Добрый день!
Неделю бьемся с проблемой - внезапно стали происходить разрывы PPTP соединений. Серверов несколько, наблюдается на всех. Не то чтоы повально, но у некоторых пользователях они периодически постоянно повторяются. При чем сеть работает отлично, до сервера ping не пропадает. Уже все мысли закончились.Вот снял лог tcpdump пользователя, который был подключен, работал и у него вдруг случился разрыв.
17:47:20.089550 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 298, length 24: LCP, Echo-Request (0x09), id 125, length 10
17:47:20.090159 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 381, ack 298, length 26: LCP, Echo-Reply (0x0a), id 125, length 10
17:47:20.115137 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 381, no-payload, length 12
17:47:40.091781 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 299, length 24: LCP, Echo-Request (0x09), id 126, length 10
17:47:40.092239 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 382, ack 299, length 26: LCP, Echo-Reply (0x0a), id 126, length 10
17:47:40.116928 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 382, no-payload, length 12
17:48:00.095228 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 300, length 24: LCP, Echo-Request (0x09), id 127, length 10
17:48:00.095724 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 383, ack 300, length 26: LCP, Echo-Reply (0x0a), id 127, length 10
17:48:00.120857 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 383, no-payload, length 12
17:48:07.817134 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 144:160(16) ack 181 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(42)
17:48:07.817516 IP 10.11.4.36.49352 > 172.16.3.14.pptp: P 181:201(20) ack 160 win 16175: pptp CTRL_MSGTYPE=ECHORP ID(42) RESULT_CODE(1) ERR_CODE(0)
17:48:07.817534 IP 172.16.3.14.pptp > 10.11.4.36.49352: . ack 201 win 8210
17:48:20.099207 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 301, length 24: LCP, Echo-Request (0x09), id 128, length 10
17:48:20.099711 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 384, ack 301, length 26: LCP, Echo-Reply (0x0a), id 128, length 10
17:48:20.127656 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 384, no-payload, length 12
17:48:22.447633 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 385, length 242: IP 172.19.28.161.netbios-dgm > 255.255.255.255.netbios-dgm: NBT UDP PACKET(138)
17:48:22.472621 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 385, no-payload, length 12
17:48:40.101604 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 302, length 24: LCP, Echo-Request (0x09), id 129, length 10
17:48:40.102182 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 386, ack 302, length 26: LCP, Echo-Reply (0x0a), id 129, length 10
17:48:40.126685 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 386, no-payload, length 12
17:49:00.105935 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 303, length 24: LCP, Echo-Request (0x09), id 130, length 10
17:49:00.106463 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 387, ack 303, length 26: LCP, Echo-Reply (0x0a), id 130, length 10
17:49:00.130804 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 387, no-payload, length 12
17:49:03.848515 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 304, length 61: IP 172.19.2.113.rfx-lm > 172.19.28.161.microsoft-ds: S 2201168671:2201168671(0) win 16384 <mss 1360,nop,nop,sackOK>
17:49:03.849243 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 388, ack 304, length 65: IP 172.19.28.161.microsoft-ds > 172.19.2.113.rfx-lm: S 824437986:824437986(0) ack 2201168672 win 8192 <mss 1360,nop,[|tcp]>
17:49:03.849800 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 305, ack 388, length 57: IP 172.19.2.113.rfx-lm > 172.19.28.161.microsoft-ds: . ack 1 win 17680
17:49:03.849886 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 306, length 53: IP 172.19.2.113.rfx-lm > 172.19.28.161.microsoft-ds: F 1:1(0) ack 1 win 17680
17:49:03.850139 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 307, length 61: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: S 1293376375:1293376375(0) win 16384 <mss 1360,nop,nop,sackOK>
17:49:03.850655 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 389, ack 307, length 57: IP 172.19.28.161.microsoft-ds > 172.19.2.113.rfx-lm: . ack 2 win 65280
17:49:03.850675 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 390, length 61: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: S 4079724501:4079724501(0) ack 1293376376 win 8192 <mss 1360,nop,nop,sackOK>
17:49:03.850752 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 391, length 53: IP 172.19.28.161.microsoft-ds > 172.19.2.113.rfx-lm: R 1:1(0) ack 2 win 0
17:49:03.851154 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 308, ack 391, length 57: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: . ack 1 win 17680
17:49:03.851418 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 309, length 190: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 1:138(137) ack 1 win 17680
17:49:03.852493 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 392, ack 309, length 188: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 1:132(131) ack 138 win 65280
17:49:03.853238 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 310, ack 392, length 246: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 138:327(189) ack 132 win 17549
17:49:03.853906 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 393, ack 310, length 364: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 132:439(307) ack 327 win 65091
17:49:03.854585 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 311, ack 393, length 330: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 327:600(273) ack 439 win 17242
17:49:03.855545 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 394, ack 311, length 96: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 439:478(39) ack 600 win 64818
17:49:03.856184 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 312, ack 394, length 168: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 600:711(111) ack 478 win 17203
17:49:03.856562 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 395, ack 312, length 163: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 478:584(106) ack 711 win 64707
17:49:03.857085 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 313, ack 395, length 116: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 711:770(59) ack 584 win 17097
17:49:03.857477 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 396, ack 313, length 107: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 584:634(50) ack 770 win 64648
17:49:03.858029 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 314, ack 396, length 152: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 770:865(95) ack 634 win 17047
17:49:03.858465 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 397, ack 314, length 96: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 634:673(39) ack 865 win 64553
17:49:03.859253 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 315, ack 397, length 163: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: P 865:971(106) ack 673 win 17008
17:49:03.859581 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 398, ack 315, length 96: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: P 673:712(39) ack 971 win 64447
17:49:03.860302 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 316, ack 398, length 57: IP 172.19.2.113.watcom-sql > 172.19.28.161.microsoft-ds: F 971:971(0) ack 712 win 16969
17:49:03.860661 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 399, ack 316, length 57: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: . ack 972 win 64447
17:49:03.860768 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 400, length 53: IP 172.19.28.161.microsoft-ds > 172.19.2.113.watcom-sql: R 712:712(0) ack 972 win 0
17:49:03.885850 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 400, no-payload, length 12
17:49:07.820039 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 160:176(16) ack 201 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(43)
17:49:07.820340 IP 10.11.4.36.49352 > 172.16.3.14.pptp: P 201:221(20) ack 176 win 16171: pptp CTRL_MSGTYPE=ECHORP ID(43) RESULT_CODE(1) ERR_CODE(0)
17:49:07.820363 IP 172.16.3.14.pptp > 10.11.4.36.49352: . ack 221 win 8210
17:49:20.110900 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 317, length 24: LCP, Echo-Request (0x09), id 131, length 10
17:49:20.111404 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 401, ack 317, length 26: LCP, Echo-Reply (0x0a), id 131, length 10
17:49:20.136731 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 401, no-payload, length 12
17:49:40.112411 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 318, length 24: LCP, Echo-Request (0x09), id 132, length 10
17:49:40.112915 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 402, ack 318, length 26: LCP, Echo-Reply (0x0a), id 132, length 10
17:49:40.137361 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 402, no-payload, length 12
17:50:00.115627 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 319, length 24: LCP, Echo-Request (0x09), id 133, length 10
17:50:00.116172 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 403, ack 319, length 26: LCP, Echo-Reply (0x0a), id 133, length 10
17:50:00.141164 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 403, no-payload, length 12
17:50:07.823232 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 176:192(16) ack 221 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(44)
17:50:07.823609 IP 10.11.4.36.49352 > 172.16.3.14.pptp: P 221:241(20) ack 192 win 16167: pptp CTRL_MSGTYPE=ECHORP ID(44) RESULT_CODE(1) ERR_CODE(0)
17:50:07.823634 IP 172.16.3.14.pptp > 10.11.4.36.49352: . ack 241 win 8210
17:50:20.119947 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 320, length 24: LCP, Echo-Request (0x09), id 134, length 10
17:50:20.120454 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 404, ack 320, length 26: LCP, Echo-Reply (0x0a), id 134, length 10
17:50:20.145512 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 404, no-payload, length 12
17:50:40.121486 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 321, length 24: LCP, Echo-Request (0x09), id 135, length 10
17:50:40.122046 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 405, ack 321, length 26: LCP, Echo-Reply (0x0a), id 135, length 10
17:50:40.146465 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 405, no-payload, length 12
17:51:00.125809 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 322, length 24: LCP, Echo-Request (0x09), id 136, length 10
17:51:00.126249 IP 10.11.4.36 > 172.16.3.14: GREv1, call 60987, seq 406, ack 322, length 26: LCP, Echo-Reply (0x0a), id 136, length 10
17:51:00.150672 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, ack 406, no-payload, length 12
### тут появился последний Echo-Replay, дальше их нет и что-то тварится
17:51:07.826318 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:08.058198 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:08.320911 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:08.644666 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:09.089736 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:09.776903 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:10.949739 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:13.093587 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:17.182461 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:18.267077 IP 10.11.4.36.49373 > 172.16.3.14.pptp: S 3929158965:3929158965(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
17:51:18.267114 IP 172.16.3.14.pptp > 10.11.4.36.49373: S 3349980013:3349980013(0) ack 3929158966 win 65535 <mss 1460,nop,wscale 3,sackOK,eol>
17:51:18.267638 IP 10.11.4.36.49373 > 172.16.3.14.pptp: . ack 1 win 16425
17:51:18.267808 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 1:157(156) ack 1 win 16425: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(A) BEARER_CAP(A) MAX_CHAN(0) FIRM_REV(0) [|pptp]
17:51:18.267833 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 157 win 8193
17:51:18.269362 IP 172.16.3.14.pptp > 10.11.4.36.49373: P 1:157(156) ack 157 win 8212: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP(AS) BEARER_CAP(DA) MAX_CHAN(0) FIRM_REV(257) [|pptp]
17:51:18.269734 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 157:325(168) ack 157 win 16386: pptp CTRL_MSGTYPE=OCRQ CALL_ID(25246) CALL_SER_NUM(21) MIN_BPS(300) MAX_BPS(100000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(64) PROC_DELAY(0) PHONE_NO_LEN(0) [|pptp]
17:51:18.269753 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 325 win 8191
17:51:18.274004 IP 172.16.3.14.pptp > 10.11.4.36.49373: P 157:189(32) ack 325 win 8212: pptp CTRL_MSGTYPE=OCRP CALL_ID(61225) PEER_CALL_ID(25246) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(64000) RECV_WIN(16) PROC_DELAY(1) PHY_CHAN_ID(36831232)
17:51:18.274277 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 0, length 54: LCP, Conf-Request (0x01), id 1, length 40
17:51:18.279799 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 325:349(24) ack 189 win 16378: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(61225) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
17:51:18.279822 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 349 win 8209
17:51:18.286644 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 0, ack 0, length 41: LCP, Conf-Request (0x01), id 0, length 23
17:51:18.287099 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 1, ack 0, length 27: LCP, Conf-Reject (0x04), id 0, length 9
17:51:18.287594 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 1, ack 1, length 38: LCP, Conf-Request (0x01), id 1, length 20
17:51:18.288115 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 2, ack 1, length 38: LCP, Conf-Ack (0x02), id 1, length 20
17:51:18.373412 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, ack 2, no-payload, length 12
17:51:20.129931 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 323, length 24: LCP, Echo-Request (0x09), id 137, length 10
17:51:20.275291 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 3, length 54: LCP, Conf-Request (0x01), id 2, length 40
17:51:20.275763 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 2, ack 3, length 39: LCP, Conf-Reject (0x04), id 2, length 21
17:51:20.276482 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 4, ack 2, length 43: LCP, Conf-Request (0x01), id 3, length 25
17:51:20.276869 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 3, ack 4, length 43: LCP, Conf-Ack (0x02), id 3, length 25
17:51:20.276932 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 349:373(24) ack 189 win 16378: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(61225) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
17:51:20.276957 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 373 win 8209
17:51:20.277055 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 4, length 32: LCP, Ident (0x0c), id 2, length 20
17:51:20.277065 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 5, length 39: LCP, Ident (0x0c), id 3, length 27
17:51:20.277074 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 6, length 38: LCP, Ident (0x0c), id 4, length 26
17:51:20.277633 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 5, ack 6, length 41: CHAP, Challenge (0x01), id 1, Value bb1e68ff190db2f579209bf409d581b9, Name
17:51:20.282072 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 7, ack 5, length 79: CHAP, Response (0x02), id 1, Value 31364911b6249f3878fad23419afa4b500000000000000002bb91e7701a1266d6041c7cf4cabb4[|chap]
17:51:20.284948 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 6, ack 7, length 66: CHAP, Success (0x03), id 1, Msg S=FC7994CE5D2A12A578D13AB833E700301F4B[|chap]
17:51:20.285797 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 7, length 30: IPCP, Conf-Request (0x01), id 1, length 18
17:51:20.286600 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 8, ack 7, length 32: IP6CP, Conf-Request (0x01), id 5, length 16
17:51:20.286710 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 9, length 24: unknown ctrl-proto (0x80fd), Conf-Request (0x01), id 6, length 12
17:51:20.286722 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 10, length 48: IPCP, Conf-Request (0x01), id 7, length 36
17:51:20.286813 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 11, length 24: IPCP, Conf-Reject (0x04), id 1, length 12
17:51:20.287037 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 8, ack 11, length 40: LCP, Prot-Reject (0x08), id 1, length 22
17:51:20.287110 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 9, length 32: LCP, Prot-Reject (0x08), id 2, length 18
17:51:20.287338 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 10, length 30: IPCP, Conf-Reject (0x04), id 7, length 18
17:51:20.287410 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 11, length 24: IPCP, Conf-Request (0x01), id 2, length 12
17:51:20.288061 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 12, ack 11, length 40: IPCP, Conf-Request (0x01), id 8, length 24
17:51:20.288190 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 13, length 24: IPCP, Conf-Ack (0x02), id 2, length 12
17:51:20.288665 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 12, ack 13, length 40: IPCP, Conf-Nack (0x03), id 8, length 24
17:51:20.289003 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 14, ack 12, length 40: IPCP, Conf-Request (0x01), id 9, length 24
17:51:20.289583 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 13, ack 14, length 40: IPCP, Conf-Ack (0x02), id 9, length 24
17:51:20.290434 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 14, length 18: IPCP, Term-Request (0x05), id 3, length 6
17:51:20.352222 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 15, ack 14, length 88: IP 172.19.28.161.62807 > 91.190.68.2.domain: 50949+[|domain]
17:51:20.371950 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 16, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:20.374477 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 17, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:20.374493 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 18, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:20.376673 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, ack 18, no-payload, length 12
17:51:20.429477 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61225, seq 19, length 18: IPCP, Term-Ack (0x06), id 3, length 6
17:51:20.429556 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 373:389(16) ack 189 win 16378: pptp CTRL_MSGTYPE=CCRQ CALL_ID(25246)
17:51:20.429578 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 389 win 8210
17:51:20.432924 IP 172.16.3.14 > 10.11.4.36: GREv1, call 25246, seq 15, ack 19, length 24: LCP, Term-Request (0x05), id 4, length 6
17:51:20.434890 IP 172.16.3.14.pptp > 10.11.4.36.49373: P 189:337(148) ack 389 win 8212: pptp CTRL_MSGTYPE=CDN CALL_ID(61225) RESULT_CODE(4) ERR_CODE(0) CAUSE_CODE(0) [|pptp]
17:51:20.435794 IP 10.11.4.36.49373 > 172.16.3.14.pptp: P 389:405(16) ack 337 win 16341: pptp CTRL_MSGTYPE=StopCCRQ REASON(1)
17:51:20.435815 IP 172.16.3.14.pptp > 10.11.4.36.49373: . ack 405 win 8210
17:51:20.436959 IP 172.16.3.14.pptp > 10.11.4.36.49373: P 337:353(16) ack 405 win 8212: pptp CTRL_MSGTYPE=StopCCRP RESULT_CODE(1) ERR_CODE(0)
17:51:20.436969 IP 172.16.3.14.pptp > 10.11.4.36.49373: F 353:353(0) ack 405 win 8212
17:51:20.437230 IP 10.11.4.36.49373 > 172.16.3.14.pptp: F 405:405(0) ack 353 win 16337
17:51:20.437268 IP 172.16.3.14.pptp > 10.11.4.36.49373: F 353:353(0) ack 406 win 8212
17:51:20.679282 IP 172.16.3.14.pptp > 10.11.4.36.49373: F 353:353(0) ack 406 win 8212
17:51:20.679523 IP 10.11.4.36.49373 > 172.16.3.14.pptp: . ack 354 win 0
17:51:25.155663 IP 172.16.3.14.pptp > 10.11.4.36.49352: P 192:208(16) ack 241 win 8212: pptp CTRL_MSGTYPE=ECHORQ ID(45)
17:51:30.130395 IP 172.16.3.14 > 10.11.4.36: GREv1, call 59616, seq 324, length 24: LCP, Echo-Request (0x09), id 138, length 10
17:51:35.646472 IP 10.11.4.36.49374 > 172.16.3.14.pptp: S 3550951176:3550951176(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
17:51:35.646508 IP 172.16.3.14.pptp > 10.11.4.36.49374: S 718214763:718214763(0) ack 3550951177 win 65535 <mss 1460,nop,wscale 3,sackOK,eol>
17:51:35.647027 IP 10.11.4.36.49374 > 172.16.3.14.pptp: . ack 1 win 16425
17:51:35.647380 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 1:157(156) ack 1 win 16425: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(A) BEARER_CAP(A) MAX_CHAN(0) FIRM_REV(0) [|pptp]
17:51:35.647399 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 157 win 8193
17:51:35.649418 IP 172.16.3.14.pptp > 10.11.4.36.49374: P 1:157(156) ack 157 win 8212: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP(AS) BEARER_CAP(DA) MAX_CHAN(0) FIRM_REV(257) [|pptp]
17:51:35.649736 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 157:325(168) ack 157 win 16386: pptp CTRL_MSGTYPE=OCRQ CALL_ID(21690) CALL_SER_NUM(22) MIN_BPS(300) MAX_BPS(100000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(64) PROC_DELAY(0) PHONE_NO_LEN(0) [|pptp]
17:51:35.649754 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 325 win 8191
17:51:35.652819 IP 172.16.3.14.pptp > 10.11.4.36.49374: P 157:189(32) ack 325 win 8212: pptp CTRL_MSGTYPE=OCRP CALL_ID(61226) PEER_CALL_ID(21690) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(64000) RECV_WIN(16) PROC_DELAY(1) PHY_CHAN_ID(36831232)
17:51:35.653062 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 0, length 54: LCP, Conf-Request (0x01), id 1, length 40
17:51:35.659397 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 325:349(24) ack 189 win 16378: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(61226) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
17:51:35.659419 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 349 win 8209
17:51:35.666145 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 0, ack 0, length 41: LCP, Conf-Request (0x01), id 0, length 23
17:51:35.666888 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 1, ack 0, length 27: LCP, Conf-Reject (0x04), id 0, length 9
17:51:35.667325 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 1, ack 1, length 38: LCP, Conf-Request (0x01), id 1, length 20
17:51:35.667859 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 2, ack 1, length 38: LCP, Conf-Ack (0x02), id 1, length 20
17:51:35.751027 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, ack 2, no-payload, length 12
17:51:37.654174 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 3, length 54: LCP, Conf-Request (0x01), id 2, length 40
17:51:37.654702 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 2, ack 3, length 39: LCP, Conf-Reject (0x04), id 2, length 21
17:51:37.655245 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 4, ack 2, length 43: LCP, Conf-Request (0x01), id 3, length 25
17:51:37.655652 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 3, ack 4, length 43: LCP, Conf-Ack (0x02), id 3, length 25
17:51:37.655711 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 349:373(24) ack 189 win 16378: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(61226) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
17:51:37.655732 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 373 win 8209
17:51:37.655758 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 4, length 32: LCP, Ident (0x0c), id 2, length 20
17:51:37.655799 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 5, length 39: LCP, Ident (0x0c), id 3, length 27
17:51:37.655809 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 6, length 38: LCP, Ident (0x0c), id 4, length 26
17:51:37.656126 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 5, ack 6, length 41: CHAP, Challenge (0x01), id 1, Value bb1e6873002e37ecc29a96360b332a47, Name
17:51:37.661669 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 7, ack 5, length 79: CHAP, Response (0x02), id 1, Value bba9b0964c049082361182be1a473fef0000000000000000d6e1d6db4a9c6d79d7b9c4a09b64fe[|chap]
17:51:37.665028 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 6, ack 7, length 66: CHAP, Success (0x03), id 1, Msg S=328CA8448FB0CDEEFAAC9E72995C43401D4A[|chap]
17:51:37.666392 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 7, length 30: IPCP, Conf-Request (0x01), id 1, length 18
17:51:37.666716 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 8, ack 7, length 32: IP6CP, Conf-Request (0x01), id 5, length 16
17:51:37.666844 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 9, length 24: unknown ctrl-proto (0x80fd), Conf-Request (0x01), id 6, length 12
17:51:37.666959 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 10, length 48: IPCP, Conf-Request (0x01), id 7, length 36
17:51:37.667052 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 11, length 24: IPCP, Conf-Reject (0x04), id 1, length 12
17:51:37.667600 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 8, ack 11, length 40: LCP, Prot-Reject (0x08), id 1, length 22
17:51:37.667632 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 9, length 32: LCP, Prot-Reject (0x08), id 2, length 18
17:51:37.667825 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 10, length 30: IPCP, Conf-Reject (0x04), id 7, length 18
17:51:37.667895 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 11, length 24: IPCP, Conf-Request (0x01), id 2, length 12
17:51:37.668525 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 12, ack 11, length 40: IPCP, Conf-Request (0x01), id 8, length 24
17:51:37.668605 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 13, length 24: IPCP, Conf-Ack (0x02), id 2, length 12
17:51:37.669043 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 12, ack 13, length 40: IPCP, Conf-Nack (0x03), id 8, length 24
17:51:37.669421 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 14, ack 12, length 40: IPCP, Conf-Request (0x01), id 9, length 24
17:51:37.669813 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 13, ack 14, length 40: IPCP, Conf-Ack (0x02), id 9, length 24
17:51:37.670582 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, seq 14, length 18: IPCP, Term-Request (0x05), id 3, length 6
17:51:37.712876 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 15, ack 14, length 88: IP 172.19.28.161.55029 > 91.190.68.2.domain: 60649+[|domain]
17:51:37.737886 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, ack 15, no-payload, length 12
17:51:37.766341 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 16, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:37.767232 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 17, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:37.767322 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 18, length 109: IP 172.19.28.161.netbios-ns > 255.255.255.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
17:51:37.791480 IP 172.16.3.14 > 10.11.4.36: GREv1, call 21690, ack 18, no-payload, length 12
17:51:37.800288 IP 10.11.4.36 > 172.16.3.14: GREv1, call 61226, seq 19, length 18: IPCP, Term-Ack (0x06), id 3, length 6
17:51:37.800499 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 373:389(16) ack 189 win 16378: pptp CTRL_MSGTYPE=CCRQ CALL_ID(21690)
17:51:37.800521 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 389 win 8210
17:51:37.803774 IP 172.16.3.14.pptp > 10.11.4.36.49374: P 189:337(148) ack 389 win 8212: pptp CTRL_MSGTYPE=CDN CALL_ID(61226) RESULT_CODE(4) ERR_CODE(0) CAUSE_CODE(0) [|pptp]
17:51:37.804674 IP 10.11.4.36.49374 > 172.16.3.14.pptp: P 389:405(16) ack 337 win 16341: pptp CTRL_MSGTYPE=StopCCRQ REASON(1)
17:51:37.804697 IP 172.16.3.14.pptp > 10.11.4.36.49374: . ack 405 win 8210
17:51:37.805832 IP 172.16.3.14.pptp > 10.11.4.36.49374: P 337:353(16) ack 405 win 8212: pptp CTRL_MSGTYPE=StopCCRP RESULT_CODE(1) ERR_CODE(0)