: 16 03 03 00 4E 02 00 00 4A 03 03 B4 5D FB 6E 69 AD 4A A3 E1 42 93 B1 DA D7 CD 55 02 F1 A1 38 47 ... : ....N...J...].ni.J..B.....U...8G ... using cached desync profile 2 packet: id=63 pass unmodified packet: id=64 len=1260 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=A seq=4290654036 ack_seq=2857024523 TCP: 16 80 14 F8 EF 7F F2 CD 78 67 A8 DE 6F 8F 24 8D 88 F1 87 03 02 B3 EB 30 1D 06 03 55 1D 0E 04 16 ... : .......xg..o.$........0...U.... ... using cached desync profile 2 packet: id=64 pass unmodified packet: id=65 len=1260 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=AP seq=4290655244 ack_seq=2857024523 TCP: 69 68 5C 06 B9 EE 51 89 E1 8A 0E 41 4D 9B 92 90 0A 89 E9 16 6B EF EF 75 BE 7A 46 B8 E3 47 8A 1D ... : ih\...Q....AM.......k..u.zF..G.. ... using cached desync profile 2 packet: id=65 pass unmodified packet: id=66 len=885 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=AP seq=4290656452 ack_seq=2857024523 TCP: 14 8F F0 4B 7F A8 2E 45 24 AE 4D 50 FA 63 9A 8B DE E2 DD 1B BC 30 1F 06 03 55 1D 23 04 18 30 16 ... : ...K..E$.MP.c.......0...U.#..0. ... using cached desync profile 2 packet: id=66 pass unmodified packet: id=67 len=52 mark=00000000 IP4: 34.104.35.123 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=44670 flags=AF seq=1341887228 ack_seq=3214433164 using cached desync profile 1 packet: id=67 pass unmodified packet: id=68 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=A seq=2857024523 ack_seq=4290654036 using cached desync profile 2 packet: id=68 pass unmodified packet: id=69 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=A seq=2857024523 ack_seq=4290655244 using cached desync profile 2 packet: id=69 pass unmodified packet: id=70 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=A seq=2857024523 ack_seq=4290656452 using cached desync profile 2 packet: id=70 pass unmodified packet: id=71 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=A seq=2857024523 ack_seq=4290657285 using cached desync profile 2 packet: id=71 pass unmodified packet: id=72 len=145 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=AP seq=2857024523 ack_seq=4290657285 TCP: 16 03 03 00 25 10 00 00 21 20 45 9D 19 E6 3F EB 1D EC C8 38 28 15 FF 70 2F 93 B7 71 46 41 C7 8F ... : ....%...! E...?....8(..p/..qFA.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=72 pass unmodified packet: id=73 len=151 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=39324 dport=443 flags=AP seq=2857024616 ack_seq=4290657285 TCP: 17 03 03 00 5E 00 00 00 00 00 00 00 01 FC 54 9F 07 5F 4F 5F 7F 42 A8 C3 B7 7F 10 F0 7F 99 A7 8A ... : ....^.........T.._O_B........ ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=73 pass unmodified packet: id=74 len=310 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=AP seq=4290657285 ack_seq=2857024616 TCP: 16 03 03 00 CA 04 00 00 C6 00 01 89 C0 00 C0 8C A2 C1 1E 08 E8 22 7E 9A 57 87 AB 8A F8 1B 4F A1 ... : ....................."~.W.....O. ... using cached desync profile 2 packet: id=74 pass unmodified packet: id=75 len=120 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=AP seq=4290657543 ack_seq=2857024616 TCP: 17 03 03 00 3F 19 7B 04 2A 11 4B 5C E7 ED B5 6D 60 35 97 BD 4E C0 1D 9D E9 51 20 0C 18 73 BB AB ... : ....?.{.*.K\...m`5..N....Q ..s.. ... using cached desync profile 2 packet: id=75 pass unmodified packet: id=76 len=64 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=A seq=4290657611 ack_seq=2857024616 using cached desync profile 2 packet: id=76 pass unmodified packet: id=77 len=64 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=39324 flags=A seq=4290657611 ack_seq=2857024616 using cached desync profile 2 packet: id=77 pass unmodified packet: id=78 len=60 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=S seq=2525600815 ack_seq=0 desync profile search for tcp target=37.9.64.225:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=78 pass unmodified packet: id=79 len=60 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=SA seq=3813407761 ack_seq=2525600816 using cached desync profile 2 incoming TTL 51 packet: id=79 pass unmodified packet: id=80 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525600816 ack_seq=3813407762 using cached desync profile 2 packet: id=80 pass unmodified packet: id=81 len=675 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=AP seq=2525600816 ack_seq=3813407762 TCP: 16 03 01 02 6A 01 00 02 66 03 03 87 8E E3 67 A4 11 4D 40 E0 56 30 B8 90 CF 38 84 6F 3F CD BE 2E ... : ....j...f.....g..M@.V0...8.o?... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2525600816-2525601438 hostname: cdnrepfu6rku5qba3zpu.svc.cdn.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=37.9.64.225:443 l7proto=tls hostname='cdnrepfu6rku5qba3zpu.svc.cdn.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for cdnrepfu6rku5qba3zpu.svc.cdn.yandex.net : negative Hostlist check for svc.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for cdnrepfu6rku5qba3zpu.svc.cdn.yandex.net : negative Hostlist check for svc.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for cdnrepfu6rku5qba3zpu.svc.cdn.yandex.net : negative Hostlist check for svc.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=81 pass unmodified packet: id=82 len=52 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813407762 ack_seq=2525601439 using cached desync profile 2 packet: id=82 pass unmodified packet: id=83 len=1260 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813407762 ack_seq=2525601439 TCP: 16 03 03 00 7A 02 00 00 76 03 03 34 48 9F 84 3B 27 DF 94 2D E5 FB 49 D2 81 98 35 D7 84 B6 91 44 ... : ....z...v..4H..;'..-..I...5....D ... using cached desync profile 2 packet: id=83 pass unmodified packet: id=84 len=1260 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813408970 ack_seq=2525601439 TCP: E5 E9 15 FF 9E EE 31 3A 82 12 9E 05 00 3B F3 BC 53 BE 25 1C EC 79 A1 50 61 F7 4E BC F8 57 D0 C3 ... : ......1:.....;..S.%..y.Pa.N..W.. ... using cached desync profile 2 packet: id=84 pass unmodified packet: id=85 len=1260 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813410178 ack_seq=2525601439 TCP: D1 93 ED FB 8E E7 BC A5 4F B0 7E A3 F5 9A BF AB 57 2A AC 1D 2E 3D D7 CD CE 00 25 5D 80 CB 2B 7B ... : ........O.~.....W*...=....%]..+{ ... using cached desync profile 2 packet: id=85 pass unmodified packet: id=86 len=524 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=AP seq=3813411386 ack_seq=2525601439 TCP: C9 09 A0 7B 2A 49 A3 F9 21 34 5D 33 FA 79 6D F8 FB 14 17 92 D0 E3 78 F9 C2 E7 3E 0D 2D 37 1D 0D ... : ...{*I..!4]3.ym.......x...>.-7.. ... using cached desync profile 2 packet: id=86 pass unmodified packet: id=87 len=446 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=AP seq=3813411858 ack_seq=2525601439 TCP: 00 1F 31 AE 65 EE 21 6B DA 09 71 3E BD 79 19 E4 2E 2F F5 45 1D 9E 17 86 3F BC 0D CC C5 D3 2F 54 ... : ..1.e.!k..q>.y.../.E....?...../T ... using cached desync profile 2 packet: id=87 pass unmodified packet: id=88 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525601439 ack_seq=3813408970 using cached desync profile 2 packet: id=88 pass unmodified packet: id=89 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525601439 ack_seq=3813410178 using cached desync profile 2 packet: id=89 pass unmodified packet: id=90 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525601439 ack_seq=3813411386 using cached desync profile 2 packet: id=90 pass unmodified packet: id=91 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525601439 ack_seq=3813411858 using cached desync profile 2 packet: id=91 pass unmodified packet: id=92 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=A seq=2525601439 ack_seq=3813412252 using cached desync profile 2 packet: id=92 pass unmodified packet: id=93 len=132 mark=20000000 IP4: 192.168.1.8 => 37.9.64.225 proto=tcp ttl=63 sport=38688 dport=443 flags=AP seq=2525601439 ack_seq=3813412252 TCP: 14 03 03 00 01 01 17 03 03 00 45 DF 62 A0 98 26 F3 12 9E BA 5A 71 99 2B 4C 31 7F 3B BE 8A A5 68 ... : ..........E.b..&....Zq.+L1;...h ... using cached desync profile 2 req retrans : tcp seq 2525601439 not within the req range 2525600816-2525601438. stop tracking. not applying tampering to unknown protocol packet: id=93 pass unmodified packet: id=94 len=52 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813412252 ack_seq=2525601519 using cached desync profile 2 packet: id=94 pass unmodified packet: id=95 len=379 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=AP seq=3813412252 ack_seq=2525601519 TCP: 17 03 03 01 42 28 2D 85 68 43 82 D8 E9 3D 41 B8 CE 39 9D C0 B4 EA 8F 6E 44 23 0E 1A C3 26 48 79 ... : ....B(-.hC...=A..9.....nD#...&Hy ... using cached desync profile 2 packet: id=95 pass unmodified packet: id=96 len=379 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=AP seq=3813412579 ack_seq=2525601519 TCP: 17 03 03 01 42 65 39 24 55 3F E9 09 84 9C 4E C9 12 2E C6 F3 D6 DD 8D 47 4B AB 04 2D 7A 46 89 34 ... : ....Be9$U?....N........GK..-zF.4 ... using cached desync profile 2 packet: id=96 pass unmodified packet: id=97 len=114 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=AP seq=3813412906 ack_seq=2525601519 TCP: 17 03 03 00 39 C0 CF CD 7E C6 1B 47 A3 7C D3 CB 3C 90 51 14 56 4C 9A EE D2 08 20 81 62 AB 9D 3D ... : ....9...~..G.|..<.Q.VL.... .b..= ... using cached desync profile 2 packet: id=97 pass unmodified packet: id=98 len=52 mark=00000000 IP4: 37.9.64.225 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=38688 flags=A seq=3813412968 ack_seq=2525601611 using cached desync profile 2 packet: id=98 pass unmodified packet: id=99 len=60 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=S seq=922902211 ack_seq=0 desync profile search for tcp target=37.9.116.71:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=99 pass unmodified packet: id=100 len=60 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=SA seq=2914693616 ack_seq=922902212 using cached desync profile 2 incoming TTL 51 packet: id=100 pass unmodified packet: id=101 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=A seq=922902212 ack_seq=2914693617 using cached desync profile 2 packet: id=101 pass unmodified packet: id=102 len=570 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=AP seq=922902212 ack_seq=2914693617 TCP: 16 03 01 02 01 01 00 01 FD 03 03 DD F6 92 B0 7E 17 77 F2 A9 30 BC 44 56 08 B6 DF 75 39 CE 7E FC ... : ...............~.w..0.DV...u9.~. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 922902212-922902729 hostname: cloudcdn-mar-58.cdn.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=37.9.116.71:443 l7proto=tls hostname='cloudcdn-mar-58.cdn.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for cloudcdn-mar-58.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for cloudcdn-mar-58.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for cloudcdn-mar-58.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=102 pass unmodified packet: id=103 len=52 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=A seq=2914693617 ack_seq=922902730 using cached desync profile 2 packet: id=103 pass unmodified packet: id=104 len=1450 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=A seq=2914693617 ack_seq=922902730 TCP: 16 03 03 00 7A 02 00 00 76 03 03 5E 6B F3 70 13 8F A3 54 85 09 FB C1 2A 0B 44 C3 96 14 35 53 A5 ... : ....z...v..^k.p...T....*.D...5S. ... using cached desync profile 2 packet: id=104 pass unmodified packet: id=105 len=1450 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=A seq=2914695015 ack_seq=922902730 TCP: 43 49 B6 49 2D 83 CD 5D FA 8B 9F AD C1 6E 9E C3 8E E1 00 D0 A4 10 5B 1D 15 3D DD E3 01 E8 96 B9 ... : CI.I-..].....n........[..=...... ... using cached desync profile 2 packet: id=105 pass unmodified packet: id=106 len=1352 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=AP seq=2914696413 ack_seq=922902730 TCP: DE BB 23 C4 85 C5 22 9F 3A 3C 05 CC 2B F1 05 32 57 CB C7 6A B4 BC 54 84 87 22 4B 0F E7 B3 D7 5E ... : ..#...".:<..+..2W..j..T.."K....^ ... using cached desync profile 2 packet: id=106 pass unmodified packet: id=107 len=431 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=AP seq=2914697713 ack_seq=922902730 TCP: 0C 05 F7 98 08 64 35 36 11 E3 B3 1B 57 BB AC 76 33 A2 7C 17 03 03 01 19 E7 67 9C 3B B2 E4 7D AA ... : .....d56....W..v3.|......g.;..}. ... using cached desync profile 2 packet: id=107 pass unmodified packet: id=108 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=A seq=922902730 ack_seq=2914695015 using cached desync profile 2 packet: id=108 pass unmodified packet: id=109 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=A seq=922902730 ack_seq=2914696413 using cached desync profile 2 packet: id=109 pass unmodified packet: id=110 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=A seq=922902730 ack_seq=2914697713 using cached desync profile 2 packet: id=110 pass unmodified packet: id=111 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=A seq=922902730 ack_seq=2914698092 using cached desync profile 2 packet: id=111 pass unmodified packet: id=112 len=132 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=AP seq=922902730 ack_seq=2914698092 TCP: 14 03 03 00 01 01 17 03 03 00 45 94 E1 5D B0 44 D9 1D E0 8E 90 55 6C 38 7C 46 8C EC 76 27 87 5C ... : ..........E..].D.....Ul8|F..v'.\ ... using cached desync profile 2 req retrans : tcp seq 922902730 not within the req range 922902212-922902729. stop tracking. not applying tampering to unknown protocol packet: id=112 pass unmodified packet: id=113 len=144 mark=20000000 IP4: 192.168.1.8 => 37.9.116.71 proto=tcp ttl=63 sport=45522 dport=443 flags=AP seq=922902810 ack_seq=2914698092 TCP: 17 03 03 00 57 72 81 4D 44 5F C9 ED F6 26 79 99 B4 B2 AE 34 90 1B 9F 05 B8 42 6C 0D C5 72 78 3D ... : ....Wr.MD_...&y....4.....Bl..rx= ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=113 pass unmodified packet: id=114 len=52 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=A seq=2914698092 ack_seq=922902810 using cached desync profile 2 packet: id=114 pass unmodified packet: id=115 len=379 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=AP seq=2914698092 ack_seq=922902810 TCP: 17 03 03 01 42 B8 CE 32 C8 33 23 FA CF F9 00 3F 0E 16 5F BB 4B 16 86 AF 18 F3 64 FE C8 34 DE BE ... : ....B..2.3#....?.._.K.....d..4.. ... using cached desync profile 2 packet: id=115 pass unmodified packet: id=116 len=363 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=AP seq=2914698419 ack_seq=922902810 TCP: 17 03 03 01 32 15 9B D8 98 FB 6D 21 31 09 A4 9E 63 CC 92 AB B5 AA AB F4 40 C6 FB 7B D5 50 29 33 ... : ....2.....m!1...c.......@..{.P)3 ... using cached desync profile 2 packet: id=116 pass unmodified packet: id=117 len=114 mark=00000000 IP4: 37.9.116.71 => 192.168.1.8 proto=tcp ttl=51 sport=443 dport=45522 flags=AP seq=2914698730 ack_seq=922902810 TCP: 17 03 03 00 39 BD 06 83 53 7C 39 95 81 5B 00 07 95 0B AC 16 F3 7B 24 FC C8 92 AC 34 6D AE 30 75 ... : ....9...S|9..[.......{$....4m.0u ... using cached desync profile 2 packet: id=117 pass unmodified packet: id=118 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=S seq=414433079 ack_seq=0 desync profile search for tcp target=212.188.37.16:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=118 pass unmodified packet: id=119 len=60 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=SA seq=3534663106 ack_seq=414433080 using cached desync profile 2 incoming TTL 122 packet: id=119 pass unmodified packet: id=120 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=A seq=414433080 ack_seq=3534663107 using cached desync profile 2 packet: id=120 pass unmodified packet: id=121 len=788 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=AP seq=414433080 ack_seq=3534663107 TCP: 16 03 01 02 DB 01 00 02 D7 03 03 71 BD 1A BB 33 39 56 EF 7C DA C4 C5 C9 48 42 8C BF 12 FE 9E 3E ... : ...........q...39V.|....HB.....> ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 414433080-414433815 hostname: rr5---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.16:443 l7proto=tls hostname='rr5---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr5---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:36712 dst=212.188.37.16:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-735 len=735 : 03 01 02 DB 01 00 02 D7 03 03 71 BD 1A BB 33 39 56 EF 7C DA C4 C5 C9 48 42 8C BF 12 FE 9E 3E 5F ... : ..........q...39V.|....HB.....>_ ... packet: id=121 drop packet: id=122 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663107 ack_seq=414433081 using cached desync profile 1 packet: id=122 pass unmodified packet: id=123 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663107 ack_seq=414433816 using cached desync profile 1 packet: id=123 pass unmodified packet: id=124 len=255 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=AP seq=3534663107 ack_seq=414433816 TCP: 16 03 03 00 80 02 00 00 7C 03 03 A4 72 B0 BF 82 8F A7 4B 89 22 67 81 8B D2 92 08 3F 86 22 70 88 ... : ........|...r.....K."g.....?."p. ... using cached desync profile 1 packet: id=124 pass unmodified packet: id=125 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=A seq=414433816 ack_seq=3534663310 using cached desync profile 1 packet: id=125 pass unmodified packet: id=126 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=AP seq=414433816 ack_seq=3534663310 TCP: 14 03 03 00 01 01 17 03 03 00 35 9A 59 93 FD 4E CA D6 12 7D 72 9E 50 D7 AE 21 75 65 EF 9C AB 57 ... : ..........5.Y..N...}r.P..!ue...W ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=126 pass unmodified packet: id=127 len=1231 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=AP seq=414433880 ack_seq=3534663310 TCP: 17 03 03 04 96 B1 76 41 15 3A 2F B0 8F 1A B1 E2 0B 5C CD 65 E0 C8 64 F3 0F 47 2C 2F CB 83 E5 2B ... : ......vA.:/......\.e..d..G,/...+ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=127 pass unmodified packet: id=128 len=1452 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=A seq=414435059 ack_seq=3534663310 TCP: 17 03 03 09 58 0D F6 CD A4 8A E6 1E 72 F9 9C 1B 33 63 B3 9F 2B AB 96 A7 D9 74 0D EB CC 69 9F 64 ... : ....X.......r...3c..+....t...i.d ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=128 pass unmodified packet: id=129 len=1049 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=AP seq=414436459 ack_seq=3534663310 TCP: D0 2F D6 92 33 70 30 AA 59 4D BA 96 0A 9F FE ED 7F FD C3 4C 62 13 47 98 4A 41 88 31 AD C0 73 BC ... : ./..3p0.YM........Lb.G.JA.1..s. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=129 pass unmodified packet: id=130 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663310 ack_seq=414435059 using cached desync profile 1 packet: id=130 pass unmodified packet: id=131 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663310 ack_seq=414437456 using cached desync profile 1 packet: id=131 pass unmodified packet: id=132 len=722 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=AP seq=3534663310 ack_seq=414437456 TCP: 17 03 03 01 D2 EA 90 4D AC 17 E7 6C 0A BE 16 5C AF 8B 84 02 64 48 1C E9 22 D3 56 68 11 7B 18 7A ... : .......M...l...\....dH..".Vh.{.z ... using cached desync profile 1 packet: id=132 pass unmodified packet: id=133 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=A seq=414437456 ack_seq=3534663980 using cached desync profile 1 packet: id=133 pass unmodified packet: id=134 len=60 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=S seq=397863951 ack_seq=0 desync profile search for tcp target=37.9.116.35:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=134 pass unmodified packet: id=135 len=60 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=SA seq=2340386498 ack_seq=397863952 using cached desync profile 2 incoming TTL 52 packet: id=135 pass unmodified packet: id=136 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=A seq=397863952 ack_seq=2340386499 using cached desync profile 2 packet: id=136 pass unmodified packet: id=137 len=634 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=AP seq=397863952 ack_seq=2340386499 TCP: 16 03 01 02 41 01 00 02 3D 03 03 2E 8B 68 74 77 C4 7C 22 72 07 86 71 60 D5 7E 19 63 D0 A5 CD 9A ... : ....A...=....htw.|"r..q`.~.c.... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 397863952-397864533 hostname: cloudcdn-mar-48.cdn.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=37.9.116.35:443 l7proto=tls hostname='cloudcdn-mar-48.cdn.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for cloudcdn-mar-48.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for cloudcdn-mar-48.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for cloudcdn-mar-48.cdn.yandex.net : negative Hostlist check for cdn.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=137 pass unmodified packet: id=138 len=52 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=A seq=2340386499 ack_seq=397864534 using cached desync profile 2 packet: id=138 pass unmodified packet: id=139 len=1450 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=A seq=2340386499 ack_seq=397864534 TCP: 16 03 03 00 7A 02 00 00 76 03 03 96 C5 29 D7 14 7D 10 18 7B 14 84 2E C0 52 48 0A 08 6F 08 BD DD ... : ....z...v....)..}..{....RH..o... ... using cached desync profile 2 packet: id=139 pass unmodified packet: id=140 len=1450 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=A seq=2340387897 ack_seq=397864534 TCP: FD 58 81 69 8C BC 08 85 96 E1 D4 6B 1E CC F6 EC 51 8A 91 BC 02 3C 31 EE AC BE D0 B8 43 AA 17 01 ... : .X.i.......k....Q....<1.....C... ... using cached desync profile 2 packet: id=140 pass unmodified packet: id=141 len=1352 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=AP seq=2340389295 ack_seq=397864534 TCP: D6 17 E3 C1 AE B1 8C 63 1F 2E 5B B3 5A AE 92 CB 6A BE E8 B7 9F 59 7D D6 83 13 9B 17 09 C7 BA FE ... : .......c..[.Z...j....Y}......... ... using cached desync profile 2 packet: id=141 pass unmodified packet: id=142 len=431 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=AP seq=2340390595 ack_seq=397864534 TCP: 7C E2 67 51 10 48 7B 60 24 B9 F6 C0 BA EE A6 AB 7C 6A 9F 17 03 03 01 19 B0 CB 3F 5D 9F A2 AC 3A ... : |.gQ.H{`$.......|j........?]...: ... using cached desync profile 2 packet: id=142 pass unmodified packet: id=143 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=A seq=397864534 ack_seq=2340387897 using cached desync profile 2 packet: id=143 pass unmodified packet: id=144 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=A seq=397864534 ack_seq=2340389295 using cached desync profile 2 packet: id=144 pass unmodified packet: id=145 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=A seq=397864534 ack_seq=2340390595 using cached desync profile 2 packet: id=145 pass unmodified packet: id=146 len=52 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=A seq=397864534 ack_seq=2340390974 using cached desync profile 2 packet: id=146 pass unmodified packet: id=147 len=132 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=AP seq=397864534 ack_seq=2340390974 TCP: 14 03 03 00 01 01 17 03 03 00 45 DE 1D C0 30 1C 39 D4 A1 C3 81 DA 2E 1A A5 4E 76 AB 9E E5 20 24 ... : ..........E...0.9........Nv... $ ... using cached desync profile 2 req retrans : tcp seq 397864534 not within the req range 397863952-397864533. stop tracking. not applying tampering to unknown protocol packet: id=147 pass unmodified packet: id=148 len=144 mark=20000000 IP4: 192.168.1.8 => 37.9.116.35 proto=tcp ttl=63 sport=54998 dport=443 flags=AP seq=397864614 ack_seq=2340390974 TCP: 17 03 03 00 57 B2 B4 CC 77 3D 4B 83 10 2E FF AE 21 3F EF 8A 78 6A 55 35 68 A7 E1 84 0E 04 31 32 ... : ....W...w=K.....!?..xjU5h.....12 ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=148 pass unmodified packet: id=149 len=52 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=A seq=2340390974 ack_seq=397864614 using cached desync profile 2 packet: id=149 pass unmodified packet: id=150 len=363 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=AP seq=2340390974 ack_seq=397864614 TCP: 17 03 03 01 32 F1 D0 D2 0A CA 71 ED B5 BF A8 F0 4C 0C 1A 55 56 86 CF 06 D5 7A 81 A4 DD 00 BD 58 ... : ....2.....q.....L..UV....z.....X ... using cached desync profile 2 packet: id=150 pass unmodified packet: id=151 len=379 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=AP seq=2340391285 ack_seq=397864614 TCP: 17 03 03 01 42 46 2A 42 39 FB 15 2C C3 16 E3 A1 5E 6A C2 8D C4 8C 17 87 CF 7D E9 B1 3C 66 9C C6 ... : ....BF*B9..,....^j.......}.. 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=AP seq=2340391612 ack_seq=397864614 TCP: 17 03 03 00 39 8A F2 90 EC 1A D6 F2 5A B9 12 7D CF 1D 1B D8 A7 8A 0D 8E AC F1 03 D7 AE 60 73 C5 ... : ....9.......Z..}.............`s. ... using cached desync profile 2 packet: id=152 pass unmodified packet: id=153 len=64 mark=00000000 IP4: 37.9.116.35 => 192.168.1.8 proto=tcp ttl=52 sport=443 dport=54998 flags=A seq=2340391674 ack_seq=397864614 using cached desync profile 2 packet: id=153 pass unmodified packet: id=154 len=1231 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=36712 dport=443 flags=AP seq=414437456 ack_seq=3534663980 TCP: 17 03 03 04 96 E8 45 FE 09 4C 84 5C 48 7B 4E A0 FC D6 A6 A9 9C B4 A0 C7 58 1A D2 35 61 6B 8A 4A ... : ......E..L.\H{N.........X..5ak.J ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=154 pass unmodified packet: id=155 len=64 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663980 ack_seq=414437456 using cached desync profile 1 packet: id=155 pass unmodified packet: id=156 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36712 flags=A seq=3534663980 ack_seq=414440942 using cached desync profile 1 packet: id=156 pass unmodified packet: id=157 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=S seq=2184551289 ack_seq=0 desync profile search for tcp target=17.157.64.66:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=157 pass unmodified packet: id=158 len=64 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=S seq=2428865175 ack_seq=0 desync profile search for tcp target=76.76.2.22:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=158 pass unmodified packet: id=159 len=60 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=SA seq=3438999348 ack_seq=2428865176 using cached desync profile 2 incoming TTL 55 packet: id=159 pass unmodified packet: id=160 len=52 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=A seq=2428865176 ack_seq=3438999349 using cached desync profile 2 packet: id=160 pass unmodified packet: id=161 len=569 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=AP seq=2428865176 ack_seq=3438999349 TCP: 16 03 01 02 00 01 00 01 FC 03 03 92 E6 AC AA C8 5E 89 ED 15 8E D8 37 83 0E DF 29 54 A5 95 A0 AB ... : ................^.....7...)T.... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2428865176-2428865692 hostname: dns.controld.com discovered l7 protocol discovered hostname desync profile search for tcp target=76.76.2.22:443 l7proto=tls hostname='dns.controld.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for dns.controld.com : negative Hostlist check for controld.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for dns.controld.com : negative Hostlist check for controld.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for dns.controld.com : negative Hostlist check for controld.com : negative Hostlist check for com : negative not applying tampering to this request packet: id=161 pass unmodified packet: id=162 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=S seq=3125485760 ack_seq=0 desync profile search for tcp target=17.157.64.79:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=162 pass unmodified packet: id=163 len=52 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=A seq=3438999349 ack_seq=2428865693 using cached desync profile 2 packet: id=163 pass unmodified packet: id=164 len=1500 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=A seq=3438999349 ack_seq=2428865693 TCP: 16 03 03 00 7A 02 00 00 76 03 03 C2 E3 7E 64 49 96 F1 3F AF 7C 79 B9 0C 49 A5 D8 62 81 6E CB 3B ... : ....z...v....~dI..?.|y..I..b.n.; ... using cached desync profile 2 packet: id=164 pass unmodified packet: id=165 len=793 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=AP seq=3439002245 ack_seq=2428865693 TCP: 09 7D E0 65 A7 B3 A9 D8 78 CD 61 F0 29 52 58 E4 07 E7 C7 FF 68 33 FB 9D F7 3C D7 4F 58 3C B5 A9 ... : .}.e....x.a.)RX.....h3...<.OX<.. ... using cached desync profile 2 packet: id=165 pass unmodified packet: id=166 len=1500 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=AP seq=3439000797 ack_seq=2428865693 TCP: 88 BF F0 34 B8 4E BB 5E 61 4E F6 97 7D 17 BB F6 E0 7F 57 29 B9 5D 3D E5 FA 4C 33 96 C5 85 95 7B ... : ...4.N.^aN..}....W).]=..L3....{ ... using cached desync profile 2 packet: id=166 pass unmodified packet: id=167 len=64 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=A seq=2428865693 ack_seq=3439000797 using cached desync profile 2 packet: id=167 pass unmodified packet: id=168 len=52 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=A seq=2428865693 ack_seq=3439002986 using cached desync profile 2 packet: id=168 pass unmodified packet: id=169 len=116 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=AP seq=2428865693 ack_seq=3439002986 TCP: 14 03 03 00 01 01 17 03 03 00 35 85 45 9B 91 6F 68 07 72 A4 85 3A BF 51 BF 8D 85 B9 5B C0 B4 2C ... : ..........5.E..oh.r..:.Q....[.., ... using cached desync profile 2 req retrans : tcp seq 2428865693 not within the req range 2428865176-2428865692. stop tracking. not applying tampering to unknown protocol packet: id=169 pass unmodified packet: id=170 len=76 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=AFP seq=2428865757 ack_seq=3439002986 TCP: 17 03 03 00 13 BB 9B D0 99 C5 B5 12 93 F8 37 41 EB B4 0E 35 65 65 F1 39 : ..............7A...5ee.9 using cached desync profile 2 not applying tampering to unknown protocol packet: id=170 pass unmodified packet: id=171 len=113 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=AP seq=3439002986 ack_seq=2428865757 TCP: 17 03 03 00 38 08 B5 24 25 89 E4 61 92 44 67 62 93 1E 49 5F 31 57 00 BB 9A 09 2C 3D AF 42 B1 E6 ... : ....8..$%..a.Dgb..I_1W....,=.B.. ... using cached desync profile 2 packet: id=171 pass unmodified packet: id=172 len=76 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=AP seq=3439003047 ack_seq=2428865782 TCP: 17 03 03 00 13 FA 21 F3 AF 34 2D 2A 89 AB 3B F8 A6 38 9D E5 D7 3C D1 40 : ......!..4-*..;..8...<.@ using cached desync profile 2 packet: id=172 pass unmodified packet: id=173 len=52 mark=00000000 IP4: 76.76.2.22 => 192.168.1.8 proto=tcp ttl=55 sport=443 dport=64225 flags=AF seq=3439003071 ack_seq=2428865782 using cached desync profile 2 packet: id=173 pass unmodified packet: id=174 len=40 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=R seq=2428865757 ack_seq=0 using cached desync profile 2 packet: id=174 pass unmodified packet: id=175 len=40 mark=20000000 IP4: 192.168.1.8 => 76.76.2.22 proto=tcp ttl=63 sport=64225 dport=443 flags=R seq=2428865782 ack_seq=0 using cached desync profile 2 packet: id=175 pass unmodified packet: id=176 len=60 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=SA seq=3829552024 ack_seq=2184551290 using cached desync profile 2 incoming TTL 43 packet: id=176 pass unmodified packet: id=177 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551290 ack_seq=3829552025 using cached desync profile 2 packet: id=177 pass unmodified packet: id=178 len=569 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=AP seq=2184551290 ack_seq=3829552025 TCP: 16 03 01 02 00 01 00 01 FC 03 03 FD D0 24 AC 8B 60 42 10 50 A6 80 2D E1 A2 86 A9 DF B8 EB 9D FC ... : .............$..`B.P..-......... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2184551290-2184551806 hostname: gsa.apple.com discovered l7 protocol discovered hostname desync profile search for tcp target=17.157.64.66:443 l7proto=tls hostname='gsa.apple.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative not applying tampering to this request packet: id=178 pass unmodified packet: id=179 len=60 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=SA seq=229662100 ack_seq=3125485761 using cached desync profile 2 incoming TTL 43 packet: id=179 pass unmodified packet: id=180 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125485761 ack_seq=229662101 using cached desync profile 2 packet: id=180 pass unmodified packet: id=181 len=569 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=AP seq=3125485761 ack_seq=229662101 TCP: 16 03 01 02 00 01 00 01 FC 03 03 E8 79 75 2B 27 0B D0 1B BC CF 52 0E 59 E7 9B A1 8D 5F 08 0D E1 ... : ............yu+'.....R.Y...._... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3125485761-3125486277 hostname: gsas.apple.com discovered l7 protocol discovered hostname desync profile search for tcp target=17.157.64.79:443 l7proto=tls hostname='gsas.apple.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for gsas.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for gsas.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for gsas.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative not applying tampering to this request packet: id=181 pass unmodified packet: id=182 len=52 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829552025 ack_seq=2184551807 using cached desync profile 2 packet: id=182 pass unmodified packet: id=183 len=982 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=AP seq=3829554921 ack_seq=2184551807 TCP: 1D 06 03 55 1D 0E 04 16 04 14 2B D0 69 47 94 76 09 FE F4 6B 8D 2E 40 A6 F7 47 4D 7F 08 5E 30 1F ... : ...U......+.iG.v...k..@..GM.^0. ... using cached desync profile 2 packet: id=183 pass unmodified packet: id=184 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829552025 ack_seq=2184551807 TCP: 16 03 03 00 70 02 00 00 6C 03 03 D7 23 D3 F3 E8 65 2D 48 BD 07 84 37 83 62 BB B7 0A 3E 28 0C 50 ... : ....p...l...#...e-H...7.b...>(.P ... using cached desync profile 2 packet: id=184 pass unmodified packet: id=185 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829553473 ack_seq=2184551807 TCP: 30 25 06 03 55 04 03 0C 1E 41 70 70 6C 65 20 53 65 72 76 65 72 20 41 75 74 68 65 6E 74 69 63 61 ... : 0%..U....Apple Server Authentica ... using cached desync profile 2 packet: id=185 pass unmodified packet: id=186 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551807 ack_seq=3829552025 using cached desync profile 2 packet: id=186 pass unmodified packet: id=187 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551807 ack_seq=3829553473 using cached desync profile 2 packet: id=187 pass unmodified packet: id=188 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551807 ack_seq=3829555851 using cached desync profile 2 packet: id=188 pass unmodified packet: id=189 len=145 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=AP seq=2184551807 ack_seq=3829555851 TCP: 16 03 03 00 25 10 00 00 21 20 A7 99 E8 25 58 5D E6 E4 F1 E4 3B A9 6A 5F 2F A0 DE F2 B0 81 E6 D3 ... : ....%...! ...%X]....;.j_/....... ... using cached desync profile 2 req retrans : tcp seq 2184551807 not within the req range 2184551290-2184551806. stop tracking. not applying tampering to unknown protocol packet: id=189 pass unmodified packet: id=190 len=52 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229662101 ack_seq=3125486278 using cached desync profile 2 packet: id=190 pass unmodified packet: id=191 len=982 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=AP seq=229664997 ack_seq=3125486278 TCP: 1D 06 03 55 1D 0E 04 16 04 14 2B D0 69 47 94 76 09 FE F4 6B 8D 2E 40 A6 F7 47 4D 7F 08 5E 30 1F ... : ...U......+.iG.v...k..@..GM.^0. ... using cached desync profile 2 packet: id=191 pass unmodified packet: id=192 len=1500 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229662101 ack_seq=3125486278 TCP: 16 03 03 00 70 02 00 00 6C 03 03 F2 1B B1 5F D9 27 40 EA 5F E1 39 17 BF 73 F9 93 CC 4E 7F 3E 42 ... : ....p...l....._.'@._.9..s...N>B ... using cached desync profile 2 packet: id=192 pass unmodified packet: id=193 len=1500 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229663549 ack_seq=3125486278 TCP: 30 25 06 03 55 04 03 0C 1E 41 70 70 6C 65 20 53 65 72 76 65 72 20 41 75 74 68 65 6E 74 69 63 61 ... : 0%..U....Apple Server Authentica ... using cached desync profile 2 packet: id=193 pass unmodified packet: id=194 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125486278 ack_seq=229662101 using cached desync profile 2 packet: id=194 pass unmodified packet: id=195 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125486278 ack_seq=229663549 using cached desync profile 2 packet: id=195 pass unmodified packet: id=196 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125486278 ack_seq=229665927 using cached desync profile 2 packet: id=196 pass unmodified packet: id=197 len=145 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=AP seq=3125486278 ack_seq=229665927 TCP: 16 03 03 00 25 10 00 00 21 20 7F 15 E2 7A BB A3 E1 06 40 A3 24 37 35 55 7A B4 D3 2C A3 6E 82 89 ... : ....%...! ..z....@.$75Uz..,.n.. ... using cached desync profile 2 req retrans : tcp seq 3125486278 not within the req range 3125485761-3125486277. stop tracking. not applying tampering to unknown protocol packet: id=197 pass unmodified packet: id=198 len=103 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=AP seq=3829555851 ack_seq=2184551900 TCP: 14 03 03 00 01 01 16 03 03 00 28 F2 69 02 C6 C4 64 49 6B 0C B8 F8 30 1B B8 38 71 8E 9A 35 44 8C ... : ..........(.i...dIk...0..8q..5D. ... using cached desync profile 2 packet: id=198 pass unmodified packet: id=199 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551900 ack_seq=3829555902 using cached desync profile 2 packet: id=199 pass unmodified packet: id=200 len=1460 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=A seq=2184551900 ack_seq=3829555902 TCP: 17 03 03 06 2E 00 00 00 00 00 00 00 01 76 58 3F FA F6 6C 49 CB 15 4B 1E FC 25 4B EC C5 81 C1 E7 ... : .............vX?..lI..K..%K..... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=200 pass unmodified packet: id=201 len=231 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64224 dport=443 flags=AP seq=2184553308 ack_seq=3829555902 TCP: 2F 2F 7E 8F 28 14 3F 2B 11 82 99 E4 47 2F 8E 60 EF 82 AC 67 DA F5 18 9C 64 E7 13 A4 D8 44 3A 45 ... : //~.(.?+....G/.`...g....d....D:E ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=201 pass unmodified packet: id=202 len=103 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=AP seq=229665927 ack_seq=3125486371 TCP: 14 03 03 00 01 01 16 03 03 00 28 1E FB F5 9C 68 FD E5 EA 89 99 E5 FF B7 8C 0B 72 FB 52 77 96 E1 ... : ..........(....h..........r.Rw.. ... using cached desync profile 2 packet: id=202 pass unmodified packet: id=203 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125486371 ack_seq=229665978 using cached desync profile 2 packet: id=203 pass unmodified packet: id=204 len=1460 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=A seq=3125486371 ack_seq=229665978 TCP: 17 03 03 06 49 00 00 00 00 00 00 00 01 40 64 CC 63 BC 2E 49 EB FB C7 F9 29 62 0A F7 35 10 63 68 ... : ....I........@d.c..I....)b..5.ch ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=204 pass unmodified packet: id=205 len=258 mark=20000000 IP4: 192.168.1.8 => 17.157.64.79 proto=tcp ttl=63 sport=64227 dport=443 flags=AP seq=3125487779 ack_seq=229665978 TCP: 59 7E 96 BB E7 C3 D3 03 1E F9 A5 83 A0 78 0B FE 94 F5 46 19 69 F3 A4 C9 FF 82 0D 3A B8 DA E3 14 ... : Y~...........x....F.i......:.... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=205 pass unmodified packet: id=206 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=S seq=293432966 ack_seq=0 desync profile search for tcp target=212.188.37.45:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=206 pass unmodified packet: id=207 len=60 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=SA seq=2995400492 ack_seq=293432967 using cached desync profile 2 incoming TTL 120 packet: id=207 pass unmodified packet: id=208 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=A seq=293432967 ack_seq=2995400493 using cached desync profile 2 packet: id=208 pass unmodified packet: id=209 len=884 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=AP seq=293432967 ack_seq=2995400493 TCP: 16 03 01 03 3B 01 00 03 37 03 03 E2 9B 5A 6D B9 BA D6 7A 1A 2B 9C 72 58 10 88 F0 8C 6B 61 FB 8D ... : ....;...7....Zm...z.+.rX....ka.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 293432967-293433798 hostname: rr2---sn-jvhnu5g-c35k.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.45:443 l7proto=tls hostname='rr2---sn-jvhnu5g-c35k.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-jvhnu5g-c35k.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:38838 dst=212.188.37.45:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-831 len=831 : 03 01 03 3B 01 00 03 37 03 03 E2 9B 5A 6D B9 BA D6 7A 1A 2B 9C 72 58 10 88 F0 8C 6B 61 FB 8D 7E ... : ...;...7....Zm...z.+.rX....ka..~ ... packet: id=209 drop packet: id=210 len=255 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=AP seq=2995400493 ack_seq=293433799 TCP: 16 03 03 00 80 02 00 00 7C 03 03 16 E8 FE C9 E1 F9 7F E5 B4 76 0E D7 36 21 B3 1C AD DD EC 92 2D ... : ........|..........v..6!......- ... using cached desync profile 1 packet: id=210 pass unmodified packet: id=211 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=A seq=2995400493 ack_seq=293432968 using cached desync profile 1 packet: id=211 pass unmodified packet: id=212 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=A seq=2995400493 ack_seq=293433799 using cached desync profile 1 packet: id=212 pass unmodified packet: id=213 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=A seq=293433799 ack_seq=2995400696 using cached desync profile 1 packet: id=213 pass unmodified packet: id=214 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=A seq=293433799 ack_seq=2995400696 using cached desync profile 1 packet: id=214 pass unmodified packet: id=215 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=AP seq=293433799 ack_seq=2995400696 TCP: 14 03 03 00 01 01 17 03 03 00 35 B4 93 34 26 C1 8A 6C CB 61 0E D3 0E 91 07 5E D3 F7 5B 97 E2 4E ... : ..........5..4&..l.a.....^..[..N ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=215 pass unmodified packet: id=216 len=685 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=AP seq=293433863 ack_seq=2995400696 TCP: 17 03 03 02 74 43 B6 BF E1 A8 7F AA 59 BF 95 55 BD B9 FB 72 69 8F 64 B3 2D ED 9A 24 C1 4B 93 49 ... : ....tC.....Y..U...ri.d.-..$.K.I ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=216 pass unmodified packet: id=217 len=1452 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=A seq=293434496 ack_seq=2995400696 TCP: 17 03 03 0F 96 B1 1E 73 8A 38 39 EC 45 9E DC B5 9E 19 BC 00 92 6E 68 DC 0A 40 0D DD 38 AB 86 A9 ... : .......s.89.E........nh..@..8... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=217 pass unmodified packet: id=218 len=1452 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=AP seq=293435896 ack_seq=2995400696 TCP: 5F 50 EB B4 BF EA D1 BB B5 7F F0 91 47 FF DC 90 2F B9 6C 29 58 BF 08 D5 26 76 5A A4 A4 85 13 72 ... : _P.........G.../.l)X...&vZ....r ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=218 pass unmodified packet: id=219 len=1247 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38838 dport=443 flags=AP seq=293437296 ack_seq=2995400696 TCP: 0B E0 30 88 B2 E0 1B 6D 17 23 F9 36 80 8B F6 B4 2A A5 CB B1 23 A8 A0 8F 48 BB FA 74 26 0D 49 91 ... : ..0....m.#.6....*...#...H..t&.I. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=219 pass unmodified packet: id=220 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=A seq=2995400696 ack_seq=293434496 using cached desync profile 1 packet: id=220 pass unmodified packet: id=221 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=A seq=2995400696 ack_seq=293437296 using cached desync profile 1 packet: id=221 pass unmodified packet: id=222 len=522 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=AP seq=2995400696 ack_seq=293438491 TCP: 17 03 03 01 D1 42 95 94 3D 55 E1 25 4D D7 F1 EB 88 23 C8 E9 E2 02 EE 06 A3 85 C2 EB 5F CD CB 4C ... : .....B..=U.%M....#.........._..L ... using cached desync profile 1 packet: id=222 pass unmodified packet: id=223 len=77 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=AP seq=2995401166 ack_seq=293438491 TCP: 17 03 03 00 14 2E C3 70 D9 E8 BC 1C 93 99 82 3C 29 E2 60 5B F5 3E 92 C3 B8 : .......p.......<).`[.>... using cached desync profile 1 packet: id=223 pass unmodified packet: id=224 len=184 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38838 flags=AP seq=2995401191 ack_seq=293438491 TCP: 17 03 03 00 15 48 12 B3 37 00 3F 32 90 50 4F 1B A2 0A 1A A3 B5 81 3D 49 B3 58 17 03 03 00 13 35 ... : .....H..7.?2.PO.......=I.X.....5 ... using cached desync profile 1 packet: id=224 pass unmodified packet: id=225 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=S seq=1905776123 ack_seq=0 desync profile search for tcp target=212.188.37.45:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=225 pass unmodified packet: id=226 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=S seq=1821733185 ack_seq=0 desync profile search for tcp target=212.188.37.45:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=226 pass unmodified packet: id=227 len=60 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=SA seq=3326153094 ack_seq=1905776124 using cached desync profile 2 incoming TTL 120 packet: id=227 pass unmodified packet: id=228 len=60 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=SA seq=1558558990 ack_seq=1821733186 using cached desync profile 2 incoming TTL 120 packet: id=228 pass unmodified packet: id=229 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=A seq=1905776124 ack_seq=3326153095 using cached desync profile 2 packet: id=229 pass unmodified packet: id=230 len=884 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=AP seq=1905776124 ack_seq=3326153095 TCP: 16 03 01 03 3B 01 00 03 37 03 03 7A DF 51 52 56 5A D6 A5 76 BD A9 51 F0 FE E4 67 19 47 B7 A8 93 ... : ....;...7..z.QRVZ..v..Q...g.G... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1905776124-1905776955 hostname: rr2---sn-jvhnu5g-c35k.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.45:443 l7proto=tls hostname='rr2---sn-jvhnu5g-c35k.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-jvhnu5g-c35k.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:38844 dst=212.188.37.45:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-831 len=831 : 03 01 03 3B 01 00 03 37 03 03 7A DF 51 52 56 5A D6 A5 76 BD A9 51 F0 FE E4 67 19 47 B7 A8 93 D1 ... : ...;...7..z.QRVZ..v..Q...g.G.... ... packet: id=230 drop packet: id=231 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=A seq=1821733186 ack_seq=1558558991 using cached desync profile 2 packet: id=231 pass unmodified packet: id=232 len=641 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=AP seq=1821733186 ack_seq=1558558991 TCP: 16 03 01 02 48 01 00 02 44 03 03 44 4B 62 94 6A F2 E9 E0 4D 4C EE B6 E2 80 B1 33 B0 4C 45 2C 2C ... : ....H...D..DKb.j...ML.....3.LE,, ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1821733186-1821733774 hostname: rr2---sn-jvhnu5g-c35k.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.45:443 l7proto=tls hostname='rr2---sn-jvhnu5g-c35k.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-jvhnu5g-c35k.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:38850 dst=212.188.37.45:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-588 len=588 : 03 01 02 48 01 00 02 44 03 03 44 4B 62 94 6A F2 E9 E0 4D 4C EE B6 E2 80 B1 33 B0 4C 45 2C 2C 9C ... : ...H...D..DKb.j...ML.....3.LE,,. ... packet: id=232 drop packet: id=233 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=A seq=3326153095 ack_seq=1905776125 using cached desync profile 1 packet: id=233 pass unmodified packet: id=234 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=A seq=3326153095 ack_seq=1905776956 using cached desync profile 1 packet: id=234 pass unmodified packet: id=235 len=255 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=AP seq=3326153095 ack_seq=1905776956 TCP: 16 03 03 00 80 02 00 00 7C 03 03 F3 DB FC 19 82 E6 F4 91 3F 26 DD 22 F8 B9 B7 A6 42 49 03 DE 03 ... : ........|..........?&."....BI... ... using cached desync profile 1 packet: id=235 pass unmodified packet: id=236 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558558991 ack_seq=1821733187 using cached desync profile 1 packet: id=236 pass unmodified packet: id=237 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558558991 ack_seq=1821733775 using cached desync profile 1 packet: id=237 pass unmodified packet: id=238 len=1452 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558558991 ack_seq=1821733775 TCP: 16 03 03 00 7A 02 00 00 76 03 03 AB 3D A3 CA BA 58 C2 E4 D0 EC 67 3B 28 A5 95 A0 BE 65 C8 97 69 ... : ....z...v...=...X....g;(....e..i ... using cached desync profile 1 packet: id=238 pass unmodified packet: id=239 len=1452 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558560391 ack_seq=1821733775 TCP: 80 15 FD 67 A7 B8 97 DE E2 30 66 62 FF 4E 29 B9 F4 63 07 AB F6 F2 12 5B 39 E6 DB 7E EF E0 45 4E ... : ...g.....0fb.N)..c.....[9..~..EN ... using cached desync profile 1 packet: id=239 pass unmodified packet: id=240 len=1452 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558561791 ack_seq=1821733775 TCP: 23 AF 51 D1 2F 40 D9 1B 69 B5 CF BC 91 04 CE A0 27 D3 46 6E 8E 74 55 1C CA 11 7C 77 72 69 E2 9E ... : #.Q./@..i.......'.Fn.tU...|wri.. ... using cached desync profile 1 packet: id=240 pass unmodified packet: id=241 len=370 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=AP seq=1558563191 ack_seq=1821733775 TCP: EF 40 20 B6 79 0F 51 C5 95 DA B7 D4 37 1B 40 91 46 87 87 86 0A AE 11 6E 69 A3 5F 83 92 49 4B 9D ... : .@ .y.Q.....7.@.F......ni._..IK. ... using cached desync profile 1 packet: id=241 pass unmodified packet: id=242 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=A seq=1905776956 ack_seq=3326153298 using cached desync profile 1 packet: id=242 pass unmodified packet: id=243 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=AP seq=1905776956 ack_seq=3326153298 TCP: 14 03 03 00 01 01 17 03 03 00 35 96 E1 8E DE 89 07 B4 17 5B EC F7 7E 2E BF CE DF CA 8F 05 64 50 ... : ..........5........[..~.......dP ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=243 pass unmodified packet: id=244 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=AP seq=1905777020 ack_seq=3326153298 TCP: 17 03 03 02 60 69 23 22 0A 50 72 66 77 AC 9C 76 34 B2 54 4D 75 06 19 F4 E2 2E 5D E0 03 22 F9 7F ... : ....`i#".Prfw..v4.TMu.....]..". ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=244 pass unmodified packet: id=245 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=A seq=1821733775 ack_seq=1558560391 using cached desync profile 1 packet: id=245 pass unmodified packet: id=246 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=A seq=1821733775 ack_seq=1558561791 using cached desync profile 1 packet: id=246 pass unmodified packet: id=247 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=A seq=1821733775 ack_seq=1558563191 using cached desync profile 1 packet: id=247 pass unmodified packet: id=248 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=A seq=1821733775 ack_seq=1558563509 using cached desync profile 1 packet: id=248 pass unmodified packet: id=249 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=AP seq=1821733775 ack_seq=1558563509 TCP: 14 03 03 00 01 01 17 03 03 00 35 48 5D CF CF A8 4A 99 18 F8 0B 92 07 35 0C 81 AA 80 DA 88 BA A8 ... : ..........5H]...J......5........ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=249 pass unmodified packet: id=250 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38850 dport=443 flags=AP seq=1821733839 ack_seq=1558563509 TCP: 17 03 03 02 60 51 98 B9 90 02 58 5C EE 44 F7 B4 91 F1 FC ED 2D 54 CB 40 9F 82 AF F3 0D 5E 02 D8 ... : ....`Q....X\.D......-T.@.....^.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=250 pass unmodified packet: id=251 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=A seq=3326153298 ack_seq=1905777633 using cached desync profile 1 packet: id=251 pass unmodified packet: id=252 len=797 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=AP seq=3326153298 ack_seq=1905777633 TCP: 17 03 03 01 85 81 06 1B 5E 4A 5C B5 0D 3E A8 6F 06 38 9D E3 F0 D8 8A 2E E5 18 F4 99 27 62 EE 78 ... : ........^J\..>.o.8..........'b.x ... using cached desync profile 1 packet: id=252 pass unmodified packet: id=253 len=52 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=A seq=1558563509 ack_seq=1821734452 using cached desync profile 1 packet: id=253 pass unmodified packet: id=254 len=797 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=AP seq=1558563509 ack_seq=1821734452 TCP: 17 03 03 01 85 5F F9 65 D1 5E DE A4 C1 C5 AF 68 57 2F 73 C0 06 2B B6 74 F3 6F C7 68 D3 37 B2 B9 ... : ....._.e.^.....hW/s..+.t.o.h.7.. ... using cached desync profile 1 packet: id=254 pass unmodified packet: id=255 len=52 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829555902 ack_seq=2184553487 using cached desync profile 2 packet: id=255 pass unmodified packet: id=256 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=A seq=1905777633 ack_seq=3326154043 using cached desync profile 1 packet: id=256 pass unmodified packet: id=257 len=64 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229665978 ack_seq=3125486371 using cached desync profile 2 packet: id=257 pass unmodified packet: id=258 len=64 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229665978 ack_seq=3125486371 using cached desync profile 2 packet: id=258 pass unmodified packet: id=259 len=64 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229665978 ack_seq=3125486371 using cached desync profile 2 packet: id=259 pass unmodified packet: id=260 len=64 mark=00000000 IP4: 17.157.64.79 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64227 flags=A seq=229665978 ack_seq=3125487779 using cached desync profile 2 packet: id=260 pass unmodified packet: id=261 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829555902 ack_seq=2184553487 TCP: 17 03 03 12 A8 F2 69 02 C6 C4 64 49 6C 5F 6F FA 73 51 CA 0B CE C9 9F DB C2 59 E1 D2 E9 12 99 48 ... : ......i...dIl_o.sQ.......Y.....H ... using cached desync profile 2 packet: id=261 pass unmodified packet: id=262 len=489 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=AP seq=3829560246 ack_seq=2184553487 TCP: 0A D3 3B C1 5A 43 A3 B9 30 E8 AA A0 3B 76 37 91 10 0B D0 25 E7 FB 26 B6 F0 92 5C 8C 53 21 EE 52 ... : ..;.ZC..0...;v7....%..&...\.S!.R ... using cached desync profile 2 packet: id=262 pass unmodified packet: id=263 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=43 sport=443 dport=64224 flags=A seq=3829557350 ack_seq=2184553487 TCP: 4C 60 C4 66 78 05 B7 46 DC 7C C4 0D DC F8 0B C8 A9 8A EA D8 C8 60 88 77 88 97 FD BE 24 F1 D0 66 ... : L`.fx..F.|...........`.w....$..f ... using cached desync profile 2 packet: id=263 pass unmodified packet: id=264 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=S seq=3746482189 ack_seq=0 desync profile search for tcp target=17.157.64.66:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=264 pass unmodified packet: id=265 len=60 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=SA seq=4023686931 ack_seq=3746482190 using cached desync profile 2 incoming TTL 44 packet: id=265 pass unmodified packet: id=266 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=A seq=3746482190 ack_seq=4023686932 using cached desync profile 2 packet: id=266 pass unmodified packet: id=267 len=569 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=AP seq=3746482190 ack_seq=4023686932 TCP: 16 03 01 02 00 01 00 01 FC 03 03 6C A8 BF 82 86 8A D9 94 F9 3D 3E FD 4A 15 63 54 78 76 77 36 89 ... : ...........l........=>.J.cTxvw6. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3746482190-3746482706 hostname: gsa.apple.com discovered l7 protocol discovered hostname desync profile search for tcp target=17.157.64.66:443 l7proto=tls hostname='gsa.apple.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for gsa.apple.com : negative Hostlist check for apple.com : negative Hostlist check for com : negative not applying tampering to this request packet: id=267 pass unmodified packet: id=268 len=52 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023686932 ack_seq=3746482707 using cached desync profile 2 packet: id=268 pass unmodified packet: id=269 len=982 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=AP seq=4023689828 ack_seq=3746482707 TCP: 1D 06 03 55 1D 0E 04 16 04 14 2B D0 69 47 94 76 09 FE F4 6B 8D 2E 40 A6 F7 47 4D 7F 08 5E 30 1F ... : ...U......+.iG.v...k..@..GM.^0. ... using cached desync profile 2 packet: id=269 pass unmodified packet: id=270 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023686932 ack_seq=3746482707 TCP: 16 03 03 00 70 02 00 00 6C 03 03 A7 CF 50 7F 9F 9A D7 94 FB DC 55 1E 89 8C FB E1 FB 25 36 73 A1 ... : ....p...l....P......U......%6s. ... using cached desync profile 2 packet: id=270 pass unmodified packet: id=271 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023688380 ack_seq=3746482707 TCP: 30 25 06 03 55 04 03 0C 1E 41 70 70 6C 65 20 53 65 72 76 65 72 20 41 75 74 68 65 6E 74 69 63 61 ... : 0%..U....Apple Server Authentica ... using cached desync profile 2 packet: id=271 pass unmodified packet: id=272 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=A seq=3746482707 ack_seq=4023686932 using cached desync profile 2 packet: id=272 pass unmodified packet: id=273 len=64 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=A seq=3746482707 ack_seq=4023688380 using cached desync profile 2 packet: id=273 pass unmodified packet: id=274 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=A seq=3746482707 ack_seq=4023690758 using cached desync profile 2 packet: id=274 pass unmodified packet: id=275 len=145 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=AP seq=3746482707 ack_seq=4023690758 TCP: 16 03 03 00 25 10 00 00 21 20 66 06 5C 37 07 11 AC 22 52 86 F2 50 49 2D 3D B4 A7 44 27 BA C5 BD ... : ....%...! f.\7..."R..PI-=..D'... ... using cached desync profile 2 req retrans : tcp seq 3746482707 not within the req range 3746482190-3746482706. stop tracking. not applying tampering to unknown protocol packet: id=275 pass unmodified packet: id=276 len=103 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=AP seq=4023690758 ack_seq=3746482800 TCP: 14 03 03 00 01 01 16 03 03 00 28 CE 38 05 C6 33 33 BE E5 CA 71 58 F4 4C 0D 66 08 DE B4 52 60 1E ... : ..........(.8..33...qX.L.f...R`. ... using cached desync profile 2 packet: id=276 pass unmodified packet: id=277 len=52 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=A seq=3746482800 ack_seq=4023690809 using cached desync profile 2 packet: id=277 pass unmodified packet: id=278 len=711 mark=20000000 IP4: 192.168.1.8 => 17.157.64.66 proto=tcp ttl=63 sport=64228 dport=443 flags=AP seq=3746482800 ack_seq=4023690809 TCP: 17 03 03 02 8E 00 00 00 00 00 00 00 01 58 3A FF F8 15 83 43 9A F6 E0 83 FB 4E 91 31 92 0A A1 16 ... : .............X:....C.....N.1.... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=278 pass unmodified packet: id=279 len=52 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023690809 ack_seq=3746483459 using cached desync profile 2 packet: id=279 pass unmodified packet: id=280 len=674 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=AP seq=4023695153 ack_seq=3746483459 TCP: B1 54 A7 E8 48 14 5D F9 74 20 06 E9 EB 26 A8 5B 89 CA D5 11 2F 00 31 93 9F 17 50 63 25 57 45 1E ... : .T..H.].t ...&.[..../.1...Pc%WE. ... using cached desync profile 2 packet: id=280 pass unmodified packet: id=281 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023690809 ack_seq=3746483459 TCP: 17 03 03 13 61 CE 38 05 C6 33 33 BE E6 D0 C1 11 D3 3B 2E 63 7B DA DA A7 C8 39 D8 0E B7 93 D2 03 ... : ....a.8..33......;.c{....9...... ... using cached desync profile 2 packet: id=281 pass unmodified packet: id=282 len=1500 mark=00000000 IP4: 17.157.64.66 => 192.168.1.8 proto=tcp ttl=44 sport=443 dport=64228 flags=A seq=4023692257 ack_seq=3746483459 TCP: 7F C1 AD A3 09 41 97 B7 3A 58 E4 D3 D2 50 C3 3D 30 64 65 4D 1F E7 8A C6 65 76 4B D5 CA E5 C4 7A ... : ....A..:X...P.=0deM....evK....z ... using cached desync profile 2 packet: id=282 pass unmodified packet: id=283 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=S seq=2262164586 ack_seq=0 desync profile search for tcp target=173.194.179.153:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=283 pass unmodified packet: id=284 len=60 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=SA seq=3991034542 ack_seq=2262164587 using cached desync profile 2 incoming TTL 120 packet: id=284 pass unmodified packet: id=285 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=A seq=2262164587 ack_seq=3991034543 using cached desync profile 2 packet: id=285 pass unmodified packet: id=286 len=573 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=AP seq=2262164587 ack_seq=3991034543 TCP: 16 03 01 02 04 01 00 02 00 03 03 7D 10 3A 0F BD 48 2E 31 23 BF F4 A4 D1 62 50 02 FA 43 0D DF D0 ... : ...........}.:..H.1#....bP..C... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2262164587-2262165107 hostname: rr7---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.153:443 l7proto=tls hostname='rr7---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52308 dst=173.194.179.153:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-520 len=520 : 03 01 02 04 01 00 02 00 03 03 7D 10 3A 0F BD 48 2E 31 23 BF F4 A4 D1 62 50 02 FA 43 0D DF D0 9A ... : ..........}.:..H.1#....bP..C.... ... packet: id=286 drop packet: id=287 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=S seq=822740851 ack_seq=0 desync profile search for tcp target=173.194.179.153:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=287 pass unmodified packet: id=288 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=S seq=3733846903 ack_seq=0 desync profile search for tcp target=173.194.179.153:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=288 pass unmodified packet: id=289 len=60 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=SA seq=3710177911 ack_seq=3733846904 using cached desync profile 2 incoming TTL 57 packet: id=289 pass unmodified packet: id=290 len=60 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=SA seq=2241756684 ack_seq=822740852 using cached desync profile 2 incoming TTL 57 packet: id=290 pass unmodified packet: id=291 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991034543 ack_seq=2262164588 using cached desync profile 1 packet: id=291 pass unmodified packet: id=292 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991034543 ack_seq=2262165108 using cached desync profile 1 packet: id=292 pass unmodified packet: id=293 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991034543 ack_seq=2262165108 TCP: 16 03 03 00 7A 02 00 00 76 03 03 27 8A CD 8A 11 2A 0E 02 3D DE E3 68 2F D9 39 3F 19 02 EE 6B 77 ... : ....z...v..'....*..=..h/.9?...kw ... using cached desync profile 1 packet: id=293 pass unmodified packet: id=294 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991035939 ack_seq=2262165108 TCP: 58 2E 54 DB 89 8C 41 A1 FB DC 6D 0F E5 0D 10 A5 E8 62 36 58 D0 E4 B7 7B 87 94 5C 31 F8 F7 6F FF ... : X.T...A...m......b6X...{..\1..o. ... using cached desync profile 1 packet: id=294 pass unmodified packet: id=295 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991037335 ack_seq=2262165108 TCP: 7D CA A5 71 CB C6 76 EF E5 E2 FB 66 33 27 33 6C 0B 96 DE 5C 7B B6 95 6E D9 48 9A 26 72 B6 27 BD ... : }..q..v....f3'3l...\{..n.H.&r.'. ... using cached desync profile 1 packet: id=295 pass unmodified packet: id=296 len=383 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=AP seq=3991038731 ack_seq=2262165108 TCP: C5 9F CE 78 34 29 33 8B 6D 2C 80 C5 66 F5 FF A1 B5 51 30 E1 89 AA 72 CB 4C 1B CB 2E 91 BA B3 88 ... : ...x4)3.m,..f....Q0...r.L....... ... using cached desync profile 1 packet: id=296 pass unmodified packet: id=297 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733846904 ack_seq=3710177912 using cached desync profile 2 packet: id=297 pass unmodified packet: id=298 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=A seq=822740852 ack_seq=2241756685 using cached desync profile 2 packet: id=298 pass unmodified packet: id=299 len=573 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=AP seq=3733846904 ack_seq=3710177912 TCP: 16 03 01 02 04 01 00 02 00 03 03 65 FB 1E 4F 1A 1A E2 AB EB 9D 7A 78 32 6B 50 BE 0C ED 3B 80 02 ... : ...........e..O......zx2kP...;.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3733846904-3733847424 hostname: rr7---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.153:443 l7proto=tls hostname='rr7---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52314 dst=173.194.179.153:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-520 len=520 : 03 01 02 04 01 00 02 00 03 03 65 FB 1E 4F 1A 1A E2 AB EB 9D 7A 78 32 6B 50 BE 0C ED 3B 80 02 3C ... : ..........e..O......zx2kP...;..< ... packet: id=299 drop packet: id=300 len=669 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=AP seq=822740852 ack_seq=2241756685 TCP: 16 03 01 02 64 01 00 02 60 03 03 E2 47 9A 4F DE B2 09 93 94 46 28 58 6F 7E 93 5F 0B 72 65 AB 46 ... : ....d...`...G.O.....F(Xo~._.re.F ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 822740852-822741468 hostname: rr7---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.153:443 l7proto=tls hostname='rr7---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52310 dst=173.194.179.153:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-616 len=616 : 03 01 02 64 01 00 02 60 03 03 E2 47 9A 4F DE B2 09 93 94 46 28 58 6F 7E 93 5F 0B 72 65 AB 46 26 ... : ...d...`...G.O.....F(Xo~._.re.F& ... packet: id=300 drop packet: id=301 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=A seq=2262165108 ack_seq=3991035939 using cached desync profile 1 packet: id=301 pass unmodified packet: id=302 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=A seq=2262165108 ack_seq=3991037335 using cached desync profile 1 packet: id=302 pass unmodified packet: id=303 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=A seq=2262165108 ack_seq=3991038731 using cached desync profile 1 packet: id=303 pass unmodified packet: id=304 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=A seq=2262165108 ack_seq=3991039062 using cached desync profile 1 packet: id=304 pass unmodified packet: id=305 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=AP seq=2262165108 ack_seq=3991039062 TCP: 14 03 03 00 01 01 17 03 03 00 35 94 4F 3C FA 5F 85 10 31 5B E6 AF 4A F4 49 C3 1E 75 01 E8 49 74 ... : ..........5.O<._..1[..J.I..u..It ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=305 pass unmodified packet: id=306 len=681 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52308 dport=443 flags=AP seq=2262165172 ack_seq=3991039062 TCP: 17 03 03 02 70 E3 01 3A 07 AB C6 87 F5 7A 47 68 6E B9 AD 9A 2B 8E B4 D9 66 07 2F 96 65 6A 10 D4 ... : ....p..:.....zGhn...+...f./.ej.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=306 pass unmodified packet: id=307 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710177912 ack_seq=3733846905 using cached desync profile 1 packet: id=307 pass unmodified packet: id=308 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710177912 ack_seq=3733847425 TCP: 16 03 03 00 7A 02 00 00 76 03 03 17 89 8E FF B9 55 CE D6 76 AB EF A9 EF E2 6D 79 F6 D4 3E BA 3B ... : ....z...v.......U..v.....my..>.; ... using cached desync profile 1 packet: id=308 pass unmodified packet: id=309 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710179308 ack_seq=3733847425 TCP: 7F 02 E5 59 FE 43 AF 2F C4 01 EC 30 06 63 F9 C9 02 D8 E6 92 59 94 C0 AD 7B 7B 69 A0 14 F0 5F 9F ... : ..Y.C./...0.c......Y...{{i..._. ... using cached desync profile 1 packet: id=309 pass unmodified packet: id=310 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710180704 ack_seq=3733847425 TCP: 43 1B 34 77 81 A8 F0 C8 E9 45 7A EA A0 E3 9C B6 38 96 12 E7 15 A0 83 6C E3 60 E1 0D 30 DB C3 7B ... : C.4w.....Ez.....8......l.`..0..{ ... using cached desync profile 1 packet: id=310 pass unmodified packet: id=311 len=381 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=AP seq=3710182100 ack_seq=3733847425 TCP: 53 5B 41 82 B5 5B 5C AD 60 93 97 8E 12 33 70 CE B5 E7 F4 1B 06 BE 91 23 95 0B 19 34 61 18 AE 77 ... : S[A..[\.`....3p........#...4a..w ... using cached desync profile 1 packet: id=311 pass unmodified packet: id=312 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710177912 ack_seq=3733847425 using cached desync profile 1 packet: id=312 pass unmodified packet: id=313 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241756685 ack_seq=822740853 using cached desync profile 1 packet: id=313 pass unmodified packet: id=314 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241756685 ack_seq=822741469 using cached desync profile 1 packet: id=314 pass unmodified packet: id=315 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241756685 ack_seq=822741469 TCP: 16 03 03 00 7A 02 00 00 76 03 03 55 67 75 71 5C C3 CD 07 28 6E C0 63 44 50 12 21 C2 67 55 07 D3 ... : ....z...v..Uguq\...(n.cDP.!.gU.. ... using cached desync profile 1 packet: id=315 pass unmodified packet: id=316 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241758081 ack_seq=822741469 TCP: 14 77 24 63 89 4C 8A 07 1B 38 5B 3D C0 3E 06 0C 8C C8 93 4C 6A AA EF C2 02 16 B9 BA 58 88 CF F5 ... : .w$c.L...8[=.>.....Lj.......X... ... using cached desync profile 1 packet: id=316 pass unmodified packet: id=317 len=1448 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241759477 ack_seq=822741469 TCP: 9B 95 77 B3 23 8F 4F A7 99 F9 55 BD 25 5F BA 4A 55 13 63 53 4A 35 73 F0 9F 0D 16 73 45 B7 0F 33 ... : ..w.#.O...U.%_.JU.cSJ5s....sE..3 ... using cached desync profile 1 packet: id=317 pass unmodified packet: id=318 len=382 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=AP seq=2241760873 ack_seq=822741469 TCP: 2C C6 E2 78 E4 CC BE 19 74 FA 22 27 96 21 88 AA 29 10 2F 1C 60 87 38 F0 79 6F E3 35 4E 93 45 2B ... : ,..x....t."'.!..)./.`.8.yo.5N.E+ ... using cached desync profile 1 packet: id=318 pass unmodified packet: id=319 len=64 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991039062 ack_seq=2262165108 using cached desync profile 1 packet: id=319 pass unmodified packet: id=320 len=64 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991039062 ack_seq=2262165108 using cached desync profile 1 packet: id=320 pass unmodified packet: id=321 len=64 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991039062 ack_seq=2262165172 using cached desync profile 1 packet: id=321 pass unmodified packet: id=322 len=64 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=52308 flags=A seq=3991039062 ack_seq=2262165172 using cached desync profile 1 packet: id=322 pass unmodified packet: id=323 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733847425 ack_seq=3710179308 using cached desync profile 1 packet: id=323 pass unmodified packet: id=324 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733847425 ack_seq=3710180704 using cached desync profile 1 packet: id=324 pass unmodified packet: id=325 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733847425 ack_seq=3710182100 using cached desync profile 1 packet: id=325 pass unmodified packet: id=326 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733847425 ack_seq=3710182429 using cached desync profile 1 packet: id=326 pass unmodified packet: id=327 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=A seq=3733847425 ack_seq=3710182429 using cached desync profile 1 packet: id=327 pass unmodified packet: id=328 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52314 dport=443 flags=AP seq=3733847425 ack_seq=3710182429 TCP: 14 03 03 00 01 01 17 03 03 00 35 32 4E 54 2D 02 9D BC A2 00 F7 92 A4 AE D5 89 2F 18 09 86 B4 D7 ... : ..........52NT-.........../..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=328 pass unmodified packet: id=329 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=A seq=822741469 ack_seq=2241758081 using cached desync profile 1 packet: id=329 pass unmodified packet: id=330 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=A seq=822741469 ack_seq=2241759477 using cached desync profile 1 packet: id=330 pass unmodified packet: id=331 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=A seq=822741469 ack_seq=2241760873 using cached desync profile 1 packet: id=331 pass unmodified packet: id=332 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=A seq=822741469 ack_seq=2241761203 using cached desync profile 1 packet: id=332 pass unmodified packet: id=333 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=AP seq=822741469 ack_seq=2241761203 TCP: 14 03 03 00 01 01 17 03 03 00 35 3A 80 01 D0 1B C6 47 86 96 63 2A B4 5D DC 45 AA E4 58 54 57 63 ... : ..........5:.....G..c*.].E..XTWc ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=333 pass unmodified packet: id=334 len=661 mark=20000000 IP4: 192.168.1.8 => 173.194.179.153 proto=tcp ttl=63 sport=52310 dport=443 flags=AP seq=822741533 ack_seq=2241761203 TCP: 17 03 03 02 5C 44 FA 5D CC 93 C8 C2 43 F2 F0 1E 1F 7D 76 50 D6 58 BA 18 F1 FF F0 97 15 4A B8 78 ... : ....\D.]....C....}vP.X.......J.x ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=334 pass unmodified packet: id=335 len=64 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710182429 ack_seq=3733847425 using cached desync profile 1 packet: id=335 pass unmodified packet: id=336 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=A seq=3710182429 ack_seq=3733848098 using cached desync profile 1 packet: id=336 pass unmodified packet: id=337 len=797 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52314 flags=AP seq=3710182429 ack_seq=3733848098 TCP: 17 03 03 01 85 37 33 C2 94 6D 51 4E 94 FB 49 C6 59 37 57 F0 0C F5 89 E7 9C D0 CD 17 45 9D DB 46 ... : .....73..mQN..I.Y7W.........E..F ... using cached desync profile 1 packet: id=337 pass unmodified packet: id=338 len=52 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=A seq=2241761203 ack_seq=822742142 using cached desync profile 1 packet: id=338 pass unmodified packet: id=339 len=797 mark=00000000 IP4: 173.194.179.153 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52310 flags=AP seq=2241761203 ack_seq=822742142 TCP: 17 03 03 01 85 18 AC 40 AC 55 B0 35 0D 44 F4 56 08 39 3C 6F 98 56 8D E5 19 E0 C9 91 3B 73 30 76 ... : .......@.U.5.D.V.9 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=S seq=3354218450 ack_seq=0 desync profile search for tcp target=173.194.177.147:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=340 pass unmodified packet: id=341 len=60 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=SA seq=531425622 ack_seq=3354218451 using cached desync profile 2 incoming TTL 120 packet: id=341 pass unmodified packet: id=342 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=A seq=3354218451 ack_seq=531425623 using cached desync profile 2 packet: id=342 pass unmodified packet: id=343 len=573 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=AP seq=3354218451 ack_seq=531425623 TCP: 16 03 01 02 04 01 00 02 00 03 03 B8 D6 4C 91 17 53 E1 7C 43 60 A6 6E F8 76 37 1C 90 A5 83 4F 48 ... : .............L..S.|C`.n.v7....OH ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3354218451-3354218971 hostname: rr1---sn-n8v7kn7y.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.177.147:443 l7proto=tls hostname='rr1---sn-n8v7kn7y.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr1---sn-n8v7kn7y.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:58528 dst=173.194.177.147:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-520 len=520 : 03 01 02 04 01 00 02 00 03 03 B8 D6 4C 91 17 53 E1 7C 43 60 A6 6E F8 76 37 1C 90 A5 83 4F 48 B5 ... : ............L..S.|C`.n.v7....OH. ... packet: id=343 drop packet: id=344 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=S seq=3737321269 ack_seq=0 desync profile search for tcp target=173.194.177.147:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=344 pass unmodified packet: id=345 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=S seq=3698313451 ack_seq=0 desync profile search for tcp target=173.194.177.147:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=345 pass unmodified packet: id=346 len=60 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=SA seq=2549826361 ack_seq=3698313452 using cached desync profile 2 incoming TTL 58 packet: id=346 pass unmodified packet: id=347 len=60 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=SA seq=3233220092 ack_seq=3737321270 using cached desync profile 2 incoming TTL 58 packet: id=347 pass unmodified packet: id=348 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531425623 ack_seq=3354218452 using cached desync profile 1 packet: id=348 pass unmodified packet: id=349 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531425623 ack_seq=3354218972 using cached desync profile 1 packet: id=349 pass unmodified packet: id=350 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531425623 ack_seq=3354218972 TCP: 16 03 03 00 7A 02 00 00 76 03 03 B2 2A DB 2F C7 C4 04 89 6D 92 C2 E0 B8 84 EE 9A 98 3B 6E 24 70 ... : ....z...v...*./....m........;n$p ... using cached desync profile 1 packet: id=350 pass unmodified packet: id=351 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531427019 ack_seq=3354218972 TCP: 7B 4D 76 3E 74 EB A5 63 33 84 70 1B 5C C6 F9 33 C0 3D 0D 89 5C 2A E0 EE E0 AA 21 78 90 14 E7 07 ... : {Mv>t..c3.p.\..3.=..\*....!x.... ... using cached desync profile 1 packet: id=351 pass unmodified packet: id=352 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531428415 ack_seq=3354218972 TCP: B6 3A 70 0C CC 14 0B CD FE 5B 47 35 C8 0D DA F8 51 BE 9F 09 5A DE 8D 5F 1A 37 77 DB D1 62 48 0B ... : .:p......[G5....Q...Z.._.7w..bH. ... using cached desync profile 1 packet: id=352 pass unmodified packet: id=353 len=381 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=AP seq=531429811 ack_seq=3354218972 TCP: 8A C6 F5 AB 06 27 34 E4 F0 A8 2E B3 48 CE 40 A7 7B 52 86 BC 37 C3 26 D7 58 58 A2 80 69 F9 E8 2C ... : .....'4.....H.@.{R..7.&.XX..i.., ... using cached desync profile 1 packet: id=353 pass unmodified packet: id=354 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=A seq=3698313452 ack_seq=2549826362 using cached desync profile 2 packet: id=354 pass unmodified packet: id=355 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=A seq=3737321270 ack_seq=3233220093 using cached desync profile 2 packet: id=355 pass unmodified packet: id=356 len=605 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=AP seq=3698313452 ack_seq=2549826362 TCP: 16 03 01 02 24 01 00 02 20 03 03 BF 75 BE 7B A2 51 30 95 4B E9 20 7A E1 72 D7 DA 76 50 D1 F1 5E ... : ....$... ...u.{.Q0.K. z.r..vP..^ ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3698313452-3698314004 hostname: rr1---sn-n8v7kn7y.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.177.147:443 l7proto=tls hostname='rr1---sn-n8v7kn7y.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr1---sn-n8v7kn7y.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:58550 dst=173.194.177.147:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-552 len=552 : 03 01 02 24 01 00 02 20 03 03 BF 75 BE 7B A2 51 30 95 4B E9 20 7A E1 72 D7 DA 76 50 D1 F1 5E 81 ... : ...$... ...u.{.Q0.K. z.r..vP..^. ... packet: id=356 drop packet: id=357 len=669 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=AP seq=3737321270 ack_seq=3233220093 TCP: 16 03 01 02 64 01 00 02 60 03 03 9E A8 8E A8 5D 3C 58 AC 61 08 AA EA 87 52 F2 B9 20 76 51 07 B2 ... : ....d...`......] 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=A seq=3354218972 ack_seq=531427019 using cached desync profile 1 packet: id=358 pass unmodified packet: id=359 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=A seq=3354218972 ack_seq=531428415 using cached desync profile 1 packet: id=359 pass unmodified packet: id=360 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=A seq=3354218972 ack_seq=531429811 using cached desync profile 1 packet: id=360 pass unmodified packet: id=361 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=A seq=3354218972 ack_seq=531430140 using cached desync profile 1 packet: id=361 pass unmodified packet: id=362 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=AP seq=3354218972 ack_seq=531430140 TCP: 14 03 03 00 01 01 17 03 03 00 35 E8 51 F7 DC 2D 70 E1 48 80 0F F9 B7 51 0C 5D 11 DA E2 DD 19 01 ... : ..........5.Q..-p.H....Q.]...... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=362 pass unmodified packet: id=363 len=681 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58528 dport=443 flags=AP seq=3354219036 ack_seq=531430140 TCP: 17 03 03 02 70 8F 61 BD 75 FD AC 1D 38 24 AB 68 BA 16 82 69 4F 9E 19 A1 66 7D 36 85 B5 80 17 A3 ... : ....p.a.u...8$.h...iO...f}6..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=363 pass unmodified packet: id=364 len=64 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531430140 ack_seq=3354218972 using cached desync profile 1 packet: id=364 pass unmodified packet: id=365 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549826362 ack_seq=3698313453 using cached desync profile 1 packet: id=365 pass unmodified packet: id=366 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549826362 ack_seq=3698314005 using cached desync profile 1 packet: id=366 pass unmodified packet: id=367 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549826362 ack_seq=3698314005 TCP: 16 03 03 00 7A 02 00 00 76 03 03 87 79 1A 07 3D 93 5D 37 3D A4 F3 9E 57 28 03 EF 26 57 A7 07 00 ... : ....z...v...y..=.]7=...W(..&W... ... using cached desync profile 1 packet: id=367 pass unmodified packet: id=368 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549827758 ack_seq=3698314005 TCP: 7B 1A EF CF 76 23 53 BC 99 38 0F 76 20 B9 5B BF CF 04 F9 3A 8E F1 06 69 3D 16 23 1F A5 F4 64 1D ... : {...v#S..8.v .[....:...i=.#...d. ... using cached desync profile 1 packet: id=368 pass unmodified packet: id=369 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549829154 ack_seq=3698314005 TCP: 46 A3 3C FA 3E 6E 14 87 D0 20 29 4A 3D 7A A3 FF 0B EC C2 57 E6 EF A0 C1 4B 8F 58 95 13 53 19 E2 ... : F.<.>n... )J=z.....W....K.X..S.. ... using cached desync profile 1 packet: id=369 pass unmodified packet: id=370 len=382 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=AP seq=2549830550 ack_seq=3698314005 TCP: 19 CC 28 71 63 77 E5 F7 DD 63 B0 74 8D 8A 37 71 67 72 67 64 27 A7 80 D9 29 2C C0 09 78 E2 E0 F7 ... : ..(qcw...c.t..7qgrgd'...),..x... ... using cached desync profile 1 packet: id=370 pass unmodified packet: id=371 len=64 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531430140 ack_seq=3354218972 using cached desync profile 1 packet: id=371 pass unmodified packet: id=372 len=64 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531430140 ack_seq=3354218972 using cached desync profile 1 packet: id=372 pass unmodified packet: id=373 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233220093 ack_seq=3737321271 using cached desync profile 1 packet: id=373 pass unmodified packet: id=374 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233220093 ack_seq=3737321887 using cached desync profile 1 packet: id=374 pass unmodified packet: id=375 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233220093 ack_seq=3737321887 TCP: 16 03 03 00 7A 02 00 00 76 03 03 69 50 20 65 69 0B 15 83 7D 93 5A 5B 05 37 37 EB 52 72 9D CD BF ... : ....z...v..iP ei...}.Z[.77.Rr... ... using cached desync profile 1 packet: id=375 pass unmodified packet: id=376 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233221489 ack_seq=3737321887 TCP: 7C DD DC AE C1 C0 8F AA 63 5A C0 BD 20 42 4E EC 72 1B 00 DE 28 0D 7F A9 59 C5 E4 12 B7 D9 F6 0D ... : |.......cZ.. BN.r...(..Y....... ... using cached desync profile 1 packet: id=376 pass unmodified packet: id=377 len=1448 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233222885 ack_seq=3737321887 TCP: 81 EC 05 59 FA B5 A8 D4 01 05 F0 3D F7 64 6A FB 66 67 4F CF 44 73 50 16 DF 48 74 11 60 40 CF 18 ... : ...Y.......=.dj.fgO.DsP..Ht.`@.. ... using cached desync profile 1 packet: id=377 pass unmodified packet: id=378 len=382 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=AP seq=3233224281 ack_seq=3737321887 TCP: 92 56 55 A3 8E 25 24 07 F6 8F 9C E5 59 8E A9 D7 3A 3A 54 94 B8 8F FC 6B FA A1 59 53 04 00 BA 90 ... : .VU..%$.....Y...::T....k..YS.... ... using cached desync profile 1 packet: id=378 pass unmodified packet: id=379 len=64 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=58528 flags=A seq=531430140 ack_seq=3354219036 using cached desync profile 1 packet: id=379 pass unmodified packet: id=380 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=A seq=3698314005 ack_seq=2549827758 using cached desync profile 1 packet: id=380 pass unmodified packet: id=381 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=A seq=3698314005 ack_seq=2549829154 using cached desync profile 1 packet: id=381 pass unmodified packet: id=382 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=A seq=3698314005 ack_seq=2549830550 using cached desync profile 1 packet: id=382 pass unmodified packet: id=383 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=A seq=3698314005 ack_seq=2549830880 using cached desync profile 1 packet: id=383 pass unmodified packet: id=384 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=AP seq=3698314005 ack_seq=2549830880 TCP: 14 03 03 00 01 01 17 03 03 00 35 5F 42 0F 14 E6 A6 00 E9 51 94 31 41 AC 5F A7 7A 48 70 E4 5D EF ... : ..........5_B......Q.1A._.zHp.]. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=384 pass unmodified packet: id=385 len=661 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58550 dport=443 flags=AP seq=3698314069 ack_seq=2549830880 TCP: 17 03 03 02 5C C9 0C 57 BC 4A 76 2A 40 1F A7 6E 98 E7 D3 87 A5 C7 A9 D2 A5 FF 3E CC 35 0C 02 89 ... : ....\..W.Jv*@..n..........>.5... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=385 pass unmodified packet: id=386 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=A seq=3737321887 ack_seq=3233221489 using cached desync profile 1 packet: id=386 pass unmodified packet: id=387 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=A seq=3737321887 ack_seq=3233222885 using cached desync profile 1 packet: id=387 pass unmodified packet: id=388 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=A seq=3737321887 ack_seq=3233224281 using cached desync profile 1 packet: id=388 pass unmodified packet: id=389 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=A seq=3737321887 ack_seq=3233224611 using cached desync profile 1 packet: id=389 pass unmodified packet: id=390 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=AP seq=3737321887 ack_seq=3233224611 TCP: 14 03 03 00 01 01 17 03 03 00 35 7E 36 B3 B3 21 D7 38 56 FC 35 69 9A 1A 69 C8 95 34 DE 59 02 13 ... : ..........5~6..!.8V.5i..i..4.Y.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=390 pass unmodified packet: id=391 len=661 mark=20000000 IP4: 192.168.1.8 => 173.194.177.147 proto=tcp ttl=63 sport=58540 dport=443 flags=AP seq=3737321951 ack_seq=3233224611 TCP: 17 03 03 02 5C DC D8 20 3C 49 B1 B2 88 95 AA F0 30 2A 96 7E 49 F5 8B 10 D1 D4 18 49 D1 2A ED AD ... : ....\.. 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=A seq=2549830880 ack_seq=3698314678 using cached desync profile 1 packet: id=392 pass unmodified packet: id=393 len=797 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58550 flags=AP seq=2549830880 ack_seq=3698314678 TCP: 17 03 03 01 85 39 E3 ED 94 49 65 76 48 C2 B6 D8 B7 C4 2A 31 34 B8 FC FA 02 DA 8E 83 FB 6E 94 8F ... : .....9...IevH.....*14........n.. ... using cached desync profile 1 packet: id=393 pass unmodified packet: id=394 len=52 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=A seq=3233224611 ack_seq=3737322560 using cached desync profile 1 packet: id=394 pass unmodified packet: id=395 len=797 mark=00000000 IP4: 173.194.177.147 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=58540 flags=AP seq=3233224611 ack_seq=3737322560 TCP: 17 03 03 01 85 72 E9 15 94 BA D5 E0 EB 74 19 E3 DF 29 DF 2E 2D C6 13 0A A9 14 3B 3A 2B 02 D8 1F ... : .....r.......t...)..-.....;:+... ... using cached desync profile 1 packet: id=395 pass unmodified packet: id=396 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=S seq=2131473694 ack_seq=0 desync profile search for tcp target=74.125.153.93:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=396 pass unmodified packet: id=397 len=60 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=SA seq=3855177378 ack_seq=2131473695 using cached desync profile 2 incoming TTL 122 packet: id=397 pass unmodified packet: id=398 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=A seq=2131473695 ack_seq=3855177379 using cached desync profile 2 packet: id=398 pass unmodified packet: id=399 len=638 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=AP seq=2131473695 ack_seq=3855177379 TCP: 16 03 01 02 45 01 00 02 41 03 03 60 AA C9 F2 E7 EB E5 EA 59 3F 72 62 44 35 F0 8D 61 00 A7 B7 86 ... : ....E...A..`.......Y?rbD5..a.... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2131473695-2131474280 hostname: rr13---sn-n8v7znze.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.93:443 l7proto=tls hostname='rr13---sn-n8v7znze.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr13---sn-n8v7znze.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:56928 dst=74.125.153.93:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-585 len=585 : 03 01 02 45 01 00 02 41 03 03 60 AA C9 F2 E7 EB E5 EA 59 3F 72 62 44 35 F0 8D 61 00 A7 B7 86 4B ... : ...E...A..`.......Y?rbD5..a....K ... packet: id=399 drop packet: id=400 len=52 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855177379 ack_seq=2131473696 using cached desync profile 1 packet: id=400 pass unmodified packet: id=401 len=52 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855177379 ack_seq=2131474281 using cached desync profile 1 packet: id=401 pass unmodified packet: id=402 len=1448 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855177379 ack_seq=2131474281 TCP: 16 03 03 00 7A 02 00 00 76 03 03 3B 4F ED 28 05 2D 77 CB 2B 81 03 78 F2 18 73 58 A9 79 A4 F0 00 ... : ....z...v..;O.(.-w.+..x..sX.y... ... using cached desync profile 1 packet: id=402 pass unmodified packet: id=403 len=1448 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855178775 ack_seq=2131474281 TCP: 6C 88 EE 9C 6B 3F 81 21 FF E4 39 F2 6C E3 F1 DF A0 E3 EB 82 E5 FD 88 67 F8 2C A1 9F 09 A2 C1 24 ... : l...k?.!..9.l..........g.,.....$ ... using cached desync profile 1 packet: id=403 pass unmodified packet: id=404 len=1448 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855180171 ack_seq=2131474281 TCP: DD 8B BE DF 80 A6 BB DE 87 55 CA DB BD A0 C1 23 E4 E5 4A 07 E4 03 A1 EF 73 90 6D 93 6E 94 1D 0B ... : .........U.....#..J.....s.m.n... ... using cached desync profile 1 packet: id=404 pass unmodified packet: id=405 len=381 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=AP seq=3855181567 ack_seq=2131474281 TCP: 3C F2 9A 96 7C 3D F9 E3 4C 63 77 63 FE 53 46 49 77 E5 25 30 2B 39 AA D8 13 90 95 38 EF 4C 37 22 ... : <...|=..Lcwc.SFIw.%0+9.....8.L7" ... using cached desync profile 1 packet: id=405 pass unmodified packet: id=406 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=A seq=2131474281 ack_seq=3855178775 using cached desync profile 1 packet: id=406 pass unmodified packet: id=407 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=A seq=2131474281 ack_seq=3855180171 using cached desync profile 1 packet: id=407 pass unmodified packet: id=408 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=A seq=2131474281 ack_seq=3855181567 using cached desync profile 1 packet: id=408 pass unmodified packet: id=409 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=A seq=2131474281 ack_seq=3855181896 using cached desync profile 1 packet: id=409 pass unmodified packet: id=410 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=AP seq=2131474281 ack_seq=3855181896 TCP: 14 03 03 00 01 01 17 03 03 00 35 25 4E A7 63 43 FF 6E CA 67 5F 92 82 7E D9 7C E5 B4 4C BE E6 AB ... : ..........5%N.cC.n.g_..~.|..L... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=410 pass unmodified packet: id=411 len=1215 mark=20000000 IP4: 192.168.1.8 => 74.125.153.93 proto=tcp ttl=63 sport=56928 dport=443 flags=AP seq=2131474345 ack_seq=3855181896 TCP: 17 03 03 04 86 86 F8 2B 67 49 81 32 48 24 F7 57 D8 B7 BD A8 86 B2 76 D3 58 87 66 B0 A6 18 5F 99 ... : .......+gI.2H$.W......v.X.f..._. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=411 pass unmodified packet: id=412 len=64 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855181896 ack_seq=2131474281 using cached desync profile 1 packet: id=412 pass unmodified packet: id=413 len=64 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855181896 ack_seq=2131474281 using cached desync profile 1 packet: id=413 pass unmodified packet: id=414 len=64 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855181896 ack_seq=2131474345 using cached desync profile 1 packet: id=414 pass unmodified packet: id=415 len=52 mark=00000000 IP4: 74.125.153.93 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=56928 flags=A seq=3855181896 ack_seq=2131477591 using cached desync profile 1 packet: id=415 pass unmodified packet: id=416 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=S seq=2970868411 ack_seq=0 desync profile search for tcp target=173.194.182.21:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=416 pass unmodified packet: id=417 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=S seq=630756649 ack_seq=0 desync profile search for tcp target=173.194.182.21:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=417 pass unmodified packet: id=418 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=S seq=4125387834 ack_seq=0 desync profile search for tcp target=173.194.182.21:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=418 pass unmodified packet: id=419 len=60 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=SA seq=1083365017 ack_seq=2970868412 using cached desync profile 2 incoming TTL 56 packet: id=419 pass unmodified packet: id=420 len=60 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=SA seq=2102290722 ack_seq=630756650 using cached desync profile 2 incoming TTL 57 packet: id=420 pass unmodified packet: id=421 len=60 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=SA seq=3380677594 ack_seq=4125387835 using cached desync profile 2 incoming TTL 122 packet: id=421 pass unmodified packet: id=422 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=A seq=2970868412 ack_seq=1083365018 using cached desync profile 2 packet: id=422 pass unmodified packet: id=423 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=A seq=630756650 ack_seq=2102290723 using cached desync profile 2 packet: id=423 pass unmodified packet: id=424 len=637 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=AP seq=2970868412 ack_seq=1083365018 TCP: 16 03 01 02 44 01 00 02 40 03 03 43 0F 64 0E 7E 12 52 8E D7 46 86 F7 ED B3 2E 75 3A E9 39 F7 44 ... : ....D...@..C.d.~.R..F.....u:.9.D ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2970868412-2970868996 hostname: rr3---sn-n8v7znsy.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.182.21:443 l7proto=tls hostname='rr3---sn-n8v7znsy.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-n8v7znsy.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:36034 dst=173.194.182.21:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-584 len=584 : 03 01 02 44 01 00 02 40 03 03 43 0F 64 0E 7E 12 52 8E D7 46 86 F7 ED B3 2E 75 3A E9 39 F7 44 08 ... : ...D...@..C.d.~.R..F.....u:.9.D. ... packet: id=424 drop packet: id=425 len=669 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=AP seq=630756650 ack_seq=2102290723 TCP: 16 03 01 02 64 01 00 02 60 03 03 0D C7 F4 0C 63 3B D0 86 AA 30 81 2F 7C C3 74 FE 72 FC E4 A9 31 ... : ....d...`......c;...0./|.t.r...1 ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 630756650-630757266 hostname: rr3---sn-n8v7znsy.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.182.21:443 l7proto=tls hostname='rr3---sn-n8v7znsy.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-n8v7znsy.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:36044 dst=173.194.182.21:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-616 len=616 : 03 01 02 64 01 00 02 60 03 03 0D C7 F4 0C 63 3B D0 86 AA 30 81 2F 7C C3 74 FE 72 FC E4 A9 31 03 ... : ...d...`......c;...0./|.t.r...1. ... packet: id=425 drop packet: id=426 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=A seq=4125387835 ack_seq=3380677595 using cached desync profile 2 packet: id=426 pass unmodified packet: id=427 len=637 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=AP seq=4125387835 ack_seq=3380677595 TCP: 16 03 01 02 44 01 00 02 40 03 03 A7 E9 7C 44 5D DC 22 A6 F2 47 AC F6 78 E7 D3 5C AC 4E 96 20 14 ... : ....D...@....|D]."..G..x..\.N. . ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 4125387835-4125388419 hostname: rr3---sn-n8v7znsy.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.182.21:443 l7proto=tls hostname='rr3---sn-n8v7znsy.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-n8v7znsy.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:36058 dst=173.194.182.21:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-584 len=584 : 03 01 02 44 01 00 02 40 03 03 A7 E9 7C 44 5D DC 22 A6 F2 47 AC F6 78 E7 D3 5C AC 4E 96 20 14 A8 ... : ...D...@....|D]."..G..x..\.N. .. ... packet: id=427 drop packet: id=428 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083365018 ack_seq=2970868413 using cached desync profile 1 packet: id=428 pass unmodified packet: id=429 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083365018 ack_seq=2970868997 using cached desync profile 1 packet: id=429 pass unmodified packet: id=430 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083365018 ack_seq=2970868997 TCP: 16 03 03 00 7A 02 00 00 76 03 03 28 40 B4 0B 36 30 2F 80 2D 18 D3 0C 27 87 0C 69 EC 47 4B 43 23 ... : ....z...v..(@..60/.-...'..i.GKC# ... using cached desync profile 1 packet: id=430 pass unmodified packet: id=431 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083366414 ack_seq=2970868997 TCP: 70 8C F8 75 B0 10 A3 6F DF 43 2D 5D EB 14 80 33 91 E3 F1 EF 63 73 DF 6F DC 97 C6 E3 8C 79 B1 D2 ... : p..u...o.C-]...3....cs.o.....y.. ... using cached desync profile 1 packet: id=431 pass unmodified packet: id=432 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083367810 ack_seq=2970868997 TCP: 81 1B C5 6E C0 6C 85 C5 74 53 86 B2 D3 BB 40 A2 86 48 F5 A5 20 CC 1E C9 CE FE FC AF 27 4C 53 85 ... : ...n.l..tS....@..H.. .......'LS. ... using cached desync profile 1 packet: id=432 pass unmodified packet: id=433 len=382 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=AP seq=1083369206 ack_seq=2970868997 TCP: 7D BD 8C 9F A5 D6 63 C1 A1 AB 14 E6 B1 C3 78 2E 8F 97 52 2C 35 0C 3D 22 55 FE 01 8B 79 AB 0D AF ... : }.....c.......x...R,5.="U...y... ... using cached desync profile 1 packet: id=433 pass unmodified packet: id=434 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102290723 ack_seq=630756651 using cached desync profile 1 packet: id=434 pass unmodified packet: id=435 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102290723 ack_seq=630757267 using cached desync profile 1 packet: id=435 pass unmodified packet: id=436 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102290723 ack_seq=630757267 TCP: 16 03 03 00 7A 02 00 00 76 03 03 D2 39 E4 5F 06 19 CF AA 2E 18 AE 89 DB C3 D1 C7 65 9A 4E CE 40 ... : ....z...v...9._............e.N.@ ... using cached desync profile 1 packet: id=436 pass unmodified packet: id=437 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102292119 ack_seq=630757267 TCP: DF D3 31 25 7E A8 16 61 D1 6F AC 4A 58 49 D5 4D FF BE 56 A1 58 86 3E 9F BF E6 31 AA FB D8 A9 34 ... : ..1%~..a.o.JXI.M..V.X.>...1....4 ... using cached desync profile 1 packet: id=437 pass unmodified packet: id=438 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102293515 ack_seq=630757267 TCP: 64 85 11 1C B0 BA DC 6F 45 2D BF 22 A2 30 66 FA 31 E8 CC 02 1A D8 95 97 A9 ED BF CB 76 CD 5F 17 ... : d......oE-.".0f.1...........v._. ... using cached desync profile 1 packet: id=438 pass unmodified packet: id=439 len=383 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=AP seq=2102294911 ack_seq=630757267 TCP: BA B7 5E C2 21 EF F7 9F B0 A8 DF 4B DD F4 13 72 C4 DC 12 12 CA 9C 1E 5A 49 93 1D 04 BD CC F6 3B ... : ..^.!......K...r.......ZI......; ... using cached desync profile 1 packet: id=439 pass unmodified packet: id=440 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=A seq=2970868997 ack_seq=1083366414 using cached desync profile 1 packet: id=440 pass unmodified packet: id=441 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380677595 ack_seq=4125387836 using cached desync profile 1 packet: id=441 pass unmodified packet: id=442 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380677595 ack_seq=4125388420 using cached desync profile 1 packet: id=442 pass unmodified packet: id=443 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380677595 ack_seq=4125388420 TCP: 16 03 03 00 7A 02 00 00 76 03 03 E5 70 97 F1 DA 9F 19 D0 F7 42 A6 71 15 C9 5B A6 CA AE 67 6F C7 ... : ....z...v...p.......B.q..[...go. ... using cached desync profile 1 packet: id=443 pass unmodified packet: id=444 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380678991 ack_seq=4125388420 TCP: A3 E7 D5 B2 F2 E8 01 41 35 47 7B FC 43 4D 6D BB 82 9B CA FC CF AC 67 55 23 BB 77 17 29 80 FB 97 ... : .......A5G{.CMm.......gU#.w.)... ... using cached desync profile 1 packet: id=444 pass unmodified packet: id=445 len=1448 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380680387 ack_seq=4125388420 TCP: 2C 4D D0 6B FF F5 9F 9F FE 06 0A BC 18 91 6F CE 03 61 63 63 B7 D9 44 1B C6 EA C2 77 3F F5 E6 86 ... : ,M.k..........o..acc..D....w?... ... using cached desync profile 1 packet: id=445 pass unmodified packet: id=446 len=382 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=AP seq=3380681783 ack_seq=4125388420 TCP: C9 65 D6 7F BC 1E 9C 68 4E FA A0 3A 7A 45 AB 11 4E 56 83 C3 1D 6C 9B 0D F3 D4 F1 82 EB D5 EB 3F ... : .e....hN..:zE..NV...l.........? ... using cached desync profile 1 packet: id=446 pass unmodified packet: id=447 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=A seq=2970868997 ack_seq=1083367810 using cached desync profile 1 packet: id=447 pass unmodified packet: id=448 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=A seq=2970868997 ack_seq=1083369206 using cached desync profile 1 packet: id=448 pass unmodified packet: id=449 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=A seq=2970868997 ack_seq=1083369536 using cached desync profile 1 packet: id=449 pass unmodified packet: id=450 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=A seq=630757267 ack_seq=2102292119 using cached desync profile 1 packet: id=450 pass unmodified packet: id=451 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=A seq=630757267 ack_seq=2102293515 using cached desync profile 1 packet: id=451 pass unmodified packet: id=452 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=A seq=630757267 ack_seq=2102294911 using cached desync profile 1 packet: id=452 pass unmodified packet: id=453 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=A seq=630757267 ack_seq=2102295242 using cached desync profile 1 packet: id=453 pass unmodified packet: id=454 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=A seq=4125388420 ack_seq=3380678991 using cached desync profile 1 packet: id=454 pass unmodified packet: id=455 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=A seq=4125388420 ack_seq=3380680387 using cached desync profile 1 packet: id=455 pass unmodified packet: id=456 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=AP seq=2970868997 ack_seq=1083369536 TCP: 14 03 03 00 01 01 17 03 03 00 35 5C AD 91 05 9E 91 5C 46 C1 DA 1E 8C 3F 09 E9 70 8E 76 CD 59 48 ... : ..........5\.....\F....?..p.v.YH ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=456 pass unmodified packet: id=457 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=AP seq=630757267 ack_seq=2102295242 TCP: 14 03 03 00 01 01 17 03 03 00 35 04 86 09 46 17 2E 05 20 D8 8A E1 E1 99 E0 4A 08 0B 70 FF CB 5C ... : ..........5...F... ......J..p..\ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=457 pass unmodified packet: id=458 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=A seq=4125388420 ack_seq=3380681783 using cached desync profile 1 packet: id=458 pass unmodified packet: id=459 len=681 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36034 dport=443 flags=AP seq=2970869061 ack_seq=1083369536 TCP: 17 03 03 02 70 D7 5F 49 0F 2E 0A 52 E2 54 84 D7 1D C2 82 85 48 C2 56 33 61 1D 09 4F 19 E8 13 5F ... : ....p._I...R.T......H.V3a..O..._ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=459 pass unmodified packet: id=460 len=661 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36044 dport=443 flags=AP seq=630757331 ack_seq=2102295242 TCP: 17 03 03 02 5C 57 AF DE 61 AD 13 58 B2 FE 66 10 F5 9F AF F1 0A 7D F6 9E 06 CF 4B F0 17 95 DB C0 ... : ....\W..a..X..f......}....K..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=460 pass unmodified packet: id=461 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=A seq=4125388420 ack_seq=3380682113 using cached desync profile 1 packet: id=461 pass unmodified packet: id=462 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=AP seq=4125388420 ack_seq=3380682113 TCP: 14 03 03 00 01 01 17 03 03 00 35 4F 63 20 84 42 75 77 3E 4C D7 E2 0F C6 9A 99 E1 74 57 76 C8 DF ... : ..........5Oc .Buw>L.......tWv.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=462 pass unmodified packet: id=463 len=661 mark=20000000 IP4: 192.168.1.8 => 173.194.182.21 proto=tcp ttl=63 sport=36058 dport=443 flags=AP seq=4125388484 ack_seq=3380682113 TCP: 17 03 03 02 5C A8 FD 73 CF FF E5 4E EB DA 46 34 3B 57 04 D9 C8 B5 E4 43 80 1D 26 0F 32 B4 81 8D ... : ....\..s...N..F4;W.....C..&.2... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=463 pass unmodified packet: id=464 len=64 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083369536 ack_seq=2970869061 using cached desync profile 1 packet: id=464 pass unmodified packet: id=465 len=64 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083369536 ack_seq=2970869061 using cached desync profile 1 packet: id=465 pass unmodified packet: id=466 len=64 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083369536 ack_seq=2970869061 using cached desync profile 1 packet: id=466 pass unmodified packet: id=467 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=36034 flags=A seq=1083369536 ack_seq=2970873694 using cached desync profile 1 packet: id=467 pass unmodified packet: id=468 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=A seq=2102295242 ack_seq=630757940 using cached desync profile 1 packet: id=468 pass unmodified packet: id=469 len=797 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=36044 flags=AP seq=2102295242 ack_seq=630757940 TCP: 17 03 03 01 85 4D 58 78 C3 80 AC 8A 29 14 97 0B FB 3F C7 D7 9F 1F F9 83 B6 9B B0 75 9C 1E 03 2A ... : .....MXx....)....?.........u...* ... using cached desync profile 1 packet: id=469 pass unmodified packet: id=470 len=522 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=36034 flags=AP seq=1083369536 ack_seq=2970873694 TCP: 17 03 03 01 D1 17 73 ED 26 F8 45 FE A4 E3 71 BD EB CF 10 4E CF 32 21 D9 AA 25 F8 C8 DB 01 5B 99 ... : ......s.&.E...q....N.2!..%....[. ... using cached desync profile 1 packet: id=470 pass unmodified packet: id=471 len=52 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=A seq=3380682113 ack_seq=4125389093 using cached desync profile 1 packet: id=471 pass unmodified packet: id=472 len=797 mark=00000000 IP4: 173.194.182.21 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=36058 flags=AP seq=3380682113 ack_seq=4125389093 TCP: 17 03 03 01 85 F4 E6 F0 FC AF C3 AD 77 FB C6 35 DB F7 57 26 4F 41 04 86 2B 5B 9A 40 C4 03 ED 2C ... : ............w..5..W&OA..+[.@..., ... using cached desync profile 1 packet: id=472 pass unmodified packet: id=473 len=60 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=S seq=445951434 ack_seq=0 desync profile search for tcp target=213.180.193.9:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=473 pass unmodified packet: id=474 len=60 mark=00000000 IP4: 213.180.193.9 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=42576 flags=SA seq=3986000013 ack_seq=445951435 using cached desync profile 2 incoming TTL 56 packet: id=474 pass unmodified packet: id=475 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=A seq=445951435 ack_seq=3986000014 using cached desync profile 2 packet: id=475 pass unmodified packet: id=476 len=179 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=AP seq=445951435 ack_seq=3986000014 TCP: 48 45 41 44 20 2F 67 65 6E 65 72 61 74 65 5F 32 30 34 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 ... : HEAD /generate_204 HTTP/1.1..Hos ... using cached desync profile 2 packet contains HTTP request req retrans : tcp seq interval 445951435-445951561 hostname: scbh.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=213.180.193.9:80 l7proto=http hostname='scbh.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for scbh.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for scbh.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for scbh.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=476 pass unmodified packet: id=477 len=52 mark=00000000 IP4: 213.180.193.9 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=42576 flags=A seq=3986000014 ack_seq=445951562 using cached desync profile 2 packet: id=477 pass unmodified packet: id=478 len=130 mark=00000000 IP4: 213.180.193.9 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=42576 flags=AP seq=3986000014 ack_seq=445951562 TCP: 48 54 54 50 2F 31 2E 31 20 32 30 34 20 4E 6F 20 63 6F 6E 74 65 6E 74 0D 0A 43 6F 6E 74 65 6E 74 ... : HTTP/1.1 204 No content..Content ... using cached desync profile 2 incoming HTTP reply detected for hostname scbh.yandex.net local or in-domain redirect detected. it's not a DPI redirect. packet: id=478 pass unmodified packet: id=479 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=A seq=445951562 ack_seq=3986000092 using cached desync profile 2 packet: id=479 pass unmodified packet: id=480 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=AF seq=445951562 ack_seq=3986000092 using cached desync profile 2 packet: id=480 pass unmodified packet: id=481 len=52 mark=00000000 IP4: 213.180.193.9 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=42576 flags=AF seq=3986000092 ack_seq=445951563 using cached desync profile 2 packet: id=481 pass unmodified packet: id=482 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.9 proto=tcp ttl=63 sport=42576 dport=80 flags=A seq=445951563 ack_seq=3986000093 using cached desync profile 2 packet: id=482 pass unmodified packet: id=483 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=S seq=1983182159 ack_seq=0 desync profile search for tcp target=173.194.177.161:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=483 pass unmodified packet: id=484 len=60 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=SA seq=3231134058 ack_seq=1983182160 using cached desync profile 2 incoming TTL 123 packet: id=484 pass unmodified packet: id=485 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=S seq=2631357478 ack_seq=0 desync profile search for tcp target=173.194.177.161:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=485 pass unmodified packet: id=486 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=S seq=3643052927 ack_seq=0 desync profile search for tcp target=173.194.177.161:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=486 pass unmodified packet: id=487 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=A seq=1983182160 ack_seq=3231134059 using cached desync profile 2 packet: id=487 pass unmodified packet: id=488 len=638 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=AP seq=1983182160 ack_seq=3231134059 TCP: 16 03 01 02 45 01 00 02 41 03 03 4A 42 CF 21 28 40 DB 2F 1A FC B4 2A 29 71 C3 32 6A 51 3A 84 2F ... : ....E...A..JB.!(@./...*)q.2jQ:./ ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1983182160-1983182745 hostname: rr15---sn-n8v7kn7y.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.177.161:443 l7proto=tls hostname='rr15---sn-n8v7kn7y.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr15---sn-n8v7kn7y.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52530 dst=173.194.177.161:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-585 len=585 : 03 01 02 45 01 00 02 41 03 03 4A 42 CF 21 28 40 DB 2F 1A FC B4 2A 29 71 C3 32 6A 51 3A 84 2F 2C ... : ...E...A..JB.!(@./...*)q.2jQ:./, ... packet: id=488 drop packet: id=489 len=60 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=SA seq=1854959409 ack_seq=2631357479 using cached desync profile 2 incoming TTL 56 packet: id=489 pass unmodified packet: id=490 len=60 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=SA seq=3924851262 ack_seq=3643052928 using cached desync profile 2 incoming TTL 57 packet: id=490 pass unmodified packet: id=491 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=A seq=2631357479 ack_seq=1854959410 using cached desync profile 2 packet: id=491 pass unmodified packet: id=492 len=606 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=AP seq=2631357479 ack_seq=1854959410 TCP: 16 03 01 02 25 01 00 02 21 03 03 08 D2 97 B3 73 89 1C 86 DB 77 A8 45 78 09 F3 D7 0C B7 00 18 E6 ... : ....%...!......s....w.Ex........ ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2631357479-2631358032 hostname: rr15---sn-n8v7kn7y.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.177.161:443 l7proto=tls hostname='rr15---sn-n8v7kn7y.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr15---sn-n8v7kn7y.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52540 dst=173.194.177.161:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-553 len=553 : 03 01 02 25 01 00 02 21 03 03 08 D2 97 B3 73 89 1C 86 DB 77 A8 45 78 09 F3 D7 0C B7 00 18 E6 4F ... : ...%...!......s....w.Ex........O ... packet: id=492 drop packet: id=493 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=A seq=3643052928 ack_seq=3924851263 using cached desync profile 2 packet: id=493 pass unmodified packet: id=494 len=606 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=AP seq=3643052928 ack_seq=3924851263 TCP: 16 03 01 02 25 01 00 02 21 03 03 D6 47 16 A9 F4 46 04 0B AB 35 5F 59 1A 86 36 8B AD D0 B5 7F 32 ... : ....%...!...G...F...5_Y..6....2 ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3643052928-3643053481 hostname: rr15---sn-n8v7kn7y.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.177.161:443 l7proto=tls hostname='rr15---sn-n8v7kn7y.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr15---sn-n8v7kn7y.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:52542 dst=173.194.177.161:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-553 len=553 : 03 01 02 25 01 00 02 21 03 03 D6 47 16 A9 F4 46 04 0B AB 35 5F 59 1A 86 36 8B AD D0 B5 7F 32 41 ... : ...%...!...G...F...5_Y..6....2A ... packet: id=494 drop packet: id=495 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231134059 ack_seq=1983182161 using cached desync profile 1 packet: id=495 pass unmodified packet: id=496 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231134059 ack_seq=1983182746 using cached desync profile 1 packet: id=496 pass unmodified packet: id=497 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231134059 ack_seq=1983182746 TCP: 16 03 03 00 7A 02 00 00 76 03 03 A0 72 81 3B 88 C4 85 70 9A 7E 05 FE B3 E5 AF 5A 2A F5 C4 D9 C6 ... : ....z...v...r.;...p.~.....Z*.... ... using cached desync profile 1 packet: id=497 pass unmodified packet: id=498 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231135455 ack_seq=1983182746 TCP: 1A 9F 3B 70 DE C9 62 7F C0 9A B2 3D 54 43 E7 57 A6 A4 EA 9A 97 12 2A 2A FC 63 FC E3 6C C3 F8 03 ... : ..;p..b...=TC.W......**.c..l... ... using cached desync profile 1 packet: id=498 pass unmodified packet: id=499 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231136851 ack_seq=1983182746 TCP: BB 61 E7 82 2B EA 8D EE F1 68 B2 13 18 5B EB F1 70 7F B3 10 DF F2 56 FF CF CC 23 3D 50 60 38 B5 ... : .a..+....h...[..p....V...#=P`8. ... using cached desync profile 1 packet: id=499 pass unmodified packet: id=500 len=382 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=AP seq=3231138247 ack_seq=1983182746 TCP: D8 BF E5 ED 24 AA 63 16 3E E2 11 20 C7 8D 29 3D 74 CB 14 E9 2C B4 79 F5 74 FF A7 07 AD AE 61 6D ... : ....$.c.>.. ..)=t...,.y.t.....am ... using cached desync profile 1 packet: id=500 pass unmodified packet: id=501 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854959410 ack_seq=2631357480 using cached desync profile 1 packet: id=501 pass unmodified packet: id=502 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854959410 ack_seq=2631358033 using cached desync profile 1 packet: id=502 pass unmodified packet: id=503 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854959410 ack_seq=2631358033 TCP: 16 03 03 00 7A 02 00 00 76 03 03 2B 8A 13 15 22 14 FB 2C 27 11 D1 12 7A 42 6E 19 64 25 0C E7 9C ... : ....z...v..+..."..,'...zBn.d%... ... using cached desync profile 1 packet: id=503 pass unmodified packet: id=504 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854960806 ack_seq=2631358033 TCP: 60 E3 CA F5 E9 FD 8A A9 F1 0A A9 7C 02 5A BA 65 95 AD 8F EF 36 54 9F 0F C0 D6 FA 87 8F 93 9A 3A ... : `..........|.Z.e....6T.........: ... using cached desync profile 1 packet: id=504 pass unmodified packet: id=505 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854962202 ack_seq=2631358033 TCP: AD DA 3B D9 1E 6C 60 13 F0 8A 7D B5 5B 5C 30 50 D6 12 34 B5 34 A8 5B 67 C4 87 D6 45 DB 15 D1 81 ... : ..;..l`...}.[\0P..4.4.[g...E.... ... using cached desync profile 1 packet: id=505 pass unmodified packet: id=506 len=382 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=AP seq=1854963598 ack_seq=2631358033 TCP: 1A 3C EC 65 87 F3 9A 01 80 3E 25 01 FC 22 04 38 40 99 9D 81 C3 3C 86 A5 97 61 62 B5 53 A4 C2 D7 ... : .<.e.....>%..".8@....<...ab.S... ... using cached desync profile 1 packet: id=506 pass unmodified packet: id=507 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=A seq=1983182746 ack_seq=3231135455 using cached desync profile 1 packet: id=507 pass unmodified packet: id=508 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=A seq=1983182746 ack_seq=3231136851 using cached desync profile 1 packet: id=508 pass unmodified packet: id=509 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924851263 ack_seq=3643052929 using cached desync profile 1 packet: id=509 pass unmodified packet: id=510 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924851263 ack_seq=3643053482 using cached desync profile 1 packet: id=510 pass unmodified packet: id=511 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=A seq=1983182746 ack_seq=3231138247 using cached desync profile 1 packet: id=511 pass unmodified packet: id=512 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924851263 ack_seq=3643053482 TCP: 16 03 03 00 7A 02 00 00 76 03 03 21 F2 3F 7E E8 65 21 26 30 E7 0A 25 0F A7 2C 2D DD DF BF FB E9 ... : ....z...v..!.?~.e!&0..%..,-..... ... using cached desync profile 1 packet: id=512 pass unmodified packet: id=513 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924852659 ack_seq=3643053482 TCP: F8 A7 99 81 10 34 95 17 E8 0E 9C 97 4E FD 4B C8 20 5D 02 06 F3 57 88 1B DF 47 65 57 48 FA 7E 9D ... : .....4......N.K. ]...W...GeWH.~. ... using cached desync profile 1 packet: id=513 pass unmodified packet: id=514 len=1448 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924854055 ack_seq=3643053482 TCP: FB 24 E6 7F FB 84 DF 3B 2E 2A A0 12 4E 6F 68 B4 22 E7 A8 BE D3 B4 D8 2E 35 FC 81 08 AF D2 48 76 ... : .$....;.*..Noh.".......5.....Hv ... using cached desync profile 1 packet: id=514 pass unmodified packet: id=515 len=382 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=AP seq=3924855451 ack_seq=3643053482 TCP: FC A9 F3 44 F8 9E B0 7D CC 6D F3 7C FF 0F 7F FE 1A FA 18 1C A8 DF 74 68 C8 CD 9E DF CE ED 46 B8 ... : ...D...}.m.|.........th......F. ... using cached desync profile 1 packet: id=515 pass unmodified packet: id=516 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=A seq=1983182746 ack_seq=3231138577 using cached desync profile 1 packet: id=516 pass unmodified packet: id=517 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=A seq=2631358033 ack_seq=1854960806 using cached desync profile 1 packet: id=517 pass unmodified packet: id=518 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=A seq=2631358033 ack_seq=1854962202 using cached desync profile 1 packet: id=518 pass unmodified packet: id=519 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=A seq=2631358033 ack_seq=1854963598 using cached desync profile 1 packet: id=519 pass unmodified packet: id=520 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=A seq=2631358033 ack_seq=1854963928 using cached desync profile 1 packet: id=520 pass unmodified packet: id=521 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=AP seq=1983182746 ack_seq=3231138577 TCP: 14 03 03 00 01 01 17 03 03 00 35 AC CB 1A 9D A1 C3 CF D7 B6 E1 6C 49 B7 76 FB 7F 20 E7 9D C7 F2 ... : ..........5..........lI.v. .... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=521 pass unmodified packet: id=522 len=382 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=AP seq=3231138247 ack_seq=1983182746 TCP: D8 BF E5 ED 24 AA 63 16 3E E2 11 20 C7 8D 29 3D 74 CB 14 E9 2C B4 79 F5 74 FF A7 07 AD AE 61 6D ... : ....$.c.>.. ..)=t...,.y.t.....am ... using cached desync profile 1 packet: id=522 pass unmodified packet: id=523 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=AP seq=2631358033 ack_seq=1854963928 TCP: 14 03 03 00 01 01 17 03 03 00 35 F6 8D 9E 66 09 E3 FA 21 B3 01 C4 B1 27 7E 3F 42 B2 CF F5 93 C3 ... : ..........5...f...!....'~?B..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=523 pass unmodified packet: id=524 len=382 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=AP seq=1854963598 ack_seq=2631358033 TCP: 1A 3C EC 65 87 F3 9A 01 80 3E 25 01 FC 22 04 38 40 99 9D 81 C3 3C 86 A5 97 61 62 B5 53 A4 C2 D7 ... : .<.e.....>%..".8@....<...ab.S... ... using cached desync profile 1 packet: id=524 pass unmodified packet: id=525 len=670 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52530 dport=443 flags=AP seq=1983182810 ack_seq=3231138577 TCP: 17 03 03 02 65 7A 23 EF 91 C7 C8 38 78 36 9F BC 96 29 EC 5F 56 BF 08 50 FF E6 27 94 80 CD B5 43 ... : ....ez#....8x6...)._V..P..'....C ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=525 pass unmodified packet: id=526 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=A seq=3643053482 ack_seq=3924852659 using cached desync profile 1 packet: id=526 pass unmodified packet: id=527 len=670 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52540 dport=443 flags=AP seq=2631358097 ack_seq=1854963928 TCP: 17 03 03 02 65 B9 E3 51 D3 D1 EA B6 E4 04 12 A9 A2 BA 0C BD 1A C1 2E 63 8D 6A 02 1D 7A 37 66 CE ... : ....e..Q...............c.j..z7f. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=527 pass unmodified packet: id=528 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=A seq=3643053482 ack_seq=3924854055 using cached desync profile 1 packet: id=528 pass unmodified packet: id=529 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=A seq=3643053482 ack_seq=3924855451 using cached desync profile 1 packet: id=529 pass unmodified packet: id=530 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=A seq=3643053482 ack_seq=3924855781 using cached desync profile 1 packet: id=530 pass unmodified packet: id=531 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=AP seq=3643053482 ack_seq=3924855781 TCP: 14 03 03 00 01 01 17 03 03 00 35 85 7A 2E 6E 45 12 32 24 7B BB 17 9A 27 B0 B6 63 0F 80 25 2A 57 ... : ..........5.z.nE.2${...'..c..%*W ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=531 pass unmodified packet: id=532 len=690 mark=20000000 IP4: 192.168.1.8 => 173.194.177.161 proto=tcp ttl=63 sport=52542 dport=443 flags=AP seq=3643053546 ack_seq=3924855781 TCP: 17 03 03 02 79 0D DB 91 42 C1 D6 85 81 73 35 17 DB A7 0D D3 23 4B 98 C0 63 EB 25 78 AA 8F FC 87 ... : ....y...B....s5.....#K..c.%x.... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=532 pass unmodified packet: id=533 len=64 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924855781 ack_seq=3643053482 using cached desync profile 1 packet: id=533 pass unmodified packet: id=534 len=64 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924855781 ack_seq=3643053482 using cached desync profile 1 packet: id=534 pass unmodified packet: id=535 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=A seq=3231138577 ack_seq=1983183428 using cached desync profile 1 packet: id=535 pass unmodified packet: id=536 len=797 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=52530 flags=AP seq=3231138577 ack_seq=1983183428 TCP: 17 03 03 01 85 7C B1 DC 8C 12 26 E1 6B 97 E8 34 A4 65 68 31 E5 23 E8 AA 30 C1 A7 71 2D CE 56 1A ... : .....|....&.k..4.eh1.#..0..q-.V. ... using cached desync profile 1 packet: id=536 pass unmodified packet: id=537 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=A seq=1854963928 ack_seq=2631358715 using cached desync profile 1 packet: id=537 pass unmodified packet: id=538 len=797 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52540 flags=AP seq=1854963928 ack_seq=2631358715 TCP: 17 03 03 01 85 D4 B7 FA D4 78 9E 7A 75 FA 09 5D 93 48 73 50 2B 98 86 00 95 84 30 A4 7F 34 82 4E ... : .........x.zu..].HsP+.....0.4.N ... using cached desync profile 1 packet: id=538 pass unmodified packet: id=539 len=64 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924855781 ack_seq=3643053546 using cached desync profile 1 packet: id=539 pass unmodified packet: id=540 len=52 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=52542 flags=A seq=3924855781 ack_seq=3643058186 using cached desync profile 1 packet: id=540 pass unmodified packet: id=541 len=522 mark=00000000 IP4: 173.194.177.161 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=52542 flags=AP seq=3924855781 ack_seq=3643058186 TCP: 17 03 03 01 D1 66 BD 2F 85 DC 8C 85 D6 07 B0 83 55 6D 2C 97 A9 40 B9 82 8B 3F 11 89 CB 3F ED F5 ... : .....f./........Um,..@...?...?.. ... using cached desync profile 1 packet: id=541 pass unmodified packet: id=542 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=S seq=527551334 ack_seq=0 desync profile search for tcp target=74.125.153.95:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=542 pass unmodified packet: id=543 len=60 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=SA seq=1934490221 ack_seq=527551335 using cached desync profile 2 incoming TTL 120 packet: id=543 pass unmodified packet: id=544 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=A seq=527551335 ack_seq=1934490222 using cached desync profile 2 packet: id=544 pass unmodified packet: id=545 len=638 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=AP seq=527551335 ack_seq=1934490222 TCP: 16 03 01 02 45 01 00 02 41 03 03 86 1C 55 D4 2B CE 9E 6F 55 3E 82 A4 A6 25 22 56 1A 1A 9E 20 59 ... : ....E...A....U.+..oU>...%"V... Y ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 527551335-527551920 hostname: rr15---sn-n8v7znze.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.95:443 l7proto=tls hostname='rr15---sn-n8v7znze.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr15---sn-n8v7znze.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:38888 dst=74.125.153.95:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-585 len=585 : 03 01 02 45 01 00 02 41 03 03 86 1C 55 D4 2B CE 9E 6F 55 3E 82 A4 A6 25 22 56 1A 1A 9E 20 59 AE ... : ...E...A....U.+..oU>...%"V... Y. ... packet: id=545 drop packet: id=546 len=52 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934490222 ack_seq=527551336 using cached desync profile 1 packet: id=546 pass unmodified packet: id=547 len=52 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934490222 ack_seq=527551921 using cached desync profile 1 packet: id=547 pass unmodified packet: id=548 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934490222 ack_seq=527551921 TCP: 16 03 03 00 7A 02 00 00 76 03 03 A5 22 90 D1 35 B1 BE 5B F5 75 9E 33 26 43 C4 30 53 79 B8 01 CB ... : ....z...v..."..5..[.u.3&C.0Sy... ... using cached desync profile 1 packet: id=548 pass unmodified packet: id=549 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934491618 ack_seq=527551921 TCP: 56 26 E9 BC 87 05 0C 70 1D 73 CB 45 4A E0 AB 44 98 D1 24 58 ED DC 95 F4 41 8A BD 3D 67 EE E5 6C ... : V&.....p.s.EJ..D..$X....A..=g..l ... using cached desync profile 1 packet: id=549 pass unmodified packet: id=550 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934493014 ack_seq=527551921 TCP: 57 91 4B 0D 4C 46 38 56 BE 8A E9 FD 6E 53 C2 33 38 42 58 D1 03 FA 16 04 C5 79 1E 4C 00 EE 65 30 ... : W.K.LF8V....nS.38BX......y.L..e0 ... using cached desync profile 1 packet: id=550 pass unmodified packet: id=551 len=383 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=AP seq=1934494410 ack_seq=527551921 TCP: 79 B3 51 B8 73 B2 89 83 7B A3 4A 2C 13 E0 C0 A8 F0 82 8A CD 44 0C 6A A0 EE 13 DC C6 AC CD C7 4D ... : y.Q.s...{.J,........D.j........M ... using cached desync profile 1 packet: id=551 pass unmodified packet: id=552 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=A seq=527551921 ack_seq=1934491618 using cached desync profile 1 packet: id=552 pass unmodified packet: id=553 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=A seq=527551921 ack_seq=1934493014 using cached desync profile 1 packet: id=553 pass unmodified packet: id=554 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=A seq=527551921 ack_seq=1934494410 using cached desync profile 1 packet: id=554 pass unmodified packet: id=555 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=A seq=527551921 ack_seq=1934494741 using cached desync profile 1 packet: id=555 pass unmodified packet: id=556 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=AP seq=527551921 ack_seq=1934494741 TCP: 14 03 03 00 01 01 17 03 03 00 35 11 7E D8 55 38 28 04 07 28 A7 C8 FE 24 F5 35 C1 89 F1 43 9F 0F ... : ..........5.~.U8(..(...$.5...C.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=556 pass unmodified packet: id=557 len=1214 mark=20000000 IP4: 192.168.1.8 => 74.125.153.95 proto=tcp ttl=63 sport=38888 dport=443 flags=AP seq=527551985 ack_seq=1934494741 TCP: 17 03 03 04 85 09 F5 CB 3B 89 D0 25 36 7E A6 25 37 0B F5 78 AE C5 B8 90 58 AF 29 62 29 FD 64 08 ... : ........;..%6~.%7..x....X.)b).d. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=557 pass unmodified packet: id=558 len=64 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934494741 ack_seq=527551921 using cached desync profile 1 packet: id=558 pass unmodified packet: id=559 len=64 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934494741 ack_seq=527551921 using cached desync profile 1 packet: id=559 pass unmodified packet: id=560 len=64 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934494741 ack_seq=527551985 using cached desync profile 1 packet: id=560 pass unmodified packet: id=561 len=52 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38888 flags=A seq=1934494741 ack_seq=527555236 using cached desync profile 1 packet: id=561 pass unmodified packet: id=562 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=38888 flags=A seq=1934494741 ack_seq=527555236 TCP: 17 03 03 01 D2 D1 2C E3 D7 AF 64 3D A1 AB 27 C2 BD 34 02 9D 9A 40 89 03 A5 50 D3 92 71 BB 2C 59 ... : ......,...d=..'..4...@...P..q.,Y ... using cached desync profile 1 packet: id=562 pass unmodified packet: id=563 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=38888 flags=A seq=1934496137 ack_seq=527555236 TCP: 87 FC F4 0B C9 95 81 1E B0 AE 6E 01 E7 B4 F0 13 0E 48 84 0E A1 A1 B0 DE 6C D1 0C 95 D9 75 CE 31 ... : ..........n......H......l....u.1 ... using cached desync profile 1 packet: id=563 pass unmodified packet: id=564 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=38888 flags=A seq=1934497533 ack_seq=527555236 TCP: FE 28 2A DC 55 74 BD 71 06 02 81 0E F1 E0 33 C0 C1 A0 1B FA 9F FE E1 43 EE EC 4E AC AE 2B 85 2E ... : .(*.Ut.q......3........C..N..+.. ... using cached desync profile 1 packet: id=564 pass unmodified packet: id=565 len=1448 mark=00000000 IP4: 74.125.153.95 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=38888 flags=AP seq=1934498929 ack_seq=527555236 TCP: 05 1B 87 16 0A BD 9F 22 43 B4 C8 86 4E 17 F4 CA 0E 2F 6B 28 6B D7 69 BF 45 74 87 8A C7 5C 96 83 ... : ......."C...N..../k(k.i.Et...\.. ... using cached desync profile 1 packet: id=565 pass unmodified packet: id=566 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 desync profile search for tcp target=157.240.205.63:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=566 pass unmodified packet: id=567 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=S seq=2257697557 ack_seq=0 desync profile search for tcp target=212.188.37.16:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=567 pass unmodified packet: id=568 len=60 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=SA seq=3634792735 ack_seq=2257697558 using cached desync profile 2 incoming TTL 122 packet: id=568 pass unmodified packet: id=569 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=A seq=2257697558 ack_seq=3634792736 using cached desync profile 2 packet: id=569 pass unmodified packet: id=570 len=609 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=AP seq=2257697558 ack_seq=3634792736 TCP: 16 03 01 02 28 01 00 02 24 03 03 D6 90 0C 4C 43 95 08 07 97 6F 30 85 61 57 6D 53 43 2F 64 C4 2A ... : ....(...$.....LC....o0.aWmSC/d.* ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2257697558-2257698114 hostname: rr5---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.16:443 l7proto=tls hostname='rr5---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr5---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:43742 dst=212.188.37.16:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-556 len=556 : 03 01 02 28 01 00 02 24 03 03 D6 90 0C 4C 43 95 08 07 97 6F 30 85 61 57 6D 53 43 2F 64 C4 2A 74 ... : ...(...$.....LC....o0.aWmSC/d.*t ... packet: id=570 drop packet: id=571 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634792736 ack_seq=2257697559 using cached desync profile 1 packet: id=571 pass unmodified packet: id=572 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634792736 ack_seq=2257698115 using cached desync profile 1 packet: id=572 pass unmodified packet: id=573 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634792736 ack_seq=2257698115 TCP: 16 03 03 00 7A 02 00 00 76 03 03 AC A7 34 C0 CF 5C B9 17 AE 97 14 47 3E E7 DD 84 80 8E 3D 7F FB ... : ....z...v....4..\.....G>.....=. ... using cached desync profile 1 packet: id=573 pass unmodified packet: id=574 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634794136 ack_seq=2257698115 TCP: E7 7C E2 C7 2A 6E 26 EB 29 28 EC 5F 31 B1 6E 4D 22 CE 8D B8 C8 C2 3A A1 1E 46 36 AB 1D 9D F8 78 ... : .|..*n&.)(._1.nM".....:..F6....x ... using cached desync profile 1 packet: id=574 pass unmodified packet: id=575 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634795536 ack_seq=2257698115 TCP: 2E 25 82 4F B9 26 7A B4 D3 EA FD EE 2B 1C 35 01 12 9B 43 CC 66 0E C5 57 56 B9 07 E6 FD E1 CD 46 ... : .%.O.&z.....+.5...C.f..WV......F ... using cached desync profile 1 packet: id=575 pass unmodified packet: id=576 len=370 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=AP seq=3634796936 ack_seq=2257698115 TCP: 83 6A CB 0D 88 43 93 40 71 6F 31 90 BB 68 1C EF C3 90 39 B1 21 87 13 C1 25 E3 0B EA 4F 3B B6 CE ... : .j...C.@qo1..h....9.!...%...O;.. ... using cached desync profile 1 packet: id=576 pass unmodified packet: id=577 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=A seq=2257698115 ack_seq=3634794136 using cached desync profile 1 packet: id=577 pass unmodified packet: id=578 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=A seq=2257698115 ack_seq=3634795536 using cached desync profile 1 packet: id=578 pass unmodified packet: id=579 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=A seq=2257698115 ack_seq=3634796936 using cached desync profile 1 packet: id=579 pass unmodified packet: id=580 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=A seq=2257698115 ack_seq=3634797254 using cached desync profile 1 packet: id=580 pass unmodified packet: id=581 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=AP seq=2257698115 ack_seq=3634797254 TCP: 14 03 03 00 01 01 17 03 03 00 35 9D 4B 88 87 D8 D7 42 EF 58 BB F6 2B 50 D0 F0 10 0C 82 C0 12 F9 ... : ..........5.K....B.X..+P........ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=581 pass unmodified packet: id=582 len=685 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43742 dport=443 flags=AP seq=2257698179 ack_seq=3634797254 TCP: 17 03 03 02 74 BE C6 68 56 A8 3A 67 04 84 20 71 44 93 CC DC A8 18 0D 8C B0 AB 33 71 A9 B7 38 9E ... : ....t..hV.:g.. qD.........3q..8. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=582 pass unmodified packet: id=583 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=S seq=1477139642 ack_seq=0 desync profile search for tcp target=212.188.37.16:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=583 pass unmodified packet: id=584 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=S seq=1924460017 ack_seq=0 desync profile search for tcp target=212.188.37.16:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=584 pass unmodified packet: id=585 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634797254 ack_seq=2257698812 using cached desync profile 1 packet: id=585 pass unmodified packet: id=586 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=A seq=3634797254 ack_seq=2257701612 using cached desync profile 1 packet: id=586 pass unmodified packet: id=587 len=60 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=SA seq=307470995 ack_seq=1924460018 using cached desync profile 2 incoming TTL 122 packet: id=587 pass unmodified packet: id=588 len=60 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=SA seq=2405818093 ack_seq=1477139643 using cached desync profile 2 incoming TTL 122 packet: id=588 pass unmodified packet: id=589 len=522 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=AP seq=3634797254 ack_seq=2257702810 TCP: 17 03 03 01 D1 27 01 66 FE A7 5C 5B 67 3A DD 8A 8F 0E DF D6 75 B8 30 49 6D 4D CA 35 23 D0 44 D5 ... : .....'.f..\[g:......u.0ImM.5#.D. ... using cached desync profile 1 packet: id=589 pass unmodified packet: id=590 len=77 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=AP seq=3634797724 ack_seq=2257702810 TCP: 17 03 03 00 14 5A 0D D3 1E D5 B3 45 74 B6 C0 8A 29 FD 87 34 97 92 80 8F 87 : .....Z.....Et...)..4..... using cached desync profile 1 packet: id=590 pass unmodified packet: id=591 len=184 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43742 flags=AP seq=3634797749 ack_seq=2257702810 TCP: 17 03 03 00 15 46 9D C0 10 63 A4 2D 65 3E AC CE D8 66 B0 17 2B 88 00 B2 D0 BC 17 03 03 00 13 3E ... : .....F...c.-e>...f..+..........> ... using cached desync profile 1 packet: id=591 pass unmodified packet: id=592 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=A seq=1924460018 ack_seq=307470996 using cached desync profile 2 packet: id=592 pass unmodified packet: id=593 len=577 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=AP seq=1924460018 ack_seq=307470996 TCP: 16 03 01 02 08 01 00 02 04 03 03 2C 0F 51 94 25 B5 4C 99 B2 07 29 43 5C AA C5 2D C3 E3 50 AC C6 ... : ...........,.Q.%.L...)C\..-..P.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1924460018-1924460542 hostname: rr5---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.16:443 l7proto=tls hostname='rr5---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr5---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:43754 dst=212.188.37.16:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-524 len=524 : 03 01 02 08 01 00 02 04 03 03 2C 0F 51 94 25 B5 4C 99 B2 07 29 43 5C AA C5 2D C3 E3 50 AC C6 2B ... : ..........,.Q.%.L...)C\..-..P..+ ... packet: id=593 drop packet: id=594 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=A seq=1477139643 ack_seq=2405818094 using cached desync profile 2 packet: id=594 pass unmodified packet: id=595 len=609 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=AP seq=1477139643 ack_seq=2405818094 TCP: 16 03 01 02 28 01 00 02 24 03 03 33 D8 81 61 67 5D 71 60 DC B7 4F FD F9 C7 3D 3E 22 0F C5 F4 1E ... : ....(...$..3..ag]q`..O...=>".... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1477139643-1477140199 hostname: rr5---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.16:443 l7proto=tls hostname='rr5---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr5---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:43752 dst=212.188.37.16:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-556 len=556 : 03 01 02 28 01 00 02 24 03 03 33 D8 81 61 67 5D 71 60 DC B7 4F FD F9 C7 3D 3E 22 0F C5 F4 1E 18 ... : ...(...$..3..ag]q`..O...=>"..... ... packet: id=595 drop packet: id=596 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307470996 ack_seq=1924460019 using cached desync profile 1 packet: id=596 pass unmodified packet: id=597 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307470996 ack_seq=1924460543 using cached desync profile 1 packet: id=597 pass unmodified packet: id=598 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307470996 ack_seq=1924460543 TCP: 16 03 03 00 7A 02 00 00 76 03 03 7B 8D 20 28 05 EF B8 78 74 4E 32 7D 7F 2C 6C B3 F7 A6 89 9B E7 ... : ....z...v..{. (...xtN2},l...... ... using cached desync profile 1 packet: id=598 pass unmodified packet: id=599 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307472396 ack_seq=1924460543 TCP: 34 FA 6B 74 74 26 C1 AD 2F 87 23 93 F8 B2 7C 80 89 42 C2 00 E7 72 FD DF D0 A6 96 BB C5 BB CA CE ... : 4.ktt&../.#...|..B...r.......... ... using cached desync profile 1 packet: id=599 pass unmodified packet: id=600 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307473796 ack_seq=1924460543 TCP: DF 4D 97 57 E7 AC 38 5B AE 7D E7 24 FD 7F 69 44 B9 10 39 7C 23 1F 6B BD A1 6A F3 7A 14 E4 DE 0D ... : .M.W..8[.}.$.iD..9|#.k..j.z.... ... using cached desync profile 1 packet: id=600 pass unmodified packet: id=601 len=371 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=AP seq=307475196 ack_seq=1924460543 TCP: 6E 06 AE 09 F7 6D 11 0C FA F6 E4 1D 71 13 1F E0 40 10 9D E6 AA C6 03 CD F6 57 B6 AD F7 D2 95 EE ... : n....m......q...@........W...... ... using cached desync profile 1 packet: id=601 pass unmodified packet: id=602 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405818094 ack_seq=1477139644 using cached desync profile 1 packet: id=602 pass unmodified packet: id=603 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405818094 ack_seq=1477140200 using cached desync profile 1 packet: id=603 pass unmodified packet: id=604 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405818094 ack_seq=1477140200 TCP: 16 03 03 00 7A 02 00 00 76 03 03 6B FC 95 D7 99 53 34 5A DA 18 AF D2 5B 67 B1 DF F0 48 5B 82 13 ... : ....z...v..k....S4Z....[g...H[.. ... using cached desync profile 1 packet: id=604 pass unmodified packet: id=605 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405819494 ack_seq=1477140200 TCP: 66 18 38 B5 67 81 41 21 F7 5B BC 05 69 AD F0 5B 97 6A 43 A8 BE E8 43 52 64 E9 1A 72 ED C5 53 00 ... : f.8.g.A!.[..i..[.jC...CRd..r..S. ... using cached desync profile 1 packet: id=605 pass unmodified packet: id=606 len=1452 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405820894 ack_seq=1477140200 TCP: 97 F0 53 FC 7F 2F E9 84 96 09 85 9D 80 7B E7 1B 70 54 58 84 C5 BA B0 69 55 9C 31 8C E7 B4 72 E4 ... : ..S./.......{..pTX....iU.1...r. ... using cached desync profile 1 packet: id=606 pass unmodified packet: id=607 len=369 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=AP seq=2405822294 ack_seq=1477140200 TCP: C6 C2 30 98 2C 48 2A 13 FA A4 EB 6D 53 6F DA A1 1A 1E BE E3 8B 0D 38 B7 27 E5 37 36 98 EF 46 6B ... : ..0.,H*....mSo........8.'.76..Fk ... using cached desync profile 1 packet: id=607 pass unmodified packet: id=608 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=A seq=1924460543 ack_seq=307472396 using cached desync profile 1 packet: id=608 pass unmodified packet: id=609 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=A seq=1924460543 ack_seq=307473796 using cached desync profile 1 packet: id=609 pass unmodified packet: id=610 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=A seq=1924460543 ack_seq=307475196 using cached desync profile 1 packet: id=610 pass unmodified packet: id=611 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=A seq=1924460543 ack_seq=307475515 using cached desync profile 1 packet: id=611 pass unmodified packet: id=612 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=AP seq=1924460543 ack_seq=307475515 TCP: 14 03 03 00 01 01 17 03 03 00 35 47 4F 7C 0B 80 81 4F 7E D4 39 26 CB AC 13 E0 89 11 F3 4A 80 E8 ... : ..........5GO|...O~.9&.......J.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=612 pass unmodified packet: id=613 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43754 dport=443 flags=AP seq=1924460607 ack_seq=307475515 TCP: 17 03 03 02 60 EA 02 A2 D2 AA FD 7B B1 BF FF 6C CF 2E 2B FC A1 AB 8A B9 49 AE 1B F1 71 3E A9 52 ... : ....`......{...l..+.....I...q>.R ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=613 pass unmodified packet: id=614 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=A seq=1477140200 ack_seq=2405819494 using cached desync profile 1 packet: id=614 pass unmodified packet: id=615 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=A seq=1477140200 ack_seq=2405820894 using cached desync profile 1 packet: id=615 pass unmodified packet: id=616 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=A seq=1477140200 ack_seq=2405822294 using cached desync profile 1 packet: id=616 pass unmodified packet: id=617 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=A seq=1477140200 ack_seq=2405822611 using cached desync profile 1 packet: id=617 pass unmodified packet: id=618 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=AP seq=1477140200 ack_seq=2405822611 TCP: 14 03 03 00 01 01 17 03 03 00 35 F2 A5 53 48 00 1D 6F 60 41 77 D9 D4 50 9D 54 AD 42 2D 94 76 A4 ... : ..........5..SH..o`Aw..P.T.B-.v. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=618 pass unmodified packet: id=619 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.16 proto=tcp ttl=63 sport=43752 dport=443 flags=AP seq=1477140264 ack_seq=2405822611 TCP: 17 03 03 02 60 9E DC C9 18 A4 60 26 E3 04 FC 9A 7F 74 59 7D B1 E1 16 B2 82 C4 3A 29 29 0C B8 DB ... : ....`.....`&....tY}......:))... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=619 pass unmodified packet: id=620 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=A seq=307475515 ack_seq=1924461220 using cached desync profile 1 packet: id=620 pass unmodified packet: id=621 len=797 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43754 flags=AP seq=307475515 ack_seq=1924461220 TCP: 17 03 03 01 85 06 72 CB 8E 72 D3 79 79 6A 6F DB AC B7 51 18 31 FB E6 8A 27 2B 0E 5C B1 BC 1B 6D ... : ......r..r.yyjo...Q.1...'+.\...m ... using cached desync profile 1 packet: id=621 pass unmodified packet: id=622 len=52 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=A seq=2405822611 ack_seq=1477140877 using cached desync profile 1 packet: id=622 pass unmodified packet: id=623 len=797 mark=00000000 IP4: 212.188.37.16 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=43752 flags=AP seq=2405822611 ack_seq=1477140877 TCP: 17 03 03 01 85 7D 39 A6 18 5B D9 02 50 DB 76 7C 50 41 BD 9A 48 5B BC 07 EF 46 25 13 4F AE 91 AD ... : .....}9..[..P.v|PA..H[...F%.O... ... using cached desync profile 1 packet: id=623 pass unmodified packet: id=624 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=624 pass unmodified packet: id=625 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=625 pass unmodified packet: id=626 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35516 dport=80 flags=S seq=657227000 ack_seq=0 desync profile search for tcp target=216.58.210.164:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=626 pass unmodified packet: id=627 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35518 dport=80 flags=S seq=4072622406 ack_seq=0 desync profile search for tcp target=216.58.210.164:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=627 pass unmodified packet: id=628 len=60 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=35516 flags=SA seq=253335763 ack_seq=657227001 using cached desync profile 2 incoming TTL 56 packet: id=628 pass unmodified packet: id=629 len=60 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=35518 flags=SA seq=4018776726 ack_seq=4072622407 using cached desync profile 2 incoming TTL 56 packet: id=629 pass unmodified packet: id=630 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35516 dport=80 flags=A seq=657227001 ack_seq=253335764 using cached desync profile 2 packet: id=630 pass unmodified packet: id=631 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35516 dport=80 flags=AF seq=657227001 ack_seq=253335764 using cached desync profile 2 packet: id=631 pass unmodified packet: id=632 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35518 dport=80 flags=A seq=4072622407 ack_seq=4018776727 using cached desync profile 2 packet: id=632 pass unmodified packet: id=633 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35518 dport=80 flags=AF seq=4072622407 ack_seq=4018776727 using cached desync profile 2 packet: id=633 pass unmodified packet: id=634 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=35516 flags=AF seq=253335764 ack_seq=657227002 using cached desync profile 2 packet: id=634 pass unmodified packet: id=635 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35516 dport=80 flags=A seq=657227002 ack_seq=253335765 using cached desync profile 2 packet: id=635 pass unmodified packet: id=636 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=56 sport=80 dport=35518 flags=AF seq=4018776727 ack_seq=4072622408 using cached desync profile 2 packet: id=636 pass unmodified packet: id=637 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35518 dport=80 flags=A seq=4072622408 ack_seq=4018776728 using cached desync profile 2 packet: id=637 pass unmodified packet: id=638 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35520 dport=80 flags=S seq=1393078049 ack_seq=0 desync profile search for tcp target=216.58.210.164:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=638 pass unmodified packet: id=639 len=60 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=35520 flags=SA seq=3154261317 ack_seq=1393078050 using cached desync profile 2 incoming TTL 58 packet: id=639 pass unmodified packet: id=640 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35520 dport=80 flags=A seq=1393078050 ack_seq=3154261318 using cached desync profile 2 packet: id=640 pass unmodified packet: id=641 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35520 dport=80 flags=AF seq=1393078050 ack_seq=3154261318 using cached desync profile 2 packet: id=641 pass unmodified packet: id=642 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=58 sport=80 dport=35520 flags=AF seq=3154261318 ack_seq=1393078051 using cached desync profile 2 packet: id=642 pass unmodified packet: id=643 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35520 dport=80 flags=A seq=1393078051 ack_seq=3154261319 using cached desync profile 2 packet: id=643 pass unmodified packet: id=644 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=S seq=2581790592 ack_seq=0 desync profile search for tcp target=74.125.153.82:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=644 pass unmodified packet: id=645 len=60 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=SA seq=1619240260 ack_seq=2581790593 using cached desync profile 2 incoming TTL 56 packet: id=645 pass unmodified packet: id=646 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=S seq=2809451678 ack_seq=0 desync profile search for tcp target=74.125.153.82:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=646 pass unmodified packet: id=647 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=S seq=3441474329 ack_seq=0 desync profile search for tcp target=74.125.153.82:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=647 pass unmodified packet: id=648 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=A seq=2581790593 ack_seq=1619240261 using cached desync profile 2 packet: id=648 pass unmodified packet: id=649 len=637 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=AP seq=2581790593 ack_seq=1619240261 TCP: 16 03 01 02 44 01 00 02 40 03 03 B8 44 C7 DB EB BA 97 5A CC E8 13 BA 8E 66 10 B8 90 38 A1 BD 67 ... : ....D...@...D.....Z.....f...8..g ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2581790593-2581791177 hostname: rr2---sn-n8v7znze.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.82:443 l7proto=tls hostname='rr2---sn-n8v7znze.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-n8v7znze.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:33882 dst=74.125.153.82:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-584 len=584 : 03 01 02 44 01 00 02 40 03 03 B8 44 C7 DB EB BA 97 5A CC E8 13 BA 8E 66 10 B8 90 38 A1 BD 67 72 ... : ...D...@...D.....Z.....f...8..gr ... packet: id=649 drop packet: id=650 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=650 pass unmodified packet: id=651 len=60 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=SA seq=3077335226 ack_seq=2809451679 using cached desync profile 2 incoming TTL 120 packet: id=651 pass unmodified packet: id=652 len=60 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=SA seq=3835028286 ack_seq=3441474330 using cached desync profile 2 incoming TTL 120 packet: id=652 pass unmodified packet: id=653 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=A seq=2809451679 ack_seq=3077335227 using cached desync profile 2 packet: id=653 pass unmodified packet: id=654 len=573 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=AP seq=2809451679 ack_seq=3077335227 TCP: 16 03 01 02 04 01 00 02 00 03 03 AE E9 50 08 08 9B D7 01 D6 CE D3 DF E4 21 6F 12 2B AC 36 46 B5 ... : .............P..........!o.+.6F. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2809451679-2809452199 hostname: rr2---sn-n8v7znze.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.82:443 l7proto=tls hostname='rr2---sn-n8v7znze.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-n8v7znze.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:33884 dst=74.125.153.82:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-520 len=520 : 03 01 02 04 01 00 02 00 03 03 AE E9 50 08 08 9B D7 01 D6 CE D3 DF E4 21 6F 12 2B AC 36 46 B5 3F ... : ............P..........!o.+.6F.? ... packet: id=654 drop packet: id=655 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=A seq=3441474330 ack_seq=3835028287 using cached desync profile 2 packet: id=655 pass unmodified packet: id=656 len=573 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=AP seq=3441474330 ack_seq=3835028287 TCP: 16 03 01 02 04 01 00 02 00 03 03 D5 74 57 64 58 BA 7D B1 5D D5 C6 2D 61 01 A2 72 EB D2 03 98 16 ... : ............tWdX.}.]..-a..r..... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3441474330-3441474850 hostname: rr2---sn-n8v7znze.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.82:443 l7proto=tls hostname='rr2---sn-n8v7znze.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr2---sn-n8v7znze.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:33896 dst=74.125.153.82:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-520 len=520 : 03 01 02 04 01 00 02 00 03 03 D5 74 57 64 58 BA 7D B1 5D D5 C6 2D 61 01 A2 72 EB D2 03 98 16 11 ... : ...........tWdX.}.]..-a..r...... ... packet: id=656 drop packet: id=657 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619240261 ack_seq=2581790594 using cached desync profile 1 packet: id=657 pass unmodified packet: id=658 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619240261 ack_seq=2581791178 using cached desync profile 1 packet: id=658 pass unmodified packet: id=659 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619240261 ack_seq=2581791178 TCP: 16 03 03 00 7A 02 00 00 76 03 03 83 41 40 5E AF 20 79 8B D3 E2 C3 9B 6F BC 55 41 03 CB 9D 93 2B ... : ....z...v...A@^. y.....o.UA....+ ... using cached desync profile 1 packet: id=659 pass unmodified packet: id=660 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619241657 ack_seq=2581791178 TCP: AE D4 AC ED 79 84 67 CC 30 AD F1 7D 05 16 C5 79 7D FA 7E 5A 07 08 A2 0D 38 94 7A 80 8D 1A A4 05 ... : ....y.g.0..}...y}.~Z....8.z..... ... using cached desync profile 1 packet: id=660 pass unmodified packet: id=661 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619243053 ack_seq=2581791178 TCP: F5 2F DB 29 11 C1 B3 B4 54 54 7B 89 0B B9 A8 0F 81 5D E0 16 FF 2F AB B2 0C 95 10 2A 12 A6 C3 EC ... : ./.)....TT{......].../.....*.... ... using cached desync profile 1 packet: id=661 pass unmodified packet: id=662 len=381 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=AP seq=1619244449 ack_seq=2581791178 TCP: DB FD 46 94 9C 98 26 4A 27 2B D8 43 75 E2 83 12 A2 DA 87 53 69 33 CE 8E F6 7A 1A AE F4 43 90 F1 ... : ..F...&J'+.Cu......Si3...z...C.. ... using cached desync profile 1 packet: id=662 pass unmodified packet: id=663 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077335227 ack_seq=2809451680 using cached desync profile 1 packet: id=663 pass unmodified packet: id=664 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077335227 ack_seq=2809452200 using cached desync profile 1 packet: id=664 pass unmodified packet: id=665 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077335227 ack_seq=2809452200 TCP: 16 03 03 00 7A 02 00 00 76 03 03 59 8A F3 67 76 AA F2 BD 37 46 55 2C C5 9A 99 AF 87 80 11 DD 53 ... : ....z...v..Y..gv...7FU,........S ... using cached desync profile 1 packet: id=665 pass unmodified packet: id=666 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077336623 ack_seq=2809452200 TCP: 31 45 0C C6 02 4F 4D AC 65 41 37 C6 9D 8A 38 76 8D F9 84 61 73 3B 8A 9A A8 8A D2 D6 82 3F 4F 8F ... : 1E...OM.eA7...8v...as;.......?O. ... using cached desync profile 1 packet: id=666 pass unmodified packet: id=667 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077338019 ack_seq=2809452200 TCP: 85 D0 CA E2 B8 F6 75 3B 42 B3 E2 F4 ED 44 C5 87 77 10 FE D3 D3 8D 1A 74 AE 9E D6 F4 E6 F2 63 B5 ... : ......u;B....D..w......t......c. ... using cached desync profile 1 packet: id=667 pass unmodified packet: id=668 len=381 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=AP seq=3077339415 ack_seq=2809452200 TCP: C0 77 82 8E 8B E3 6F E9 F5 DA 2D C5 56 49 CD 6B 01 71 C7 9F 4F 8D B5 DB 04 8B 1D 60 C9 16 4C DC ... : .w....o...-.VI.k.q..O......`..L. ... using cached desync profile 1 packet: id=668 pass unmodified packet: id=669 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=A seq=2581791178 ack_seq=1619241657 using cached desync profile 1 packet: id=669 pass unmodified packet: id=670 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=A seq=2581791178 ack_seq=1619243053 using cached desync profile 1 packet: id=670 pass unmodified packet: id=671 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835028287 ack_seq=3441474331 using cached desync profile 1 packet: id=671 pass unmodified packet: id=672 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835028287 ack_seq=3441474851 using cached desync profile 1 packet: id=672 pass unmodified packet: id=673 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835028287 ack_seq=3441474851 TCP: 16 03 03 00 7A 02 00 00 76 03 03 76 89 E8 0F 15 A5 F7 72 E9 E9 D7 C7 B7 E9 DB 23 D5 87 C1 12 21 ... : ....z...v..v......r.......#....! ... using cached desync profile 1 packet: id=673 pass unmodified packet: id=674 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835029683 ack_seq=3441474851 TCP: 09 60 4B C9 08 7B 8C EB E2 14 6C DB 2C 3A 54 47 11 74 6C 21 E9 F8 D4 24 C8 F2 37 FE 5A 09 DB E6 ... : .`K..{....l.,:TG.tl!...$..7.Z... ... using cached desync profile 1 packet: id=674 pass unmodified packet: id=675 len=1448 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835031079 ack_seq=3441474851 TCP: D0 F4 F3 86 BE 1B C4 C6 5F 04 57 82 C4 F9 1C 80 7D E2 F2 82 BC 99 44 2C 43 1D 36 41 9C 80 24 8C ... : ........_.W.....}.....D,C.6A..$. ... using cached desync profile 1 packet: id=675 pass unmodified packet: id=676 len=382 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=AP seq=3835032475 ack_seq=3441474851 TCP: 6F 6B F1 30 F1 09 DA 88 8A 54 2B ED 17 EA 02 82 DF 7C 8B E4 48 6B B6 D1 BD C0 E1 8D 16 48 B0 62 ... : ok.0.....T+......|..Hk.......H.b ... using cached desync profile 1 packet: id=676 pass unmodified packet: id=677 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=A seq=2581791178 ack_seq=1619244449 using cached desync profile 1 packet: id=677 pass unmodified packet: id=678 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=A seq=2581791178 ack_seq=1619244778 using cached desync profile 1 packet: id=678 pass unmodified packet: id=679 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=A seq=2809452200 ack_seq=3077336623 using cached desync profile 1 packet: id=679 pass unmodified packet: id=680 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=A seq=2809452200 ack_seq=3077338019 using cached desync profile 1 packet: id=680 pass unmodified packet: id=681 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=A seq=2809452200 ack_seq=3077339415 using cached desync profile 1 packet: id=681 pass unmodified packet: id=682 len=381 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=AP seq=1619244449 ack_seq=2581791178 TCP: DB FD 46 94 9C 98 26 4A 27 2B D8 43 75 E2 83 12 A2 DA 87 53 69 33 CE 8E F6 7A 1A AE F4 43 90 F1 ... : ..F...&J'+.Cu......Si3...z...C.. ... using cached desync profile 1 packet: id=682 pass unmodified packet: id=683 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=A seq=2809452200 ack_seq=3077339744 using cached desync profile 1 packet: id=683 pass unmodified packet: id=684 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=A seq=3441474851 ack_seq=3835029683 using cached desync profile 1 packet: id=684 pass unmodified packet: id=685 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=AP seq=2581791178 ack_seq=1619244778 TCP: 14 03 03 00 01 01 17 03 03 00 35 59 08 EA B7 DF 07 18 72 AA 95 51 93 0D 3E 1F D3 58 DC 9D 13 60 ... : ..........5Y......r..Q..>..X...` ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=685 pass unmodified packet: id=686 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=A seq=3441474851 ack_seq=3835031079 using cached desync profile 1 packet: id=686 pass unmodified packet: id=687 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=AP seq=2809452200 ack_seq=3077339744 TCP: 14 03 03 00 01 01 17 03 03 00 35 7A 75 04 65 4E 02 A3 34 99 6A 36 DA 71 46 4E DC D7 C7 4C 65 12 ... : ..........5zu.eN..4.j6.qFN...Le. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=687 pass unmodified packet: id=688 len=661 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33882 dport=443 flags=AP seq=2581791242 ack_seq=1619244778 TCP: 17 03 03 02 5C 2E 7F 16 41 E6 20 FA 95 15 B4 BE 6A 6D 58 2C 80 A9 8D 13 75 E0 EB E9 D0 64 B9 C2 ... : ....\..A. .....jmX,....u....d.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=688 pass unmodified packet: id=689 len=381 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=AP seq=3077339415 ack_seq=2809452200 TCP: C0 77 82 8E 8B E3 6F E9 F5 DA 2D C5 56 49 CD 6B 01 71 C7 9F 4F 8D B5 DB 04 8B 1D 60 C9 16 4C DC ... : .w....o...-.VI.k.q..O......`..L. ... using cached desync profile 1 packet: id=689 pass unmodified packet: id=690 len=661 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33884 dport=443 flags=AP seq=2809452264 ack_seq=3077339744 TCP: 17 03 03 02 5C 55 00 43 1E 2A CE AB 26 7C 76 8C 38 95 EC 8A 84 DC C3 59 6F 6E 41 61 85 F9 67 D2 ... : ....\U.C.*..&|v.8......YonAa..g. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=690 pass unmodified packet: id=691 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=A seq=3441474851 ack_seq=3835032475 using cached desync profile 1 packet: id=691 pass unmodified packet: id=692 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=A seq=3441474851 ack_seq=3835032805 using cached desync profile 1 packet: id=692 pass unmodified packet: id=693 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=AP seq=3441474851 ack_seq=3835032805 TCP: 14 03 03 00 01 01 17 03 03 00 35 D9 62 95 46 49 AE EA 82 CF 7F DB B8 FD 97 FC 35 1E 0A 7C 35 7B ... : ..........5.b.FI.........5..|5{ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=693 pass unmodified packet: id=694 len=681 mark=20000000 IP4: 192.168.1.8 => 74.125.153.82 proto=tcp ttl=63 sport=33896 dport=443 flags=AP seq=3441474915 ack_seq=3835032805 TCP: 17 03 03 02 70 28 D2 CD 69 5E C9 C8 62 A1 FF 64 91 EE 9D F1 3B 8C 56 18 30 37 E6 84 B3 75 95 83 ... : ....p(..i^..b..d....;.V.07...u.. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=694 pass unmodified packet: id=695 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=A seq=1619244778 ack_seq=2581791851 using cached desync profile 1 packet: id=695 pass unmodified packet: id=696 len=797 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=33882 flags=AP seq=1619244778 ack_seq=2581791851 TCP: 17 03 03 01 85 58 89 32 EC 22 97 86 B9 60 88 35 38 C7 3E 09 BB 7C 44 09 88 06 40 FB 74 E0 B8 88 ... : .....X.2."...`.58.>..|D...@.t... ... using cached desync profile 1 packet: id=696 pass unmodified packet: id=697 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=A seq=3077339744 ack_seq=2809452873 using cached desync profile 1 packet: id=697 pass unmodified packet: id=698 len=797 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33884 flags=AP seq=3077339744 ack_seq=2809452873 TCP: 17 03 03 01 85 85 7C 6D 23 EC 34 6F 1A 56 33 D5 D4 CA 6B 9B 4A F1 AE FE A5 8B D8 13 5D 82 B4 CD ... : ......|m#.4o.V3...k.J.......]... ... using cached desync profile 1 packet: id=698 pass unmodified packet: id=699 len=64 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835032805 ack_seq=3441474851 using cached desync profile 1 packet: id=699 pass unmodified packet: id=700 len=64 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835032805 ack_seq=3441474851 using cached desync profile 1 packet: id=700 pass unmodified packet: id=701 len=64 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835032805 ack_seq=3441474851 using cached desync profile 1 packet: id=701 pass unmodified packet: id=702 len=64 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835032805 ack_seq=3441474915 using cached desync profile 1 packet: id=702 pass unmodified packet: id=703 len=52 mark=00000000 IP4: 74.125.153.82 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=33896 flags=A seq=3835032805 ack_seq=3441479542 using cached desync profile 1 packet: id=703 pass unmodified packet: id=704 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=704 pass unmodified packet: id=705 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=S seq=2453300896 ack_seq=0 desync profile search for tcp target=173.194.179.164:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=705 pass unmodified packet: id=706 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=S seq=1265371586 ack_seq=0 desync profile search for tcp target=173.194.179.164:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=706 pass unmodified packet: id=707 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=S seq=2104308127 ack_seq=0 desync profile search for tcp target=173.194.179.164:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=707 pass unmodified packet: id=708 len=60 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=SA seq=128876831 ack_seq=2453300897 using cached desync profile 2 incoming TTL 58 packet: id=708 pass unmodified packet: id=709 len=60 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=SA seq=842428284 ack_seq=1265371587 using cached desync profile 2 incoming TTL 57 packet: id=709 pass unmodified packet: id=710 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=A seq=2453300897 ack_seq=128876832 using cached desync profile 2 packet: id=710 pass unmodified packet: id=711 len=60 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=SA seq=340095329 ack_seq=2104308128 using cached desync profile 2 incoming TTL 123 packet: id=711 pass unmodified packet: id=712 len=606 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=AP seq=2453300897 ack_seq=128876832 TCP: 16 03 01 02 25 01 00 02 21 03 03 8A CD 32 2A 41 00 48 F3 64 60 BD CA 02 93 41 FC 8C DF C4 1D A9 ... : ....%...!....2*A.H.d`....A...... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2453300897-2453301450 hostname: rr18---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.164:443 l7proto=tls hostname='rr18---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr18---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:48230 dst=173.194.179.164:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-553 len=553 : 03 01 02 25 01 00 02 21 03 03 8A CD 32 2A 41 00 48 F3 64 60 BD CA 02 93 41 FC 8C DF C4 1D A9 B9 ... : ...%...!....2*A.H.d`....A....... ... packet: id=712 drop packet: id=713 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=A seq=1265371587 ack_seq=842428285 using cached desync profile 2 packet: id=713 pass unmodified packet: id=714 len=574 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=AP seq=1265371587 ack_seq=842428285 TCP: 16 03 01 02 05 01 00 02 01 03 03 16 75 76 B0 F4 69 01 7F C5 30 9F 32 82 F2 91 59 55 E1 AA 79 49 ... : ............uv..i..0.2...YU..yI ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1265371587-1265372108 hostname: rr18---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.164:443 l7proto=tls hostname='rr18---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr18---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:48246 dst=173.194.179.164:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-521 len=521 : 03 01 02 05 01 00 02 01 03 03 16 75 76 B0 F4 69 01 7F C5 30 9F 32 82 F2 91 59 55 E1 AA 79 49 3B ... : ...........uv..i..0.2...YU..yI; ... packet: id=714 drop packet: id=715 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=A seq=2104308128 ack_seq=340095330 using cached desync profile 2 packet: id=715 pass unmodified packet: id=716 len=638 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=AP seq=2104308128 ack_seq=340095330 TCP: 16 03 01 02 45 01 00 02 41 03 03 BE 59 A4 E2 7D 27 FD 3E E0 F9 15 EE DA D8 BF 01 05 88 59 AA D3 ... : ....E...A...Y..}'.>..........Y.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2104308128-2104308713 hostname: rr18---sn-n8v7znsl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.179.164:443 l7proto=tls hostname='rr18---sn-n8v7znsl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr18---sn-n8v7znsl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:48248 dst=173.194.179.164:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-585 len=585 : 03 01 02 45 01 00 02 41 03 03 BE 59 A4 E2 7D 27 FD 3E E0 F9 15 EE DA D8 BF 01 05 88 59 AA D3 34 ... : ...E...A...Y..}'.>..........Y..4 ... packet: id=716 drop packet: id=717 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128876832 ack_seq=2453300898 using cached desync profile 1 packet: id=717 pass unmodified packet: id=718 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128876832 ack_seq=2453301451 using cached desync profile 1 packet: id=718 pass unmodified packet: id=719 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128876832 ack_seq=2453301451 TCP: 16 03 03 00 7A 02 00 00 76 03 03 7A 08 85 A0 75 0E 77 D6 2B E7 A0 92 03 A8 DC 6F DC 95 1E B4 CD ... : ....z...v..z...u.w.+......o..... ... using cached desync profile 1 packet: id=719 pass unmodified packet: id=720 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128878228 ack_seq=2453301451 TCP: 47 CF AE D1 57 45 BD 26 5A 45 1B FA 7D 40 52 74 65 44 24 B4 6B CE 78 4D 0E 4B CD 70 71 68 88 E6 ... : G...WE.&ZE..}@RteD$.k.xM.K.pqh.. ... using cached desync profile 1 packet: id=720 pass unmodified packet: id=721 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128879624 ack_seq=2453301451 TCP: 4E FB ED 16 37 E9 E1 93 42 24 2C 86 03 12 CD 2C 01 91 26 50 01 28 DF 12 AD B1 EB 78 4B 18 28 9A ... : N...7...B$,....,..&P.(.....xK.(. ... using cached desync profile 1 packet: id=721 pass unmodified packet: id=722 len=381 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=AP seq=128881020 ack_seq=2453301451 TCP: 13 FC EA E2 34 F5 D2 B2 7B BD 23 4D 14 DD 31 22 F9 4C 33 1D 2C 3E 21 53 87 8F 7E 2D 29 C9 05 F6 ... : ....4...{.#M..1".L3.,>!S..~-)... ... using cached desync profile 1 packet: id=722 pass unmodified packet: id=723 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842428285 ack_seq=1265371588 using cached desync profile 1 packet: id=723 pass unmodified packet: id=724 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842428285 ack_seq=1265372109 using cached desync profile 1 packet: id=724 pass unmodified packet: id=725 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842428285 ack_seq=1265372109 TCP: 16 03 03 00 7A 02 00 00 76 03 03 2E F9 A0 45 B9 BD 65 9B 6A 7E 5E 5E 1A B9 C6 3C 49 A9 BF 13 C1 ... : ....z...v.....E..e.j~^^... 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842429681 ack_seq=1265372109 TCP: 23 66 E2 53 A5 FA 2A C0 1E BF EB 66 63 3A 73 E1 B6 5F C3 5A 47 AB F5 52 31 6E A7 90 E5 4D ED A6 ... : #f.S..*....fc:s.._.ZG..R1n...M.. ... using cached desync profile 1 packet: id=726 pass unmodified packet: id=727 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842431077 ack_seq=1265372109 TCP: B4 CE 89 F3 B4 DA 38 4D 33 D7 69 FF A0 DE BB D0 10 DB 37 3F 90 3F 63 8E 2B 3A D0 32 57 2D 03 9B ... : ......8M3.i.......7?.?c.+:.2W-.. ... using cached desync profile 1 packet: id=727 pass unmodified packet: id=728 len=381 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=AP seq=842432473 ack_seq=1265372109 TCP: 32 B9 3E FF DC A8 78 D9 66 B2 6B 97 0E 4E 39 D9 F2 25 DA CF 7B 36 F1 63 2C 1B 5A C6 46 3F F5 C4 ... : 2.>...x.f.k..N9..%..{6.c,.Z.F?.. ... using cached desync profile 1 packet: id=728 pass unmodified packet: id=729 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340095330 ack_seq=2104308129 using cached desync profile 1 packet: id=729 pass unmodified packet: id=730 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340095330 ack_seq=2104308714 using cached desync profile 1 packet: id=730 pass unmodified packet: id=731 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340095330 ack_seq=2104308714 TCP: 16 03 03 00 7A 02 00 00 76 03 03 4B 97 C1 4B C3 3E A6 CE 00 A5 26 94 5F 1C 2D 17 EF 11 31 C0 1F ... : ....z...v..K..K.>....&._.-...1.. ... using cached desync profile 1 packet: id=731 pass unmodified packet: id=732 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340096726 ack_seq=2104308714 TCP: 40 32 82 48 5E 1D CF 17 8D CB E3 F2 AB 1A 44 D7 60 A6 A6 16 29 21 84 31 4D A2 36 5C C9 5A F6 93 ... : @2.H^.........D.`...)!.1M.6\.Z.. ... using cached desync profile 1 packet: id=732 pass unmodified packet: id=733 len=1448 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340098122 ack_seq=2104308714 TCP: 31 3F 14 38 9B 8E 72 E0 60 13 7E 5E A8 DD FB BF FB 76 8E BF 50 67 50 21 9D 8B 71 45 89 23 E9 1B ... : 1?.8..r.`.~^.....v..PgP!..qE.#.. ... using cached desync profile 1 packet: id=733 pass unmodified packet: id=734 len=383 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=AP seq=340099518 ack_seq=2104308714 TCP: 8A 23 8A B9 30 41 07 CA 9C 37 86 4F B9 AB 01 FB 0D C6 D9 31 F9 A6 15 BC DA 59 AC 50 9B 6A 1C BC ... : .#..0A...7.O.......1.....Y.P.j.. ... using cached desync profile 1 packet: id=734 pass unmodified packet: id=735 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=A seq=2453301451 ack_seq=128878228 using cached desync profile 1 packet: id=735 pass unmodified packet: id=736 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=A seq=2453301451 ack_seq=128879624 using cached desync profile 1 packet: id=736 pass unmodified packet: id=737 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=A seq=2453301451 ack_seq=128881020 using cached desync profile 1 packet: id=737 pass unmodified packet: id=738 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=A seq=2453301451 ack_seq=128881349 using cached desync profile 1 packet: id=738 pass unmodified packet: id=739 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=A seq=1265372109 ack_seq=842429681 using cached desync profile 1 packet: id=739 pass unmodified packet: id=740 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=A seq=1265372109 ack_seq=842431077 using cached desync profile 1 packet: id=740 pass unmodified packet: id=741 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=AP seq=2453301451 ack_seq=128881349 TCP: 14 03 03 00 01 01 17 03 03 00 35 78 BB AE FF EE 80 DE AE 2E 17 04 D4 51 A4 FB 52 9F 41 D9 62 B4 ... : ..........5x...........Q..R.A.b. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=741 pass unmodified packet: id=742 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=A seq=1265372109 ack_seq=842432473 using cached desync profile 1 packet: id=742 pass unmodified packet: id=743 len=682 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48230 dport=443 flags=AP seq=2453301515 ack_seq=128881349 TCP: 17 03 03 02 71 5B 55 DD 53 FA 62 E4 1F BB 1D DC D4 73 9F AC 89 99 E1 92 0A EF E6 A3 CB E8 FC 10 ... : ....q[U.S.b......s.............. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=743 pass unmodified packet: id=744 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=A seq=1265372109 ack_seq=842432802 using cached desync profile 1 packet: id=744 pass unmodified packet: id=745 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=AP seq=1265372109 ack_seq=842432802 TCP: 14 03 03 00 01 01 17 03 03 00 35 86 55 9B B2 B0 6A 78 3D 34 2A C8 F7 F4 8D 00 DB B5 7F 70 28 6C ... : ..........5.U...jx=4*.......p(l ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=745 pass unmodified packet: id=746 len=662 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48246 dport=443 flags=AP seq=1265372173 ack_seq=842432802 TCP: 17 03 03 02 5D 1D 7F 91 EC 0B 72 BB FF D4 7A 99 97 78 A6 B5 0C CF 8B 26 8D 90 CB 33 79 89 35 40 ... : ....]....r...z..x.....&...3y.5@ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=746 pass unmodified packet: id=747 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=A seq=2104308714 ack_seq=340096726 using cached desync profile 1 packet: id=747 pass unmodified packet: id=748 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=A seq=2104308714 ack_seq=340098122 using cached desync profile 1 packet: id=748 pass unmodified packet: id=749 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=A seq=2104308714 ack_seq=340099518 using cached desync profile 1 packet: id=749 pass unmodified packet: id=750 len=64 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128881349 ack_seq=2453301451 using cached desync profile 1 packet: id=750 pass unmodified packet: id=751 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=A seq=2104308714 ack_seq=340099849 using cached desync profile 1 packet: id=751 pass unmodified packet: id=752 len=116 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=AP seq=2104308714 ack_seq=340099849 TCP: 14 03 03 00 01 01 17 03 03 00 35 93 C8 FB 67 AE AD D9 D3 E6 C3 F4 6C 5E 30 7D 43 21 E9 96 67 E1 ... : ..........5...g.......l^0}C!..g. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=752 pass unmodified packet: id=753 len=662 mark=20000000 IP4: 192.168.1.8 => 173.194.179.164 proto=tcp ttl=63 sport=48248 dport=443 flags=AP seq=2104308778 ack_seq=340099849 TCP: 17 03 03 02 5D BF 06 14 43 4E E0 CF C8 5D F8 0D 82 D4 62 A1 DA 85 D0 E1 7F 60 12 D8 8E 2E 9A DD ... : ....]...CN...]....b.....`...... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=753 pass unmodified packet: id=754 len=64 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128881349 ack_seq=2453301451 using cached desync profile 1 packet: id=754 pass unmodified packet: id=755 len=64 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128881349 ack_seq=2453301451 using cached desync profile 1 packet: id=755 pass unmodified packet: id=756 len=64 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128881349 ack_seq=2453301515 using cached desync profile 1 packet: id=756 pass unmodified packet: id=757 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=58 sport=443 dport=48230 flags=A seq=128881349 ack_seq=2453306144 using cached desync profile 1 packet: id=757 pass unmodified packet: id=758 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=A seq=842432802 ack_seq=1265372783 using cached desync profile 1 packet: id=758 pass unmodified packet: id=759 len=797 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=57 sport=443 dport=48246 flags=AP seq=842432802 ack_seq=1265372783 TCP: 17 03 03 01 85 BD 45 8D 62 E9 C7 A3 D3 EB B4 53 AF BD 9E 38 D3 B7 3B C7 48 B1 34 7E 64 6C 82 B0 ... : ......E.b......S...8..;.H.4~dl.. ... using cached desync profile 1 packet: id=759 pass unmodified packet: id=760 len=52 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=A seq=340099849 ack_seq=2104309388 using cached desync profile 1 packet: id=760 pass unmodified packet: id=761 len=797 mark=00000000 IP4: 173.194.179.164 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=48248 flags=AP seq=340099849 ack_seq=2104309388 TCP: 17 03 03 01 85 CD 54 87 85 9B FF 46 D9 2C 01 DB 24 F8 BA B8 8F 00 9B 01 03 E5 18 65 E2 12 30 5F ... : ......T....F.,..$..........e..0_ ... using cached desync profile 1 packet: id=761 pass unmodified packet: id=762 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=S seq=3645807856 ack_seq=0 desync profile search for tcp target=157.240.251.63:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=762 pass unmodified packet: id=763 len=60 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=SA seq=1762043118 ack_seq=3645807857 using cached desync profile 2 incoming TTL 53 packet: id=763 pass unmodified packet: id=764 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=A seq=3645807857 ack_seq=1762043119 using cached desync profile 2 packet: id=764 pass unmodified packet: id=765 len=445 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645807857 ack_seq=1762043119 TCP: 16 03 03 01 84 01 00 01 80 03 03 2D A2 17 F9 36 0D 8F CD 14 DD 14 4D F8 69 D1 1E 1F 9A D4 32 FF ... : ...........-...6......M.i.....2. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3645807857-3645808249 hostname: scontent-fra5-1.cdninstagram.com discovered l7 protocol discovered hostname desync profile search for tcp target=157.240.251.63:443 l7proto=tls hostname='scontent-fra5-1.cdninstagram.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : positive dpi desync src=192.168.1.8:59833 dst=157.240.251.63:443 split pos 1 sending fake request : 16 03 01 02 83 01 00 02 7F 03 03 3A 4D CE 86 07 E3 3A 0F 60 78 9F F0 57 BE 39 8A 11 EF 72 B7 6E ... : ..........:M....:.`x..W.9...r.n ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-392 len=392 : 03 03 01 84 01 00 01 80 03 03 2D A2 17 F9 36 0D 8F CD 14 DD 14 4D F8 69 D1 1E 1F 9A D4 32 FF 7F ... : ..........-...6......M.i.....2. ... packet: id=765 drop packet: id=766 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=766 pass unmodified packet: id=767 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=A seq=1762043119 ack_seq=3645807858 using cached desync profile 2 packet: id=767 pass unmodified packet: id=768 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=A seq=1762043119 ack_seq=3645808250 using cached desync profile 2 packet: id=768 pass unmodified packet: id=769 len=264 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=AP seq=1762043119 ack_seq=3645808250 TCP: 16 03 03 00 80 02 00 00 7C 03 03 D1 A0 D4 4A A5 3E A1 13 B2 2E 65 70 DF 00 58 2A AC 7E 82 82 73 ... : ........|.....J.>....ep..X*.~..s ... using cached desync profile 2 packet: id=769 pass unmodified packet: id=770 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=A seq=3645808250 ack_seq=1762043331 using cached desync profile 2 packet: id=770 pass unmodified packet: id=771 len=58 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645808250 ack_seq=1762043331 TCP: 14 03 03 00 01 01 : ...... using cached desync profile 2 not applying tampering to unknown protocol packet: id=771 pass unmodified packet: id=772 len=110 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645808256 ack_seq=1762043331 TCP: 17 03 03 00 35 40 B7 67 48 F9 86 3A F7 D8 17 5B 9A 61 2C 0A 81 40 49 7D B2 B6 55 42 57 FB A5 36 ... : ....5@.gH..:...[.a,..@I}..UBW..6 ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=772 pass unmodified packet: id=773 len=98 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645808314 ack_seq=1762043331 TCP: 17 03 03 00 29 C3 92 18 73 71 5D 31 F8 10 9A FE 15 5E 0A 87 5D 81 71 01 C0 D5 77 7B D0 43 2F 1D ... : ....)...sq]1.....^..].q...w{.C/. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=773 pass unmodified packet: id=774 len=95 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645808360 ack_seq=1762043331 TCP: 17 03 03 00 26 CD 05 AB 88 57 CD C6 0A 97 04 13 46 22 4C E0 2F F2 65 7F 9A 67 3E 55 ED 28 DE 69 ... : ....&....W......F"L./.e.g>U.(.i ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=774 pass unmodified packet: id=775 len=87 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59833 dport=443 flags=AP seq=3645808403 ack_seq=1762043331 TCP: 17 03 03 00 1E EF 70 4B 4D 7E DD BF B0 40 0B 2F D9 F8 FA F5 24 46 68 FA 08 B7 73 47 78 14 83 BB ... : ......pKM~...@./....$Fh...sGx... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=775 pass unmodified packet: id=776 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=A seq=1762043331 ack_seq=3645808314 using cached desync profile 2 packet: id=776 pass unmodified packet: id=777 len=224 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=AP seq=1762043331 ack_seq=3645808314 TCP: 17 03 03 00 A7 45 16 D3 77 BA 69 B4 A6 18 69 45 F9 66 EE A6 4C 30 EE E6 22 5C FC FD 87 85 FD 9D ... : .....E..w.i...iE.f..L0.."\...... ... using cached desync profile 2 packet: id=777 pass unmodified packet: id=778 len=126 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=AP seq=1762043503 ack_seq=3645808314 TCP: 17 03 03 00 45 F7 EA 38 92 95 B6 6A 1B 65 68 A7 84 0B 2C 39 F7 EF 9D 17 13 A4 C0 9F 2A 06 12 E7 ... : ....E..8...j.eh...,9........*... ... using cached desync profile 2 packet: id=778 pass unmodified packet: id=779 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=A seq=1762043577 ack_seq=3645808403 using cached desync profile 2 packet: id=779 pass unmodified packet: id=780 len=83 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59833 flags=AP seq=1762043577 ack_seq=3645808403 TCP: 17 03 03 00 1A 81 CA 15 EE A0 93 BD 28 1A 18 6C 5F DB 28 54 D0 6A 6F 81 B4 A1 95 E0 F9 C6 89 : ............(..l_.(T.jo........ using cached desync profile 2 packet: id=780 pass unmodified packet: id=781 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=S seq=2317733354 ack_seq=0 desync profile search for tcp target=74.125.153.151:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=781 pass unmodified packet: id=782 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=S seq=3646777098 ack_seq=0 desync profile search for tcp target=74.125.153.151:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=782 pass unmodified packet: id=783 len=60 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=S seq=449616582 ack_seq=0 desync profile search for tcp target=74.125.153.151:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=783 pass unmodified packet: id=784 len=60 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=SA seq=3918185185 ack_seq=2317733355 using cached desync profile 2 incoming TTL 56 packet: id=784 pass unmodified packet: id=785 len=60 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=SA seq=3673275901 ack_seq=3646777099 using cached desync profile 2 incoming TTL 123 packet: id=785 pass unmodified packet: id=786 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=A seq=2317733355 ack_seq=3918185186 using cached desync profile 2 packet: id=786 pass unmodified packet: id=787 len=60 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=SA seq=2594713933 ack_seq=449616583 using cached desync profile 2 incoming TTL 122 packet: id=787 pass unmodified packet: id=788 len=669 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=AP seq=2317733355 ack_seq=3918185186 TCP: 16 03 01 02 64 01 00 02 60 03 03 94 75 56 0B A7 94 5A 43 F2 BE F2 37 BD 92 C3 88 D5 AF F1 1B F4 ... : ....d...`...uV...ZC...7......... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2317733355-2317733971 hostname: rr7---sn-n8v7znzl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.151:443 l7proto=tls hostname='rr7---sn-n8v7znzl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znzl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:42526 dst=74.125.153.151:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-616 len=616 : 03 01 02 64 01 00 02 60 03 03 94 75 56 0B A7 94 5A 43 F2 BE F2 37 BD 92 C3 88 D5 AF F1 1B F4 D8 ... : ...d...`...uV...ZC...7.......... ... packet: id=788 drop packet: id=789 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=A seq=3646777099 ack_seq=3673275902 using cached desync profile 2 packet: id=789 pass unmodified packet: id=790 len=605 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=AP seq=3646777099 ack_seq=3673275902 TCP: 16 03 01 02 24 01 00 02 20 03 03 0B F1 34 B8 67 1D 7A 64 FE 13 42 9A 86 B2 B5 7B F9 1F EF 76 8E ... : ....$... ....4.g.zd..B....{...v. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 3646777099-3646777651 hostname: rr7---sn-n8v7znzl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.151:443 l7proto=tls hostname='rr7---sn-n8v7znzl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znzl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:42538 dst=74.125.153.151:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-552 len=552 : 03 01 02 24 01 00 02 20 03 03 0B F1 34 B8 67 1D 7A 64 FE 13 42 9A 86 B2 B5 7B F9 1F EF 76 8E 50 ... : ...$... ....4.g.zd..B....{...v.P ... packet: id=790 drop packet: id=791 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=A seq=449616583 ack_seq=2594713934 using cached desync profile 2 packet: id=791 pass unmodified packet: id=792 len=605 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=AP seq=449616583 ack_seq=2594713934 TCP: 16 03 01 02 24 01 00 02 20 03 03 1E 47 67 3C 7E ED F1 8C 34 AB E0 AB 0F 8E 89 FB 22 95 B7 52 34 ... : ....$... ...Gg<~...4......."..R4 ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 449616583-449617135 hostname: rr7---sn-n8v7znzl.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=74.125.153.151:443 l7proto=tls hostname='rr7---sn-n8v7znzl.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr7---sn-n8v7znzl.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:42540 dst=74.125.153.151:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-552 len=552 : 03 01 02 24 01 00 02 20 03 03 1E 47 67 3C 7E ED F1 8C 34 AB E0 AB 0F 8E 89 FB 22 95 B7 52 34 9F ... : ...$... ...Gg<~...4......."..R4. ... packet: id=792 drop packet: id=793 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918185186 ack_seq=2317733356 using cached desync profile 1 packet: id=793 pass unmodified packet: id=794 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918185186 ack_seq=2317733972 using cached desync profile 1 packet: id=794 pass unmodified packet: id=795 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918185186 ack_seq=2317733972 TCP: 16 03 03 00 7A 02 00 00 76 03 03 EB 94 B6 DA 8F F5 42 CF 8E 36 D8 04 70 C1 63 45 4D 98 39 05 E9 ... : ....z...v........B..6..p.cEM.9.. ... using cached desync profile 1 packet: id=795 pass unmodified packet: id=796 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918186582 ack_seq=2317733972 TCP: CE B3 7E 69 67 96 BD 4A EC A0 3E DA 4F 8C 99 3B 84 E6 1D AD 1B BB 31 7D 98 56 DF 36 C3 D3 86 9A ... : ..~ig..J..>.O..;......1}.V.6.... ... using cached desync profile 1 packet: id=796 pass unmodified packet: id=797 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918187978 ack_seq=2317733972 TCP: 58 6C A1 68 ED 34 21 1F A9 C4 DA D3 C7 CA 3A E6 52 36 0C 1F AF DE BE A8 CF 44 13 C9 06 C1 1F 90 ... : Xl.h.4!.......:.R6.......D...... ... using cached desync profile 1 packet: id=797 pass unmodified packet: id=798 len=383 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=AP seq=3918189374 ack_seq=2317733972 TCP: A9 A0 E4 23 81 A5 0C AD 3A 08 84 12 01 57 B5 5E 38 9F FB CA 17 9A AD 81 E7 1B C9 86 A2 22 8C 06 ... : ...#....:....W.^8............".. ... using cached desync profile 1 packet: id=798 pass unmodified packet: id=799 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=A seq=2317733972 ack_seq=3918186582 using cached desync profile 1 packet: id=799 pass unmodified packet: id=800 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=A seq=2317733972 ack_seq=3918187978 using cached desync profile 1 packet: id=800 pass unmodified packet: id=801 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=A seq=2317733972 ack_seq=3918189374 using cached desync profile 1 packet: id=801 pass unmodified packet: id=802 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=A seq=2317733972 ack_seq=3918189705 using cached desync profile 1 packet: id=802 pass unmodified packet: id=803 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673275902 ack_seq=3646777100 using cached desync profile 1 packet: id=803 pass unmodified packet: id=804 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673275902 ack_seq=3646777652 using cached desync profile 1 packet: id=804 pass unmodified packet: id=805 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673275902 ack_seq=3646777652 TCP: 16 03 03 00 7A 02 00 00 76 03 03 72 2F 07 B7 F9 F1 B7 27 CE 73 6D A9 9A A9 A5 B9 6E 98 02 15 66 ... : ....z...v..r/.....'.sm.....n...f ... using cached desync profile 1 packet: id=805 pass unmodified packet: id=806 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673277298 ack_seq=3646777652 TCP: DD CF CD F5 39 17 34 20 47 29 C9 23 5B 52 33 97 63 7C 1A 0A D8 71 23 5A 9A 5B 4F 64 D0 20 EC 2A ... : ....9.4 G).#[R3.c|...q#Z.[Od. .* ... using cached desync profile 1 packet: id=806 pass unmodified packet: id=807 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673278694 ack_seq=3646777652 TCP: 47 DD 68 46 0B 7C BC AE 55 E7 ED 5F 7C C8 AA 8C 2E 6C F6 87 41 27 4F CF EA 40 B6 22 BC 42 75 A2 ... : G.hF.|..U.._|....l..A'O..@.".Bu. ... using cached desync profile 1 packet: id=807 pass unmodified packet: id=808 len=382 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=AP seq=3673280090 ack_seq=3646777652 TCP: CF 2A 2C 8C A3 6F 28 31 D5 52 7A 6E 83 9E EF 40 E7 43 EB CD AB FD 36 7B F6 CE BF 9B 3A 90 49 FF ... : .*,..o(1.Rzn...@.C....6{....:.I. ... using cached desync profile 1 packet: id=808 pass unmodified packet: id=809 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=AP seq=2317733972 ack_seq=3918189705 TCP: 14 03 03 00 01 01 17 03 03 00 35 00 60 FC 24 56 B2 15 B7 4D 4A D4 15 19 7D 95 9E 22 7F 96 A1 62 ... : ..........5.`.$V...MJ...}.."..b ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=809 pass unmodified packet: id=810 len=383 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=AP seq=3918189374 ack_seq=2317733972 TCP: A9 A0 E4 23 81 A5 0C AD 3A 08 84 12 01 57 B5 5E 38 9F FB CA 17 9A AD 81 E7 1B C9 86 A2 22 8C 06 ... : ...#....:....W.^8............".. ... using cached desync profile 1 packet: id=810 pass unmodified packet: id=811 len=661 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42526 dport=443 flags=AP seq=2317734036 ack_seq=3918189705 TCP: 17 03 03 02 5C AC EE C4 ED 69 BA D0 5E 22 7E 0F E5 E8 5E 57 20 7A 33 AB 70 2F 95 1F A0 56 B5 3E ... : ....\....i..^"~...^W z3.p/...V.> ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=811 pass unmodified packet: id=812 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=A seq=3646777652 ack_seq=3673277298 using cached desync profile 1 packet: id=812 pass unmodified packet: id=813 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=A seq=3646777652 ack_seq=3673278694 using cached desync profile 1 packet: id=813 pass unmodified packet: id=814 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=A seq=3646777652 ack_seq=3673280090 using cached desync profile 1 packet: id=814 pass unmodified packet: id=815 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=A seq=3646777652 ack_seq=3673280420 using cached desync profile 1 packet: id=815 pass unmodified packet: id=816 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=AP seq=3646777652 ack_seq=3673280420 TCP: 14 03 03 00 01 01 17 03 03 00 35 E5 93 00 66 04 0E F5 F0 6D DF 04 D9 4D 53 8B 30 91 B0 E5 09 9E ... : ..........5...f....m...MS.0..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=816 pass unmodified packet: id=817 len=661 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42538 dport=443 flags=AP seq=3646777716 ack_seq=3673280420 TCP: 17 03 03 02 5C 1F 8F F7 8F A0 F3 C6 67 F8 E6 20 8B 6D 56 D6 B3 97 D4 1A 69 B3 B7 2B D1 AB 2F 8D ... : ....\.......g.. .mV.....i..+../. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=817 pass unmodified packet: id=818 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594713934 ack_seq=449616584 using cached desync profile 1 packet: id=818 pass unmodified packet: id=819 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594713934 ack_seq=449617136 using cached desync profile 1 packet: id=819 pass unmodified packet: id=820 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594713934 ack_seq=449617136 TCP: 16 03 03 00 7A 02 00 00 76 03 03 96 BE 82 F7 8D AA 17 B9 3B 28 72 FC 1E 69 94 71 CC 20 98 A6 1F ... : ....z...v..........;(r..i.q. ... ... using cached desync profile 1 packet: id=820 pass unmodified packet: id=821 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594715330 ack_seq=449617136 TCP: C2 7C 98 8D 14 12 0A 80 E2 8B BD 1E 3F 01 2A E8 0A D9 67 50 F6 E6 A9 61 98 5F C2 B2 53 DC D0 D5 ... : .|..........?.*...gP...a._..S... ... using cached desync profile 1 packet: id=821 pass unmodified packet: id=822 len=1448 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594716726 ack_seq=449617136 TCP: 99 DC 98 40 9D 8B 33 F2 10 C8 FA E2 4F 5D 81 08 90 9C AB F8 D8 6E C1 49 5F ED 4B 9D CE 33 36 DA ... : ...@..3.....O].......n.I_.K..36. ... using cached desync profile 1 packet: id=822 pass unmodified packet: id=823 len=382 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=AP seq=2594718122 ack_seq=449617136 TCP: A4 7F 4F C0 EC AA 79 05 0A D3 2D 13 C9 D9 B3 E1 D1 A5 86 E7 B3 F9 81 06 C5 73 D0 58 00 4B 07 61 ... : .O...y...-..............s.X.K.a ... using cached desync profile 1 packet: id=823 pass unmodified packet: id=824 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=A seq=3918189705 ack_seq=2317734645 using cached desync profile 1 packet: id=824 pass unmodified packet: id=825 len=797 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=42526 flags=AP seq=3918189705 ack_seq=2317734645 TCP: 17 03 03 01 85 C8 07 09 A7 3E 59 F0 88 C1 FD 69 EB 91 8D BE 36 1D EC EE 8E 4A D3 1E 0A 8E 02 9B ... : .........>Y....i....6....J...... ... using cached desync profile 1 packet: id=825 pass unmodified packet: id=826 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=A seq=3673280420 ack_seq=3646778325 using cached desync profile 1 packet: id=826 pass unmodified packet: id=827 len=797 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=123 sport=443 dport=42538 flags=AP seq=3673280420 ack_seq=3646778325 TCP: 17 03 03 01 85 91 47 F4 CE 92 07 DE 96 7D 6B A7 C7 67 3B 99 52 EB 27 10 BF BF BC BC 55 9B 48 1B ... : ......G......}k..g;.R.'.....U.H. ... using cached desync profile 1 packet: id=827 pass unmodified packet: id=828 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=A seq=449617136 ack_seq=2594715330 using cached desync profile 1 packet: id=828 pass unmodified packet: id=829 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=A seq=449617136 ack_seq=2594716726 using cached desync profile 1 packet: id=829 pass unmodified packet: id=830 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=A seq=449617136 ack_seq=2594718122 using cached desync profile 1 packet: id=830 pass unmodified packet: id=831 len=52 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=A seq=449617136 ack_seq=2594718452 using cached desync profile 1 packet: id=831 pass unmodified packet: id=832 len=116 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=AP seq=449617136 ack_seq=2594718452 TCP: 14 03 03 00 01 01 17 03 03 00 35 9C 58 70 F5 FC 1E FF 6C 1A 2D 4D 03 E5 75 FA DC 7D D2 05 C0 20 ... : ..........5.Xp....l.-M..u..}... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=832 pass unmodified packet: id=833 len=681 mark=20000000 IP4: 192.168.1.8 => 74.125.153.151 proto=tcp ttl=63 sport=42540 dport=443 flags=AP seq=449617200 ack_seq=2594718452 TCP: 17 03 03 02 70 E1 69 E4 49 91 B0 8B D3 CA 55 97 77 F3 08 25 1A 46 6C C1 48 55 5D E9 E8 EE E8 D7 ... : ....p.i.I.....U.w..%.Fl.HU]..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=833 pass unmodified packet: id=834 len=64 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594718452 ack_seq=449617136 using cached desync profile 1 packet: id=834 pass unmodified packet: id=835 len=64 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594718452 ack_seq=449617136 using cached desync profile 1 packet: id=835 pass unmodified packet: id=836 len=64 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594718452 ack_seq=449617136 using cached desync profile 1 packet: id=836 pass unmodified packet: id=837 len=64 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594718452 ack_seq=449617200 using cached desync profile 1 packet: id=837 pass unmodified packet: id=838 len=52 mark=00000000 IP4: 74.125.153.151 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=42540 flags=A seq=2594718452 ack_seq=449621840 using cached desync profile 1 packet: id=838 pass unmodified packet: id=839 len=60 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=S seq=2291482078 ack_seq=0 desync profile search for tcp target=173.194.222.132:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=839 pass unmodified packet: id=840 len=60 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=SA seq=184032448 ack_seq=2291482079 using cached desync profile 2 incoming TTL 121 packet: id=840 pass unmodified packet: id=841 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=A seq=2291482079 ack_seq=184032449 using cached desync profile 2 packet: id=841 pass unmodified packet: id=842 len=1101 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=AP seq=2291482079 ack_seq=184032449 TCP: 16 03 01 04 14 01 00 04 10 03 03 DD 18 F4 DF 13 31 ED 67 7C F1 6F 71 AC 1E F9 24 28 0D 60 1A D9 ... : ................1.g|.oq...$(.`.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2291482079-2291483127 hostname: yt3.ggpht.com discovered l7 protocol discovered hostname desync profile search for tcp target=173.194.222.132:443 l7proto=tls hostname='yt3.ggpht.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for yt3.ggpht.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:46752 dst=173.194.222.132:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-1048 len=1048 : 03 01 04 14 01 00 04 10 03 03 DD 18 F4 DF 13 31 ED 67 7C F1 6F 71 AC 1E F9 24 28 0D 60 1A D9 36 ... : ...............1.g|.oq...$(.`..6 ... packet: id=842 drop packet: id=843 len=52 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=A seq=184032449 ack_seq=2291482080 using cached desync profile 1 packet: id=843 pass unmodified packet: id=844 len=52 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=A seq=184032449 ack_seq=2291483128 using cached desync profile 1 packet: id=844 pass unmodified packet: id=845 len=426 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184032449 ack_seq=2291483128 TCP: 16 03 03 00 80 02 00 00 7C 03 03 39 12 17 39 27 12 E7 51 72 E5 8F A8 33 03 12 B1 DF 49 66 D1 BE ... : ........|..9..9'..Qr...3....If.. ... using cached desync profile 1 packet: id=845 pass unmodified packet: id=846 len=52 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=A seq=2291483128 ack_seq=184032823 using cached desync profile 1 packet: id=846 pass unmodified packet: id=847 len=126 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=AP seq=2291483128 ack_seq=184032823 TCP: 14 03 03 00 01 01 17 03 03 00 3F 8D 61 64 F5 8C 1D 5A 88 7A 80 CC 8D F4 4C FB 9D 4A D4 D1 D7 4F ... : ..........?.ad...Z.z....L..J...O ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=847 pass unmodified packet: id=848 len=144 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=AP seq=2291483202 ack_seq=184032823 TCP: 17 03 03 00 57 AE 90 45 06 FD 93 68 F3 50 C3 35 DE EC AB BE DD 70 6D C3 C4 68 54 9C EF CF 3C 2B ... : ....W..E...h.P.5.....pm..hT...<+ ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=848 pass unmodified packet: id=849 len=280 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=AP seq=2291483294 ack_seq=184032823 TCP: 17 03 03 00 DF 34 34 34 2C 0C 66 91 C0 44 15 93 D3 D4 B6 DC 63 AD 4F 29 C9 52 1B A4 E5 78 69 D1 ... : .....444,.f..D......c.O).R...xi. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=849 pass unmodified packet: id=850 len=1006 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184032823 ack_seq=2291483202 TCP: 17 03 03 03 77 54 4D 10 16 4F 7E 8D A0 5B B9 98 26 08 0D E4 B0 89 DC B2 43 BF A4 E8 F3 6A E3 BD ... : ....wTM..O~..[..&.......C....j.. ... using cached desync profile 1 packet: id=850 pass unmodified packet: id=851 len=83 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184033777 ack_seq=2291483294 TCP: 17 03 03 00 1A 65 6F 94 D0 DA B9 E2 D3 F4 FB B2 9F 05 B6 95 02 FF DD 04 C4 75 F2 4B 29 36 E9 : .....eo..................u.K)6. using cached desync profile 1 packet: id=851 pass unmodified packet: id=852 len=83 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=AP seq=2291483522 ack_seq=184033777 TCP: 17 03 03 00 1A 6D 37 FF BE F1 93 5E 51 2E AE 48 A7 9E 8B 02 C0 20 0E D4 F2 0A BC 33 DD 40 A2 : .....m7....^Q..H..... .....3.@. using cached desync profile 1 not applying tampering to unknown protocol packet: id=852 pass unmodified packet: id=853 len=397 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184033808 ack_seq=2291483522 TCP: 17 03 03 01 54 39 97 2F F9 5B 72 3C 47 49 CB EA 95 96 D8 97 9B B4 93 99 AC 34 EC 3B 77 71 E0 68 ... : ....T9./.[r 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184034153 ack_seq=2291483522 TCP: 17 03 03 05 73 93 DB B2 F4 60 11 1D 93 9D AE D6 E8 EF C9 E8 40 10 19 B4 F9 18 41 24 1B 62 E3 E5 ... : ....s....`..........@.....A$.b.. ... using cached desync profile 1 packet: id=854 pass unmodified packet: id=855 len=1452 mark=00000000 IP4: 173.194.222.132 => 192.168.1.8 proto=tcp ttl=121 sport=443 dport=46752 flags=AP seq=184035553 ack_seq=2291483522 TCP: 17 03 03 05 73 AD CD CE DC 6D 3B 84 BD 12 6D 0F 4E A3 73 AD 47 16 95 D6 F7 14 1F 7C 58 D7 62 AB ... : ....s....m;...m.N.s.G......|X.b. ... using cached desync profile 1 packet: id=855 pass unmodified packet: id=856 len=64 mark=20000000 IP4: 192.168.1.8 => 173.194.222.132 proto=tcp ttl=63 sport=46752 dport=443 flags=A seq=2291483553 ack_seq=184033808 using cached desync profile 1 packet: id=856 pass unmodified packet: id=857 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.205.63 proto=tcp ttl=63 sport=59832 dport=443 flags=S seq=337246964 ack_seq=0 using cached desync profile 2 packet: id=857 pass unmodified packet: id=858 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=AP seq=1905777633 ack_seq=3326154043 TCP: 17 03 03 02 60 FD 9F 8E E3 E6 5B 9B 97 3C 22 29 2E B1 88 8A A5 6C 6D 3F B9 68 88 7E 4A 46 7F 81 ... : ....`.....[..<").....lm?.h.~JF. ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=858 pass unmodified packet: id=859 len=403 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38850 flags=AP seq=1558564254 ack_seq=1821735065 TCP: 17 03 03 01 5A 30 BC F9 1F 6F A8 4E 31 95 01 15 4E 47 FC 40 6A 9A B3 9E 92 6D C1 15 72 43 C2 AC ... : ....Z0...o.N1...NG.@j....m..rC.. ... using cached desync profile 1 packet: id=859 pass unmodified packet: id=860 len=403 mark=00000000 IP4: 212.188.37.45 => 192.168.1.8 proto=tcp ttl=120 sport=443 dport=38844 flags=AP seq=3326154043 ack_seq=1905778246 TCP: 17 03 03 01 5A C7 9D 5D 65 51 5C 71 A9 AD 63 44 53 84 E4 11 FA 4F D4 2C F7 CB 8C AB D5 5B 1F 9B ... : ....Z..]eQ\q..cDS....O.,.....[.. ... using cached desync profile 1 packet: id=860 pass unmodified packet: id=861 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.45 proto=tcp ttl=63 sport=38844 dport=443 flags=A seq=1905778246 ack_seq=3326154394 using cached desync profile 1 packet: id=861 pass unmodified packet: id=862 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=S seq=1380835508 ack_seq=0 desync profile search for tcp target=212.188.37.14:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=862 pass unmodified packet: id=863 len=60 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=SA seq=4018942754 ack_seq=1380835509 using cached desync profile 2 incoming TTL 122 packet: id=863 pass unmodified packet: id=864 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=A seq=1380835509 ack_seq=4018942755 using cached desync profile 2 packet: id=864 pass unmodified packet: id=865 len=852 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=AP seq=1380835509 ack_seq=4018942755 TCP: 16 03 01 03 1B 01 00 03 17 03 03 33 C2 F8 F5 87 BD 6B 23 05 A4 38 0E 43 1B 0E 9F A7 FE 81 4D F8 ... : ...........3.....k#..8.C......M. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1380835509-1380836308 hostname: rr3---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.14:443 l7proto=tls hostname='rr3---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:38334 dst=212.188.37.14:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-799 len=799 : 03 01 03 1B 01 00 03 17 03 03 33 C2 F8 F5 87 BD 6B 23 05 A4 38 0E 43 1B 0E 9F A7 FE 81 4D F8 D4 ... : ..........3.....k#..8.C......M.. ... packet: id=865 drop packet: id=866 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942755 ack_seq=1380835510 using cached desync profile 1 packet: id=866 pass unmodified packet: id=867 len=255 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=AP seq=4018942755 ack_seq=1380836309 TCP: 16 03 03 00 80 02 00 00 7C 03 03 05 7A FD 70 FF 89 58 F3 D8 BF B7 F6 C6 82 43 75 7A 1A 55 C8 08 ... : ........|...z.p..X.......Cuz.U.. ... using cached desync profile 1 packet: id=867 pass unmodified packet: id=868 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942755 ack_seq=1380836309 using cached desync profile 1 packet: id=868 pass unmodified packet: id=869 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=A seq=1380836309 ack_seq=4018942958 using cached desync profile 1 packet: id=869 pass unmodified packet: id=870 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=A seq=1380836309 ack_seq=4018942958 using cached desync profile 1 packet: id=870 pass unmodified packet: id=871 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=AP seq=1380836309 ack_seq=4018942958 TCP: 14 03 03 00 01 01 17 03 03 00 35 C5 30 B7 C8 D5 F2 37 51 A9 B9 C9 CF 7B 2D 21 C0 78 72 B6 D0 96 ... : ..........5.0....7Q....{-!.xr... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=871 pass unmodified packet: id=872 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942958 ack_seq=1380836373 using cached desync profile 1 packet: id=872 pass unmodified packet: id=873 len=71 mark=20000000 IP4: 192.168.1.8 => 34.110.236.123 proto=tcp ttl=127 sport=60233 dport=443 flags=AP seq=2802071346 ack_seq=914470507 TCP: 15 03 03 00 1A 00 00 00 00 00 00 00 02 41 61 FD E2 7E F9 06 E1 A1 A8 B0 0C BB CE 59 3D 69 1C : .............Aa..~.........Y=i. desync profile search for tcp target=34.110.236.123:443 l7proto=unknown hostname='' desync profile 2 matches not applying tampering to unknown protocol packet: id=873 pass unmodified packet: id=874 len=60 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=S seq=4150322851 ack_seq=0 desync profile search for tcp target=93.158.134.32:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=874 pass unmodified packet: id=875 len=60 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=SA seq=484149288 ack_seq=4150322852 using cached desync profile 2 incoming TTL 56 packet: id=875 pass unmodified packet: id=876 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150322852 ack_seq=484149289 using cached desync profile 2 packet: id=876 pass unmodified packet: id=877 len=569 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=AP seq=4150322852 ack_seq=484149289 TCP: 16 03 01 02 00 01 00 01 FC 03 03 9D 2B BD 55 60 54 6F E7 07 B1 D9 D6 34 3F FF 8F 94 72 D6 7E 36 ... : ............+.U`To.....4?...r.~6 ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 4150322852-4150323368 hostname: clck.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=93.158.134.32:443 l7proto=tls hostname='clck.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=877 pass unmodified packet: id=878 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484149289 ack_seq=4150323369 using cached desync profile 2 packet: id=878 pass unmodified packet: id=879 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484149289 ack_seq=4150323369 TCP: 16 03 03 00 6C 02 00 00 68 03 03 33 CD 09 89 A5 3B EE 16 A7 36 8A 77 67 A5 92 59 92 3E 55 8D D7 ... : ....l...h..3....;...6.wg..Y.>U.. ... using cached desync profile 2 packet: id=879 pass unmodified packet: id=880 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=AP seq=484150497 ack_seq=4150323369 TCP: 30 45 02 21 00 AD A8 97 1A E9 84 FD 2F A0 D5 2A C5 B3 F5 F1 5D 25 09 EF B2 72 DD 0A FC 03 21 FD ... : 0E.!......../..*....]%...r....!. ... using cached desync profile 2 packet: id=880 pass unmodified packet: id=881 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484151705 ack_seq=4150323369 TCP: F0 4B 7F A8 2E 45 24 AE 4D 50 FA 63 9A 8B DE E2 DD 1B BC 30 3E 06 08 2B 06 01 05 05 07 01 01 04 ... : .K..E$.MP.c.......0>..+........ ... using cached desync profile 2 packet: id=881 pass unmodified packet: id=882 len=755 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=AP seq=484152913 ack_seq=4150323369 TCP: A0 26 A0 24 86 22 68 74 74 70 3A 2F 2F 63 72 6C 2E 67 6C 6F 62 61 6C 73 69 67 6E 2E 63 6F 6D 2F ... : .&.$."http://crl.globalsign.com/ ... using cached desync profile 2 packet: id=882 pass unmodified packet: id=883 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150323369 ack_seq=484150497 using cached desync profile 2 packet: id=883 pass unmodified packet: id=884 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150323369 ack_seq=484151705 using cached desync profile 2 packet: id=884 pass unmodified packet: id=885 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150323369 ack_seq=484152913 using cached desync profile 2 packet: id=885 pass unmodified packet: id=886 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150323369 ack_seq=484153616 using cached desync profile 2 packet: id=886 pass unmodified packet: id=887 len=145 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=AP seq=4150323369 ack_seq=484153616 TCP: 16 03 03 00 25 10 00 00 21 20 56 8B 7F 12 61 EE 83 5C 0C D9 CB A4 B0 2F 31 70 C4 91 FD 35 AD 13 ... : ....%...! V..a..\...../1p...5.. ... using cached desync profile 2 req retrans : tcp seq 4150323369 not within the req range 4150322852-4150323368. stop tracking. not applying tampering to unknown protocol packet: id=887 pass unmodified packet: id=888 len=103 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=AP seq=484153616 ack_seq=4150323462 TCP: 14 03 03 00 01 01 16 03 03 00 28 F8 3F 2D 87 AA 1D DB 10 32 BA F7 AE A6 10 53 F6 5B 55 33 76 FC ... : ..........(.?-.....2.....S.[U3v. ... using cached desync profile 2 packet: id=888 pass unmodified packet: id=889 len=1450 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34744 dport=443 flags=A seq=4150323462 ack_seq=484153667 TCP: 17 03 03 0D D8 E1 D9 F8 5C F3 FE 22 B2 3B C1 18 E2 B2 63 76 E7 44 E6 58 59 99 50 80 D7 54 9D 01 ... : ........\..".;....cv.D.XY.P..T.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=889 pass unmodified packet: id=890 len=64 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484153667 ack_seq=4150323462 using cached desync profile 2 packet: id=890 pass unmodified packet: id=891 len=64 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484153667 ack_seq=4150323462 using cached desync profile 2 packet: id=891 pass unmodified packet: id=892 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=A seq=484153667 ack_seq=4150327011 using cached desync profile 2 packet: id=892 pass unmodified packet: id=893 len=184 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34744 flags=AP seq=484153667 ack_seq=4150327011 TCP: 17 03 03 00 5E F8 3F 2D 87 AA 1D DB 11 83 9D 1E C1 81 B2 06 D6 33 EC 70 7C 42 A3 FD 04 33 D4 11 ... : ....^.?-.............3.p|B...3.. ... using cached desync profile 2 packet: id=893 pass unmodified packet: id=894 len=60 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=S seq=2500932665 ack_seq=0 desync profile search for tcp target=93.158.134.32:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=894 pass unmodified packet: id=895 len=60 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=SA seq=3789738087 ack_seq=2500932666 using cached desync profile 2 incoming TTL 56 packet: id=895 pass unmodified packet: id=896 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=A seq=2500932666 ack_seq=3789738088 using cached desync profile 2 packet: id=896 pass unmodified packet: id=897 len=358 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=AP seq=2500932666 ack_seq=3789738088 TCP: 16 03 01 01 2D 01 00 01 29 03 03 67 0F F6 34 87 AB 03 8C E2 FE D1 7B 6F 2C 19 0D 6A E6 13 59 7E ... : ....-...)..g..4.......{o,..j..Y~ ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2500932666-2500932971 hostname: clck.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=93.158.134.32:443 l7proto=tls hostname='clck.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=897 pass unmodified packet: id=898 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789738088 ack_seq=2500932972 using cached desync profile 2 packet: id=898 pass unmodified packet: id=899 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789738088 ack_seq=2500932972 TCP: 16 03 03 00 41 02 00 00 3D 03 03 2F E3 E1 D4 FB F6 A8 1F 14 25 2E E4 40 21 45 39 8A 09 60 02 C5 ... : ....A...=../........%..@!E9..`.. ... using cached desync profile 2 packet: id=899 pass unmodified packet: id=900 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=AP seq=3789739296 ack_seq=2500932972 TCP: 31 77 1B 2A 0D 0A B4 A7 88 31 F8 A0 A0 CE E9 02 4C 54 2F D1 BD BB 58 2B 89 41 4B 2E 00 76 00 13 ... : 1w.*.....1......LT/...X+.AK..v.. ... using cached desync profile 2 packet: id=900 pass unmodified packet: id=901 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789740504 ack_seq=2500932972 TCP: 05 07 30 01 86 22 68 74 74 70 3A 2F 2F 6F 63 73 70 32 2E 67 6C 6F 62 61 6C 73 69 67 6E 2E 63 6F ... : ..0.."http://ocsp2.globalsign.co ... using cached desync profile 2 packet: id=901 pass unmodified packet: id=902 len=712 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=AP seq=3789741712 ack_seq=2500932972 TCP: 03 55 1D 20 04 40 30 3E 30 3C 06 04 55 1D 20 00 30 34 30 32 06 08 2B 06 01 05 05 07 02 01 16 26 ... : .U. .@0>0<..U. .0402..+........& ... using cached desync profile 2 packet: id=902 pass unmodified packet: id=903 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=A seq=2500932972 ack_seq=3789739296 using cached desync profile 2 packet: id=903 pass unmodified packet: id=904 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=A seq=2500932972 ack_seq=3789740504 using cached desync profile 2 packet: id=904 pass unmodified packet: id=905 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=A seq=2500932972 ack_seq=3789741712 using cached desync profile 2 packet: id=905 pass unmodified packet: id=906 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=A seq=2500932972 ack_seq=3789742372 using cached desync profile 2 packet: id=906 pass unmodified packet: id=907 len=94 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=AP seq=2500932972 ack_seq=3789742372 TCP: 16 03 03 00 25 10 00 00 21 20 6D 6B B4 D2 C9 55 7E 06 E2 EC B5 0D 91 83 EF 86 1A FB 8E 63 73 47 ... : ....%...! mk...U~............csG ... using cached desync profile 2 req retrans : tcp seq 2500932972 not within the req range 2500932666-2500932971. stop tracking. not applying tampering to unknown protocol packet: id=907 pass unmodified packet: id=908 len=103 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=34746 dport=443 flags=AP seq=2500933014 ack_seq=3789742372 TCP: 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 BE 8B 08 01 94 97 25 4C 16 B4 D6 8E 2A ... : ..........(..............%L....* ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=908 pass unmodified packet: id=909 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789742372 ack_seq=2500933065 using cached desync profile 2 packet: id=909 pass unmodified packet: id=910 len=278 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=AP seq=3789742372 ack_seq=2500933065 TCP: 16 03 03 00 AA 04 00 00 A6 00 01 89 C0 00 A0 66 2D 1E 7D F3 D0 21 7A 4D A2 4A DD 84 E0 4B DF DC ... : ...............f-.}..!zM.J...K.. ... using cached desync profile 2 packet: id=910 pass unmodified packet: id=911 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789742598 ack_seq=2500935923 using cached desync profile 2 packet: id=911 pass unmodified packet: id=912 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789742598 ack_seq=2500935923 TCP: 17 03 03 00 61 4B 60 3A 18 6F 15 E9 F7 39 97 F3 82 04 C9 3F A2 BA 1B 1B 75 BE 90 6D 7B 3A 37 AD ... : ....aK`:.o...9.....?....u..m{:7. ... using cached desync profile 2 packet: id=912 pass unmodified packet: id=913 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=AP seq=3789743806 ack_seq=2500935923 TCP: C5 0F 42 0B DF 11 F6 05 01 4C E0 42 93 6E 9C 1E AA 05 B3 0D B8 0F AD 0A 76 02 3B 72 2D FA 73 9F ... : ..B......L.B.n..........v.;r-.s. ... using cached desync profile 2 packet: id=913 pass unmodified packet: id=914 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=A seq=3789745014 ack_seq=2500935923 TCP: 00 03 CB 5C B4 CB 82 94 75 91 C8 B1 74 8D 49 8F 5C 22 52 5E E8 FA EE 2C 74 43 3E FB F9 FB B4 D0 ... : ...\....u...t.I.\"R^...,tC>..... ... using cached desync profile 2 packet: id=914 pass unmodified packet: id=915 len=621 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=34746 flags=AP seq=3789746222 ack_seq=2500935923 TCP: B4 0F BC 10 4A 0A 94 5E 00 EA 6E FA 68 8A 4B 72 5D 7B 0F 40 53 7C 13 F5 C2 0F 8E 93 1D 46 82 3A ... : ....J..^..n.h.Kr]{.@S|.......F.: ... using cached desync profile 2 packet: id=915 pass unmodified packet: id=916 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=S seq=635542144 ack_seq=0 desync profile search for tcp target=212.188.37.14:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=916 pass unmodified packet: id=917 len=60 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=S seq=1028500294 ack_seq=0 desync profile search for tcp target=212.188.37.14:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=917 pass unmodified packet: id=918 len=685 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=AP seq=1380836373 ack_seq=4018942958 TCP: 17 03 03 02 74 B9 1D 95 12 D8 1B 7C 85 56 AB D0 E0 73 93 25 44 E5 22 CE 5E 94 D3 BD 27 E7 F6 EB ... : ....t......|.V...s.%D.".^...'... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=918 pass unmodified packet: id=919 len=1452 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=A seq=1380837006 ack_seq=4018942958 TCP: 17 03 03 0F 9D CD 48 69 0E 86 DD CA 59 F8 28 F6 EC 30 1F AF C8 7C DA 54 52 99 29 54 E1 DB BD BF ... : ......Hi....Y.(..0...|.TR.)T.... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=919 pass unmodified packet: id=920 len=1452 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=AP seq=1380838406 ack_seq=4018942958 TCP: DC CF 9F 3E 02 04 55 EA 86 D0 C1 43 DA 76 84 7C 84 6D 36 2B 9E B3 64 58 22 9A 30 DE 96 BA 5E 66 ... : ...>..U....C.v.|.m6+..dX".0...^f ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=920 pass unmodified packet: id=921 len=1254 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=38334 dport=443 flags=AP seq=1380839806 ack_seq=4018942958 TCP: 02 9D 20 4A 86 66 45 40 24 B2 93 AB 05 36 62 47 0B 25 53 49 AA 8C 53 89 C0 FE 67 6F F0 29 D8 72 ... : .. J.fE@$....6bG.%SI..S...go.).r ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=921 pass unmodified packet: id=922 len=60 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=SA seq=1820478611 ack_seq=635542145 using cached desync profile 2 incoming TTL 122 packet: id=922 pass unmodified packet: id=923 len=60 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=SA seq=2265672265 ack_seq=1028500295 using cached desync profile 2 incoming TTL 122 packet: id=923 pass unmodified packet: id=924 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942958 ack_seq=1380837006 using cached desync profile 1 packet: id=924 pass unmodified packet: id=925 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942958 ack_seq=1380838406 using cached desync profile 1 packet: id=925 pass unmodified packet: id=926 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942958 ack_seq=1380839806 using cached desync profile 1 packet: id=926 pass unmodified packet: id=927 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=A seq=635542145 ack_seq=1820478612 using cached desync profile 2 packet: id=927 pass unmodified packet: id=928 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=38334 flags=A seq=4018942958 ack_seq=1380841008 using cached desync profile 1 packet: id=928 pass unmodified packet: id=929 len=884 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=AP seq=635542145 ack_seq=1820478612 TCP: 16 03 01 03 3B 01 00 03 37 03 03 69 B7 A0 0C 6F 1E 0A 10 7A 3E FB 8E F3 04 5A EA 11 94 A5 07 A2 ... : ....;...7..i...o...z>....Z...... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 635542145-635542976 hostname: rr3---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.14:443 l7proto=tls hostname='rr3---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:45018 dst=212.188.37.14:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-831 len=831 : 03 01 03 3B 01 00 03 37 03 03 69 B7 A0 0C 6F 1E 0A 10 7A 3E FB 8E F3 04 5A EA 11 94 A5 07 A2 CA ... : ...;...7..i...o...z>....Z....... ... packet: id=929 drop packet: id=930 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=A seq=1028500295 ack_seq=2265672266 using cached desync profile 2 packet: id=930 pass unmodified packet: id=931 len=641 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=AP seq=1028500295 ack_seq=2265672266 TCP: 16 03 01 02 48 01 00 02 44 03 03 74 DA AF 7E 09 A2 7B E2 C3 26 6D C9 57 0B C9 05 5A C1 A8 2D B3 ... : ....H...D..t..~..{..&m.W...Z..-. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1028500295-1028500883 hostname: rr3---sn-jvhnu5g-c35d.googlevideo.com discovered l7 protocol discovered hostname desync profile search for tcp target=212.188.37.14:443 l7proto=tls hostname='rr3---sn-jvhnu5g-c35d.googlevideo.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for rr3---sn-jvhnu5g-c35d.googlevideo.com : negative Hostlist check for googlevideo.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:45032 dst=212.188.37.14:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-588 len=588 : 03 01 02 48 01 00 02 44 03 03 74 DA AF 7E 09 A2 7B E2 C3 26 6D C9 57 0B C9 05 5A C1 A8 2D B3 E2 ... : ...H...D..t..~..{..&m.W...Z..-.. ... packet: id=931 drop packet: id=932 len=255 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=AP seq=1820478612 ack_seq=635542977 TCP: 16 03 03 00 80 02 00 00 7C 03 03 13 A2 AB D4 C0 B7 27 B9 05 CE 7A 1B 8F 35 54 18 7A 9E 4B F2 A9 ... : ........|........'...z..5T.z.K.. ... using cached desync profile 1 packet: id=932 pass unmodified packet: id=933 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=A seq=1820478612 ack_seq=635542146 using cached desync profile 1 packet: id=933 pass unmodified packet: id=934 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=A seq=1820478612 ack_seq=635542977 using cached desync profile 1 packet: id=934 pass unmodified packet: id=935 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265672266 ack_seq=1028500296 using cached desync profile 1 packet: id=935 pass unmodified packet: id=936 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265672266 ack_seq=1028500884 using cached desync profile 1 packet: id=936 pass unmodified packet: id=937 len=1452 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265672266 ack_seq=1028500884 TCP: 16 03 03 00 7A 02 00 00 76 03 03 DB E5 1C 4D 76 71 CE C6 47 FC 59 58 17 C3 CB 98 9C 5D D5 CA 9F ... : ....z...v.....Mvq..G.YX.....]... ... using cached desync profile 1 packet: id=937 pass unmodified packet: id=938 len=1452 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265673666 ack_seq=1028500884 TCP: 87 7E 0D AC 33 A4 9E F1 03 1B 45 C4 F8 FA 55 3B 8E 1B 7D 46 03 58 60 CF 9A 13 1B 86 FC 1B 97 6D ... : .~..3.....E...U;..}F.X`........m ... using cached desync profile 1 packet: id=938 pass unmodified packet: id=939 len=1452 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265675066 ack_seq=1028500884 TCP: 70 33 E4 8F 60 EA CD 61 0E 53 2F B9 D6 C1 0C EF 85 E3 94 78 01 B8 27 6C 93 21 3C 36 58 B6 0F FE ... : p3..`..a.S/........x..'l.!<6X... ... using cached desync profile 1 packet: id=939 pass unmodified packet: id=940 len=369 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=AP seq=2265676466 ack_seq=1028500884 TCP: 09 3C F2 ED 51 4E 9B 5C A8 20 55 AF F2 C5 2E B8 28 DF E3 DC 95 52 E2 13 BB AA 66 3B E1 A7 5C 36 ... : .<..QN.\. U.....(....R....f;..\6 ... using cached desync profile 1 packet: id=940 pass unmodified packet: id=941 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=A seq=635542977 ack_seq=1820478815 using cached desync profile 1 packet: id=941 pass unmodified packet: id=942 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=AP seq=635542977 ack_seq=1820478815 TCP: 14 03 03 00 01 01 17 03 03 00 35 BE 6C B8 66 DC C3 4E 58 06 C8 84 F3 E4 17 FE 01 1A 8A 26 D8 4D ... : ..........5.l.f..NX..........&.M ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=942 pass unmodified packet: id=943 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=A seq=635543041 ack_seq=1820478815 using cached desync profile 1 packet: id=943 pass unmodified packet: id=944 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=AP seq=635543041 ack_seq=1820478815 TCP: 17 03 03 02 60 4F AB 05 2B 08 4C 23 34 A2 91 8C 5C D2 8D BD E4 AE EC 28 35 47 30 01 E4 28 58 56 ... : ....`O..+.L#4...\......(5G0..(XV ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=944 pass unmodified packet: id=945 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=A seq=1028500884 ack_seq=2265673666 using cached desync profile 1 packet: id=945 pass unmodified packet: id=946 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=A seq=1028500884 ack_seq=2265675066 using cached desync profile 1 packet: id=946 pass unmodified packet: id=947 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=A seq=1028500884 ack_seq=2265676466 using cached desync profile 1 packet: id=947 pass unmodified packet: id=948 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=A seq=1028500884 ack_seq=2265676783 using cached desync profile 1 packet: id=948 pass unmodified packet: id=949 len=116 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=AP seq=1028500884 ack_seq=2265676783 TCP: 14 03 03 00 01 01 17 03 03 00 35 15 3E BC 26 2F 1E F5 CC CE 6A 4D 79 24 FE F8 2A D3 BC AA 0E 3A ... : ..........5.>.&/....jMy$..*....: ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=949 pass unmodified packet: id=950 len=665 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45032 dport=443 flags=AP seq=1028500948 ack_seq=2265676783 TCP: 17 03 03 02 60 9B 3B 1C 91 12 CF 91 AE 1A 95 82 83 93 45 22 C3 76 4B E1 73 70 C1 6E 8F C8 98 43 ... : ....`.;...........E".vK.sp.n...C ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=950 pass unmodified packet: id=951 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=A seq=1820478815 ack_seq=635543654 using cached desync profile 1 packet: id=951 pass unmodified packet: id=952 len=797 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45018 flags=AP seq=1820478815 ack_seq=635543654 TCP: 17 03 03 01 85 02 FF D6 BE 4E 11 BA F8 7F F1 FC 50 1B 80 88 7A 29 77 51 27 F6 1E 57 6F BE 31 74 ... : .........N.....P...z)wQ'..Wo.1t ... using cached desync profile 1 packet: id=952 pass unmodified packet: id=953 len=52 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=A seq=2265676783 ack_seq=1028501561 using cached desync profile 1 packet: id=953 pass unmodified packet: id=954 len=797 mark=00000000 IP4: 212.188.37.14 => 192.168.1.8 proto=tcp ttl=122 sport=443 dport=45032 flags=AP seq=2265676783 ack_seq=1028501561 TCP: 17 03 03 01 85 D7 BD 54 42 31 96 59 B1 D9 62 77 5F EF 66 E4 3C 8F 0E A6 6B 95 08 D1 C7 64 E0 AE ... : .......TB1.Y..bw_.f.<...k....d.. ... using cached desync profile 1 packet: id=954 pass unmodified packet: id=955 len=52 mark=20000000 IP4: 192.168.1.8 => 212.188.37.14 proto=tcp ttl=63 sport=45018 dport=443 flags=A seq=635543654 ack_seq=1820479560 using cached desync profile 1 packet: id=955 pass unmodified packet: id=956 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=S seq=1340078948 ack_seq=0 desync profile search for tcp target=157.240.253.63:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=956 pass unmodified packet: id=957 len=60 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=SA seq=1246420629 ack_seq=1340078949 using cached desync profile 2 incoming TTL 53 packet: id=957 pass unmodified packet: id=958 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=A seq=1340078949 ack_seq=1246420630 using cached desync profile 2 packet: id=958 pass unmodified packet: id=959 len=445 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340078949 ack_seq=1246420630 TCP: 16 03 03 01 84 01 00 01 80 03 03 21 59 97 7C A7 32 BD DC D4 CB 11 E8 22 BB B3 3A 83 70 2D F0 C4 ... : ...........!Y.|.2......"..:.p-.. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 1340078949-1340079341 hostname: scontent-fra5-2.cdninstagram.com discovered l7 protocol discovered hostname desync profile search for tcp target=157.240.253.63:443 l7proto=tls hostname='scontent-fra5-2.cdninstagram.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for scontent-fra5-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for scontent-fra5-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for scontent-fra5-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : positive dpi desync src=192.168.1.8:59834 dst=157.240.253.63:443 split pos 1 sending fake request : 16 03 01 02 83 01 00 02 7F 03 03 3A 4D CE 86 07 E3 3A 0F 60 78 9F F0 57 BE 39 8A 11 EF 72 B7 6E ... : ..........:M....:.`x..W.9...r.n ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-392 len=392 : 03 03 01 84 01 00 01 80 03 03 21 59 97 7C A7 32 BD DC D4 CB 11 E8 22 BB B3 3A 83 70 2D F0 C4 DE ... : ..........!Y.|.2......"..:.p-... ... packet: id=959 drop packet: id=960 len=52 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=A seq=1246420630 ack_seq=1340078950 using cached desync profile 2 packet: id=960 pass unmodified packet: id=961 len=52 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=A seq=1246420630 ack_seq=1340079342 using cached desync profile 2 packet: id=961 pass unmodified packet: id=962 len=264 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=AP seq=1246420630 ack_seq=1340079342 TCP: 16 03 03 00 80 02 00 00 7C 03 03 ED 5D 19 F0 37 62 0B E9 E6 89 AF 10 BF 40 1D FF 94 20 0D 1D 3C ... : ........|...]..7b.......@... ..< ... using cached desync profile 2 packet: id=962 pass unmodified packet: id=963 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=A seq=1340079342 ack_seq=1246420842 using cached desync profile 2 packet: id=963 pass unmodified packet: id=964 len=58 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340079342 ack_seq=1246420842 TCP: 14 03 03 00 01 01 : ...... using cached desync profile 2 not applying tampering to unknown protocol packet: id=964 pass unmodified packet: id=965 len=110 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340079348 ack_seq=1246420842 TCP: 17 03 03 00 35 AD 89 1B E6 B3 8F 95 94 53 DE 2D F0 37 E4 BF 77 9A 7B 27 58 6C 39 3D 84 BA 68 C5 ... : ....5........S.-.7..w.{'Xl9=..h. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=965 pass unmodified packet: id=966 len=98 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340079406 ack_seq=1246420842 TCP: 17 03 03 00 29 4F 7F 7D B0 43 05 08 9F F5 94 C1 77 BD 1D 17 C0 0E F1 24 52 E2 FF D3 18 9D AD 81 ... : ....)O}.C......w......$R....... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=966 pass unmodified packet: id=967 len=95 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340079452 ack_seq=1246420842 TCP: 17 03 03 00 26 CA C1 57 BB 09 BC 1D FB 32 6F B3 F0 EE 86 F5 9B B0 9A F0 78 AC 1F 3D FF 8C AD 88 ... : ....&..W.....2o.........x..=.... ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=967 pass unmodified packet: id=968 len=87 mark=20000000 IP4: 192.168.1.8 => 157.240.253.63 proto=tcp ttl=63 sport=59834 dport=443 flags=AP seq=1340079495 ack_seq=1246420842 TCP: 17 03 03 00 1E 8B 44 22 E0 D2 F8 E3 F3 E9 D0 8F 98 98 CA B9 23 E8 18 6A 8D F9 E5 28 D3 D5 25 46 ... : ......D"............#..j...(..%F ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=968 pass unmodified packet: id=969 len=52 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=A seq=1246420842 ack_seq=1340079406 using cached desync profile 2 packet: id=969 pass unmodified packet: id=970 len=224 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=AP seq=1246420842 ack_seq=1340079406 TCP: 17 03 03 00 A7 8B 3A E2 1F EB 4E 55 23 48 B0 AF DB EA 1F FF 1A EE EC 77 48 47 CB 0B 78 96 B6 46 ... : ......:...NU#H.........wHG..x..F ... using cached desync profile 2 packet: id=970 pass unmodified packet: id=971 len=126 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=AP seq=1246421014 ack_seq=1340079406 TCP: 17 03 03 00 45 C1 D7 01 C0 98 1C B2 92 F1 AF AD ED AE 75 EC 5E 98 67 F6 B2 D9 B1 47 7E 32 8C EF ... : ....E.............u.^.g....G~2.. ... using cached desync profile 2 packet: id=971 pass unmodified packet: id=972 len=52 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=A seq=1246421088 ack_seq=1340079495 using cached desync profile 2 packet: id=972 pass unmodified packet: id=973 len=83 mark=00000000 IP4: 157.240.253.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59834 flags=AP seq=1246421088 ack_seq=1340079495 TCP: 17 03 03 00 1A DB CF 3D 74 B4 E4 87 AB 46 A1 4A 9F BD AD 81 3C CA 4D DC D1 26 C4 12 5B 34 D4 : .......=t....F.J....<.M..&..[4. using cached desync profile 2 packet: id=973 pass unmodified packet: id=974 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35526 dport=80 flags=S seq=2548661508 ack_seq=0 desync profile search for tcp target=216.58.210.164:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=974 pass unmodified packet: id=975 len=60 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=121 sport=80 dport=35526 flags=SA seq=1393581517 ack_seq=2548661509 using cached desync profile 2 incoming TTL 121 packet: id=975 pass unmodified packet: id=976 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35526 dport=80 flags=A seq=2548661509 ack_seq=1393581518 using cached desync profile 2 packet: id=976 pass unmodified packet: id=977 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35526 dport=80 flags=AF seq=2548661509 ack_seq=1393581518 using cached desync profile 2 packet: id=977 pass unmodified packet: id=978 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=121 sport=80 dport=35526 flags=A seq=1393581518 ack_seq=2548661510 using cached desync profile 2 packet: id=978 pass unmodified packet: id=979 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=121 sport=80 dport=35526 flags=AF seq=1393581518 ack_seq=2548661510 using cached desync profile 2 packet: id=979 pass unmodified packet: id=980 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35526 dport=80 flags=A seq=2548661510 ack_seq=1393581519 using cached desync profile 2 packet: id=980 pass unmodified packet: id=981 len=60 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35528 dport=80 flags=S seq=1940160009 ack_seq=0 desync profile search for tcp target=216.58.210.164:80 l7proto=unknown hostname='' desync profile 2 matches packet: id=981 pass unmodified packet: id=982 len=60 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=121 sport=80 dport=35528 flags=SA seq=1093938579 ack_seq=1940160010 using cached desync profile 2 incoming TTL 121 packet: id=982 pass unmodified packet: id=983 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35528 dport=80 flags=A seq=1940160010 ack_seq=1093938580 using cached desync profile 2 packet: id=983 pass unmodified packet: id=984 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35528 dport=80 flags=AF seq=1940160010 ack_seq=1093938580 using cached desync profile 2 packet: id=984 pass unmodified packet: id=985 len=52 mark=00000000 IP4: 216.58.210.164 => 192.168.1.8 proto=tcp ttl=121 sport=80 dport=35528 flags=AF seq=1093938580 ack_seq=1940160011 using cached desync profile 2 packet: id=985 pass unmodified packet: id=986 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.164 proto=tcp ttl=63 sport=35528 dport=80 flags=A seq=1940160011 ack_seq=1093938581 using cached desync profile 2 packet: id=986 pass unmodified packet: id=987 len=60 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=S seq=2544836626 ack_seq=0 desync profile search for tcp target=93.158.134.32:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=987 pass unmodified packet: id=988 len=60 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=SA seq=3836356571 ack_seq=2544836627 using cached desync profile 2 incoming TTL 56 packet: id=988 pass unmodified packet: id=989 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=A seq=2544836627 ack_seq=3836356572 using cached desync profile 2 packet: id=989 pass unmodified packet: id=990 len=358 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=AP seq=2544836627 ack_seq=3836356572 TCP: 16 03 01 01 2D 01 00 01 29 03 03 67 0F F6 3C 29 02 56 78 F4 77 96 A3 79 FC 9A 9E 2E 42 98 5B 67 ... : ....-...)..g..<).Vx.w..y....B.[g ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 2544836627-2544836932 hostname: clck.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=93.158.134.32:443 l7proto=tls hostname='clck.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for clck.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=990 pass unmodified packet: id=991 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836356572 ack_seq=2544836933 using cached desync profile 2 packet: id=991 pass unmodified packet: id=992 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836356572 ack_seq=2544836933 TCP: 16 03 03 00 41 02 00 00 3D 03 03 2E 17 89 61 49 0B 8B 5B 35 81 48 C2 08 53 03 F0 5C 78 B4 49 57 ... : ....A...=.....aI..[5.H..S..\x.IW ... using cached desync profile 2 packet: id=992 pass unmodified packet: id=993 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=AP seq=3836357780 ack_seq=2544836933 TCP: 31 77 1B 2A 0D 0A B4 A7 88 31 F8 A0 A0 CE E9 02 4C 54 2F D1 BD BB 58 2B 89 41 4B 2E 00 76 00 13 ... : 1w.*.....1......LT/...X+.AK..v.. ... using cached desync profile 2 packet: id=993 pass unmodified packet: id=994 len=1260 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836358988 ack_seq=2544836933 TCP: 05 07 30 01 86 22 68 74 74 70 3A 2F 2F 6F 63 73 70 32 2E 67 6C 6F 62 61 6C 73 69 67 6E 2E 63 6F ... : ..0.."http://ocsp2.globalsign.co ... using cached desync profile 2 packet: id=994 pass unmodified packet: id=995 len=712 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=AP seq=3836360196 ack_seq=2544836933 TCP: 03 55 1D 20 04 40 30 3E 30 3C 06 04 55 1D 20 00 30 34 30 32 06 08 2B 06 01 05 05 07 02 01 16 26 ... : .U. .@0>0<..U. .0402..+........& ... using cached desync profile 2 packet: id=995 pass unmodified packet: id=996 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=A seq=2544836933 ack_seq=3836357780 using cached desync profile 2 packet: id=996 pass unmodified packet: id=997 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=A seq=2544836933 ack_seq=3836358988 using cached desync profile 2 packet: id=997 pass unmodified packet: id=998 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=A seq=2544836933 ack_seq=3836360196 using cached desync profile 2 packet: id=998 pass unmodified packet: id=999 len=52 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=A seq=2544836933 ack_seq=3836360856 using cached desync profile 2 packet: id=999 pass unmodified packet: id=1000 len=94 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=AP seq=2544836933 ack_seq=3836360856 TCP: 16 03 03 00 25 10 00 00 21 20 09 69 D5 85 8B FA 16 2C 68 24 AA 9B A2 55 52 D8 E6 CD 18 03 B2 C1 ... : ....%...! .i.....,h$...UR....... ... using cached desync profile 2 req retrans : tcp seq 2544836933 not within the req range 2544836627-2544836932. stop tracking. not applying tampering to unknown protocol packet: id=1000 pass unmodified packet: id=1001 len=58 mark=20000000 IP4: 192.168.1.8 => 93.158.134.32 proto=tcp ttl=63 sport=59072 dport=443 flags=AP seq=2544836975 ack_seq=3836360856 TCP: 14 03 03 00 01 01 : ...... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1001 pass unmodified packet: id=1002 len=64 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836360856 ack_seq=2544836933 using cached desync profile 2 packet: id=1002 pass unmodified packet: id=1003 len=64 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836360856 ack_seq=2544836975 using cached desync profile 2 packet: id=1003 pass unmodified packet: id=1004 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836360856 ack_seq=2544837026 using cached desync profile 2 packet: id=1004 pass unmodified packet: id=1005 len=278 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=AP seq=3836360856 ack_seq=2544837026 TCP: 16 03 03 00 AA 04 00 00 A6 00 01 89 C0 00 A0 66 2D 1E 7D F3 D0 21 7A 4D A2 4A DD 84 E0 4B DF 95 ... : ...............f-.}..!zM.J...K.. ... using cached desync profile 2 packet: id=1005 pass unmodified packet: id=1006 len=52 mark=00000000 IP4: 93.158.134.32 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=59072 flags=A seq=3836361082 ack_seq=2544837532 using cached desync profile 2 packet: id=1006 pass unmodified packet: id=1007 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=S seq=4091425509 ack_seq=0 desync profile search for tcp target=157.240.0.63:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1007 pass unmodified packet: id=1008 len=64 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=S seq=550386358 ack_seq=0 desync profile search for tcp target=157.240.251.63:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1008 pass unmodified packet: id=1009 len=60 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=SA seq=984530820 ack_seq=4091425510 using cached desync profile 2 incoming TTL 53 packet: id=1009 pass unmodified packet: id=1010 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=A seq=4091425510 ack_seq=984530821 using cached desync profile 2 packet: id=1010 pass unmodified packet: id=1011 len=445 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091425510 ack_seq=984530821 TCP: 16 03 03 01 84 01 00 01 80 03 03 C5 87 8F 5C 21 D3 D7 EF D1 2E B6 71 60 81 41 B1 71 FD E7 58 80 ... : ..............\!......q`.A.q..X. ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 4091425510-4091425902 hostname: scontent-fra3-2.cdninstagram.com discovered l7 protocol discovered hostname desync profile search for tcp target=157.240.0.63:443 l7proto=tls hostname='scontent-fra3-2.cdninstagram.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for scontent-fra3-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for scontent-fra3-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for scontent-fra3-2.cdninstagram.com : negative Hostlist check for cdninstagram.com : positive dpi desync src=192.168.1.8:59835 dst=157.240.0.63:443 split pos 1 sending fake request : 16 03 01 02 83 01 00 02 7F 03 03 3A 4D CE 86 07 E3 3A 0F 60 78 9F F0 57 BE 39 8A 11 EF 72 B7 6E ... : ..........:M....:.`x..W.9...r.n ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-392 len=392 : 03 03 01 84 01 00 01 80 03 03 C5 87 8F 5C 21 D3 D7 EF D1 2E B6 71 60 81 41 B1 71 FD E7 58 80 6A ... : .............\!......q`.A.q..X.j ... packet: id=1011 drop packet: id=1012 len=60 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=SA seq=1544951068 ack_seq=550386359 using cached desync profile 2 incoming TTL 53 packet: id=1012 pass unmodified packet: id=1013 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=A seq=550386359 ack_seq=1544951069 using cached desync profile 2 packet: id=1013 pass unmodified packet: id=1014 len=445 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386359 ack_seq=1544951069 TCP: 16 03 03 01 84 01 00 01 80 03 03 13 85 AE 76 68 03 70 68 FC AD B9 D6 10 73 E7 75 5E E2 23 B7 50 ... : ..............vh.ph.....s.u^.#.P ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 550386359-550386751 hostname: scontent-fra5-1.cdninstagram.com discovered l7 protocol discovered hostname desync profile search for tcp target=157.240.251.63:443 l7proto=tls hostname='scontent-fra5-1.cdninstagram.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : negative Hostlist check for com : negative Checking include hostlist Hostlist check for scontent-fra5-1.cdninstagram.com : negative Hostlist check for cdninstagram.com : positive dpi desync src=192.168.1.8:59836 dst=157.240.251.63:443 split pos 1 sending fake request : 16 03 01 02 83 01 00 02 7F 03 03 3A 4D CE 86 07 E3 3A 0F 60 78 9F F0 57 BE 39 8A 11 EF 72 B7 6E ... : ..........:M....:.`x..W.9...r.n ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-392 len=392 : 03 03 01 84 01 00 01 80 03 03 13 85 AE 76 68 03 70 68 FC AD B9 D6 10 73 E7 75 5E E2 23 B7 50 DD ... : .............vh.ph.....s.u^.#.P. ... packet: id=1014 drop packet: id=1015 len=52 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=A seq=984530821 ack_seq=4091425511 using cached desync profile 2 packet: id=1015 pass unmodified packet: id=1016 len=52 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=A seq=984530821 ack_seq=4091425903 using cached desync profile 2 packet: id=1016 pass unmodified packet: id=1017 len=264 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=AP seq=984530821 ack_seq=4091425903 TCP: 16 03 03 00 80 02 00 00 7C 03 03 11 7E C6 D7 21 C9 DB A2 D1 6A 37 53 5D 8B 77 89 E1 11 6D 01 D8 ... : ........|...~..!....j7S].w...m.. ... using cached desync profile 2 packet: id=1017 pass unmodified packet: id=1018 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=A seq=4091425903 ack_seq=984531033 using cached desync profile 2 packet: id=1018 pass unmodified packet: id=1019 len=58 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091425903 ack_seq=984531033 TCP: 14 03 03 00 01 01 : ...... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1019 pass unmodified packet: id=1020 len=110 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091425909 ack_seq=984531033 TCP: 17 03 03 00 35 75 2B 74 3B 00 18 30 40 8A AF 52 12 79 AB 4A 5B 54 DC 86 8E D5 0D 54 F7 4E 80 10 ... : ....5u+t;..0@..R.y.J[T.....T.N.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1020 pass unmodified packet: id=1021 len=98 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091425967 ack_seq=984531033 TCP: 17 03 03 00 29 1C 82 CB 03 FC DF CB 3D 65 79 AB C0 31 E0 80 30 90 B4 BA 1B 2B 37 3C 80 71 89 89 ... : ....).......=ey..1..0....+7<.q.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1021 pass unmodified packet: id=1022 len=95 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091426013 ack_seq=984531033 TCP: 17 03 03 00 26 56 05 01 5E F1 31 26 5B 89 0A C0 32 62 B8 DE D7 8C 5D 12 16 28 9A BF 47 CC F2 2F ... : ....&V..^.1&[...2b....]..(..G../ ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1022 pass unmodified packet: id=1023 len=87 mark=20000000 IP4: 192.168.1.8 => 157.240.0.63 proto=tcp ttl=63 sport=59835 dport=443 flags=AP seq=4091426056 ack_seq=984531033 TCP: 17 03 03 00 1E C1 A0 0E 7A 56 69 47 8B 9A 5A EC CA DC 7A 2E F9 E5 6B 25 48 19 11 00 68 28 F3 70 ... : ........zViG..Z...z...k%H...h(.p ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1023 pass unmodified packet: id=1024 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=A seq=1544951069 ack_seq=550386360 using cached desync profile 2 packet: id=1024 pass unmodified packet: id=1025 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=A seq=1544951069 ack_seq=550386752 using cached desync profile 2 packet: id=1025 pass unmodified packet: id=1026 len=264 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=AP seq=1544951069 ack_seq=550386752 TCP: 16 03 03 00 80 02 00 00 7C 03 03 27 2F A5 AE 4C 48 94 11 ED 59 EE 97 46 4F FA EB F3 45 14 DD 63 ... : ........|..'/..LH...Y..FO...E..c ... using cached desync profile 2 packet: id=1026 pass unmodified packet: id=1027 len=52 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=A seq=550386752 ack_seq=1544951281 using cached desync profile 2 packet: id=1027 pass unmodified packet: id=1028 len=58 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386752 ack_seq=1544951281 TCP: 14 03 03 00 01 01 : ...... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1028 pass unmodified packet: id=1029 len=110 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386758 ack_seq=1544951281 TCP: 17 03 03 00 35 C4 40 84 64 3B A6 A2 24 6C 62 CA 1B 0F E9 F2 B7 DE 1C BF 1F 7E 65 E2 17 44 E1 B6 ... : ....5.@.d;..$lb..........~e..D.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1029 pass unmodified packet: id=1030 len=98 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386816 ack_seq=1544951281 TCP: 17 03 03 00 29 A6 9B 16 45 FD 33 CC 86 2B 46 71 23 99 5B 80 43 E3 FF 7F 28 65 81 71 13 5F B2 46 ... : ....)...E.3..+Fq#.[.C..(e.q._.F ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1030 pass unmodified packet: id=1031 len=95 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386862 ack_seq=1544951281 TCP: 17 03 03 00 26 A7 C8 61 27 37 85 70 D4 54 93 DC 8A CD 7F 05 38 59 23 3E CD 4A 51 1A A9 98 64 76 ... : ....&..a'7.p.T.....8Y#>.JQ...dv ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1031 pass unmodified packet: id=1032 len=87 mark=20000000 IP4: 192.168.1.8 => 157.240.251.63 proto=tcp ttl=63 sport=59836 dport=443 flags=AP seq=550386905 ack_seq=1544951281 TCP: 17 03 03 00 1E 13 FF 0E 88 52 3D BD 67 90 46 90 43 4F 65 95 BE B5 F6 9C F7 F7 A4 4E 93 91 39 4B ... : .........R=.g.F.COe........N..9K ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1032 pass unmodified packet: id=1033 len=52 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=A seq=984531033 ack_seq=4091425967 using cached desync profile 2 packet: id=1033 pass unmodified packet: id=1034 len=224 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=AP seq=984531033 ack_seq=4091425967 TCP: 17 03 03 00 A7 45 C5 09 00 4F 36 5B 78 FE 4B A7 0E 39 FA 28 98 C4 FA 29 56 D7 FA 4E C4 89 47 5B ... : .....E...O6[x.K..9.(...)V..N..G[ ... using cached desync profile 2 packet: id=1034 pass unmodified packet: id=1035 len=126 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=AP seq=984531205 ack_seq=4091425967 TCP: 17 03 03 00 45 E5 B4 42 22 C5 52 F8 5C CA 06 25 1B D1 E7 FE BB 2F A0 D1 E0 2D A9 01 DB AF F5 7A ... : ....E..B".R.\..%...../...-.....z ... using cached desync profile 2 packet: id=1035 pass unmodified packet: id=1036 len=52 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=A seq=984531279 ack_seq=4091426056 using cached desync profile 2 packet: id=1036 pass unmodified packet: id=1037 len=83 mark=00000000 IP4: 157.240.0.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59835 flags=AP seq=984531279 ack_seq=4091426056 TCP: 17 03 03 00 1A 1C 96 91 6D C0 7C FB AD CE B9 A9 25 2B CA E8 27 29 67 04 A3 AB 77 13 AB 3E 53 : ........m.|.....%+..')g...w..>S using cached desync profile 2 packet: id=1037 pass unmodified packet: id=1038 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=A seq=1544951281 ack_seq=550386816 using cached desync profile 2 packet: id=1038 pass unmodified packet: id=1039 len=224 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=AP seq=1544951281 ack_seq=550386816 TCP: 17 03 03 00 A7 5B BC 0A F7 68 33 EB E9 11 3D 8A D6 CE BD 92 82 58 87 4A 9D 5C C3 9F FF CE 64 D2 ... : .....[...h3...=......X.J.\....d. ... using cached desync profile 2 packet: id=1039 pass unmodified packet: id=1040 len=126 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=AP seq=1544951453 ack_seq=550386816 TCP: 17 03 03 00 45 DA DE 01 5F E2 10 15 84 A3 CD E2 D4 C6 3A 45 7D 18 69 BB 33 F2 DC 24 DC DE 53 35 ... : ....E..._.........:E}.i.3..$..S5 ... using cached desync profile 2 packet: id=1040 pass unmodified packet: id=1041 len=52 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=A seq=1544951527 ack_seq=550386905 using cached desync profile 2 packet: id=1041 pass unmodified packet: id=1042 len=83 mark=00000000 IP4: 157.240.251.63 => 192.168.1.8 proto=tcp ttl=53 sport=443 dport=59836 flags=AP seq=1544951527 ack_seq=550386905 TCP: 17 03 03 00 1A 3F B3 F9 EF 21 39 EF 17 60 7A 24 7D 3C 18 30 BA 1A EE D6 66 9B E0 EF EE 4E B5 : .....?...!9..`z$}<.0....f....N. using cached desync profile 2 packet: id=1042 pass unmodified packet: id=1043 len=52 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=S seq=1767978469 ack_seq=0 desync profile search for tcp target=216.58.210.142:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1043 pass unmodified packet: id=1044 len=52 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=SA seq=3242093477 ack_seq=1767978470 using cached desync profile 2 incoming TTL 56 packet: id=1044 pass unmodified packet: id=1045 len=40 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=A seq=1767978470 ack_seq=3242093478 using cached desync profile 2 packet: id=1045 pass unmodified packet: id=1046 len=1452 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=A seq=1767978470 ack_seq=3242093478 TCP: 16 03 01 08 C9 01 00 08 C5 03 03 52 F1 73 EC 5B 80 4F 85 F7 BA EF 11 8D 2C 50 5B 01 73 84 61 CD ... : ...........R.s.[.O......,P[.s.a. ... using cached desync profile 2 packet contains partial TLS ClientHello starting reassemble. now we have 1412/2254 req retrans : seq interval 1767978470-1767979881 DELAY desync until reasm is complete (#1) packet: id=1046 drop packet: id=1047 len=882 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767979882 ack_seq=3242093478 TCP: 83 44 00 81 8B B5 50 A4 DC 7D 8C 3C 72 67 56 74 4A B2 73 DE 98 2E 25 18 A4 18 A8 A8 C8 35 97 BA ... : .D....P..}. 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=A seq=1767978470 ack_seq=3242093478 TCP: 16 03 01 08 C9 01 00 08 C5 03 03 52 F1 73 EC 5B 80 4F 85 F7 BA EF 11 8D 2C 50 5B 01 73 84 61 CD ... : ...........R.s.[.O......,P[.s.a. ... using cached desync profile 2 packet contains full TLS ClientHello hostname: accounts.youtube.com discovered l7 protocol discovered hostname desync profile search for tcp target=216.58.210.142:443 l7proto=tls hostname='accounts.youtube.com' * hostlist check for profile 1 Checking include hostlist Hostlist check for accounts.youtube.com : negative Hostlist check for youtube.com : positive desync profile 1 matches desync profile changed by revealed l7 protocol or hostname ! dpi desync src=192.168.1.8:60680 dst=216.58.210.142:443 split pos 1 sending fake request : 16 03 01 02 91 01 00 02 8D 03 03 8E C0 C8 6C FE 62 16 77 65 AD 67 B9 F2 03 DB 8D 96 61 24 FE 82 ... : ..............l.b.we.g......a$.. ... sending 1st tcp segment 0-0 len=1 seqovl=0 : 16 : . sending 2nd tcp segment 1-1411 len=1411 : 03 01 08 C9 01 00 08 C5 03 03 52 F1 73 EC 5B 80 4F 85 F7 BA EF 11 8D 2C 50 5B 01 73 84 61 CD 89 ... : ..........R.s.[.O......,P[.s.a.. ... DROPPING delayed packet #1 REPLAYING delayed packet #2 offset 1412 REPLAY IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767979882 ack_seq=3242093478 TCP: 83 44 00 81 8B B5 50 A4 DC 7D 8C 3C 72 67 56 74 4A B2 73 DE 98 2E 25 18 A4 18 A8 A8 C8 35 97 BA ... : .D....P..}. 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242093478 ack_seq=1767978471 using cached desync profile 1 packet: id=1048 pass unmodified packet: id=1049 len=40 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242093478 ack_seq=1767979882 using cached desync profile 1 packet: id=1049 pass unmodified packet: id=1050 len=40 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242093478 ack_seq=1767980724 using cached desync profile 1 packet: id=1050 pass unmodified packet: id=1051 len=1452 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242093478 ack_seq=1767980724 TCP: 16 03 03 04 C0 02 00 04 BC 03 03 63 A2 91 BC 4A A9 FE 34 8F 03 AD 66 5B B2 86 CB 0C 2C 9A CC 98 ... : ...........c...J..4...f[....,... ... using cached desync profile 1 packet: id=1051 pass unmodified packet: id=1052 len=97 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=AP seq=3242094890 ack_seq=1767980724 TCP: 55 97 CC 4C 33 6C D2 59 8B C9 FF E3 C4 30 6F 8D 88 25 77 BB 18 55 B8 88 0E E2 1F F6 6F 11 7D E0 ... : U..L3l.Y.....0o..%w..U......o.}. ... using cached desync profile 1 packet: id=1052 pass unmodified packet: id=1053 len=40 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=A seq=1767980724 ack_seq=3242094947 using cached desync profile 1 packet: id=1053 pass unmodified packet: id=1054 len=114 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767980724 ack_seq=3242094947 TCP: 14 03 03 00 01 01 17 03 03 00 3F 39 79 82 19 54 79 98 D8 19 BC F2 21 F6 7E 10 B1 FC 94 B9 13 9D ... : ..........?9y..Ty.....!.~....... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=1054 pass unmodified packet: id=1055 len=132 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767980798 ack_seq=3242094947 TCP: 17 03 03 00 57 80 22 08 24 44 52 9F 5C 34 AE 38 9E 55 FF 77 A4 24 96 A0 60 7B 8B 14 CF 5F 04 70 ... : ....W.".$DR.\4.8.U.w.$..`{..._.p ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=1055 pass unmodified packet: id=1056 len=1452 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=A seq=1767980890 ack_seq=3242094947 TCP: 17 03 03 08 7E 57 BA 79 E6 42 B6 B2 87 DA 82 C9 AB CC 62 69 A2 5D E2 F0 69 1A 4A 15 FF 02 C3 57 ... : ....~W.y.B........bi.]..i.J....W ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=1056 pass unmodified packet: id=1057 len=807 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767982302 ack_seq=3242094947 TCP: 87 81 31 AB 85 34 24 9E EE 0D 3A 3E FA 72 62 75 72 92 1A 7E EF 31 1C 2D EC 12 5C DF F4 1A 99 8F ... : ..1..4$...:>.rbur..~.1.-..\..... ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=1057 pass unmodified packet: id=1058 len=101 mark=20000000 IP4: 192.168.1.8 => 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767983069 ack_seq=3242094947 TCP: 17 03 03 00 38 F2 D4 3D FA 2C CD E6 2B 2B BD CD 95 AE 30 53 46 B8 C8 8D E4 BA 89 B5 BC 3D E3 69 ... : ....8..=.,..++....0SF........=.i ... using cached desync profile 1 not applying tampering to unknown protocol packet: id=1058 pass unmodified packet: id=1059 len=1010 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=AP seq=3242094947 ack_seq=1767980798 TCP: 17 03 03 03 87 28 E9 9D 4D 3F 4D FA 32 8D 2B B0 19 C8 A6 9F A4 3E 19 46 31 DB 14 AB 34 E4 9A 36 ... : .....(..M?M.2.+......>.F1...4..6 ... using cached desync profile 1 packet: id=1059 pass unmodified packet: id=1060 len=71 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=AP seq=3242095917 ack_seq=1767980890 TCP: 17 03 03 00 1A 3C 7A 97 70 DB F3 BA A2 1D 08 1E 2B AE 4F 5D 17 B8 68 87 17 EF AC 5E BC 54 C4 : ..... 216.58.210.142 proto=tcp ttl=127 sport=60680 dport=443 flags=AP seq=1767983130 ack_seq=3242095917 TCP: 17 03 03 00 1A 64 04 AC 47 91 38 12 D7 67 5F C2 59 F5 BC 63 85 4D DC D1 F6 81 DA 08 4E F1 64 : .....d..G.8..g_.Y..c.M......N.d using cached desync profile 1 not applying tampering to unknown protocol packet: id=1061 pass unmodified packet: id=1062 len=52 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242095948 ack_seq=1767980890 using cached desync profile 1 packet: id=1062 pass unmodified packet: id=1063 len=52 mark=00000000 IP4: 216.58.210.142 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=60680 flags=A seq=3242095948 ack_seq=1767980890 using cached desync profile 1 packet: id=1063 pass unmodified packet: id=1064 len=71 mark=00000000 IP4: 37.244.28.21 => 192.168.1.8 proto=tcp ttl=48 sport=443 dport=60613 flags=AP seq=2244746758 ack_seq=2718617408 TCP: 15 03 03 00 1A C9 2A 89 2F F4 CE 24 95 BC 70 74 72 06 8A C1 3E 4C 78 01 1A A2 61 C2 17 06 A8 : ......*./..$..ptr...>Lx...a.... desync profile search for tcp target=192.168.1.8:60613 l7proto=unknown hostname='' desync profile 2 matches not applying tampering to unknown protocol packet: id=1064 pass unmodified packet: id=1065 len=40 mark=20000000 IP4: 192.168.1.8 => 37.244.28.21 proto=tcp ttl=127 sport=60613 dport=443 flags=A seq=2718617408 ack_seq=2244746758 desync profile search for tcp target=37.244.28.21:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1065 pass unmodified packet: id=1066 len=60 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=S seq=321490637 ack_seq=0 desync profile search for tcp target=213.180.193.234:443 l7proto=unknown hostname='' desync profile 2 matches packet: id=1066 pass unmodified packet: id=1067 len=60 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52158 flags=SA seq=4214103403 ack_seq=321490638 using cached desync profile 2 incoming TTL 56 packet: id=1067 pass unmodified packet: id=1068 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=A seq=321490638 ack_seq=4214103404 using cached desync profile 2 packet: id=1068 pass unmodified packet: id=1069 len=850 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=AP seq=321490638 ack_seq=4214103404 TCP: 16 03 01 03 19 01 00 03 15 03 03 97 8B C6 AB 8E 63 86 3F 63 96 9B 68 C1 49 12 DF E4 88 D6 15 EB ... : ................c.?c..h.I....... ... using cached desync profile 2 packet contains full TLS ClientHello req retrans : seq interval 321490638-321491435 hostname: api.browser.yandex.net discovered l7 protocol discovered hostname desync profile search for tcp target=213.180.193.234:443 l7proto=tls hostname='api.browser.yandex.net' * hostlist check for profile 1 Checking include hostlist Hostlist check for api.browser.yandex.net : negative Hostlist check for browser.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative desync profile 2 matches * hostlist check for profile 2 Checking exclude hostlist Hostlist check for api.browser.yandex.net : negative Hostlist check for browser.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative Checking include hostlist Hostlist check for api.browser.yandex.net : negative Hostlist check for browser.yandex.net : negative Hostlist check for yandex.net : negative Hostlist check for net : negative not applying tampering to this request packet: id=1069 pass unmodified packet: id=1070 len=52 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52158 flags=A seq=4214103404 ack_seq=321491436 using cached desync profile 2 packet: id=1070 pass unmodified packet: id=1071 len=202 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52158 flags=AP seq=4214103404 ack_seq=321491436 TCP: 16 03 03 00 5E 02 00 00 5A 03 03 87 8A B6 56 60 75 8B 10 96 09 EB 67 64 27 2D ED B3 EA F1 3B 7F ... : ....^...Z.....V`u.....gd'-....; ... using cached desync profile 2 packet: id=1071 pass unmodified packet: id=1072 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=A seq=321491436 ack_seq=4214103554 using cached desync profile 2 packet: id=1072 pass unmodified packet: id=1073 len=103 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=AP seq=321491436 ack_seq=4214103554 TCP: 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 76 02 41 2B 01 DF 8C 40 8B 8D 98 CC 7F ... : ..........(........v.A+...@.... ... using cached desync profile 2 req retrans : tcp seq 321491436 not within the req range 321490638-321491435. stop tracking. not applying tampering to unknown protocol packet: id=1073 pass unmodified packet: id=1074 len=151 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=AP seq=321491487 ack_seq=4214103554 TCP: 17 03 03 00 5E 00 00 00 00 00 00 00 01 0D 24 D0 80 2C FF 6D 56 C3 50 56 D7 82 3F EA FA 56 FC 27 ... : ....^.........$..,.mV.PV..?..V.' ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1074 pass unmodified packet: id=1075 len=466 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=AP seq=321491586 ack_seq=4214103554 TCP: 17 03 03 01 99 00 00 00 00 00 00 00 02 B8 E8 46 7C 10 5E A2 68 CE BE 0F C5 43 CF 19 EF 38 AF C6 ... : ...............F|.^.h....C...8.. ... using cached desync profile 2 not applying tampering to unknown protocol packet: id=1075 pass unmodified packet: id=1076 len=52 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=AR seq=321492000 ack_seq=4214103554 using cached desync profile 2 packet: id=1076 pass unmodified packet: id=1077 len=52 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52158 flags=A seq=4214103554 ack_seq=321491586 using cached desync profile 2 packet: id=1077 pass unmodified packet: id=1078 len=142 mark=00000000 IP4: 213.180.193.234 => 192.168.1.8 proto=tcp ttl=56 sport=443 dport=52158 flags=AP seq=4214103554 ack_seq=321491586 TCP: 17 03 03 00 55 3F D0 D7 0F 48 BC 6F 12 77 24 EF F7 E0 A1 3F B4 45 2A D4 95 98 95 A8 71 12 95 54 ... : ....U?...H.o.w$....?.E*.....q..T ... using cached desync profile 2 packet: id=1078 pass unmodified packet: id=1079 len=40 mark=20000000 IP4: 192.168.1.8 => 213.180.193.234 proto=tcp ttl=63 sport=52158 dport=443 flags=R seq=321491586 ack_seq=0 using cached desync profile 2 packet: id=1079 pass unmodified