2

LAST BREAKTHROUGH -> see the tshark results below for some clue

Hi, at home I have the following setup:

Internet - NAS (Ubuntu 16.04.4 LTS) - LAN (Asus N56U WiFi) - family users. NAS connects using pppoe (ppp0, cable) to Internet while having eth0 (192.168.0.1, cable) to LAN. Asus N56U connects to NAS using static ip 192.168.0.2/255.255.255.0 with DNS 192.168.0.1.

Everything works fine:
NAS & family users access the Internet while Internet access NAS.

I also have another extremely similar router (Asus RT-AC66U) which simply swapping with Asus N56U while keeping same simple settings doesn't work :(. I mean anything that touches the Internet dies though my personal web sites are still accessible from LAN.

I tried this command on NAS (108.177.119.94 is www.google.ro):

sudo tcpdump -AX -vnni eth0 -c 2 dst 108.177.119.94

while running this on routers (I have telnet access to them):

ping -c 2 108.177.119.94

and I get this for N56U:

09:00:47.036839 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.2 > 108.177.119.94: ICMP echo request, id 63814, seq 0, length 64
      0x0000:  4500 0054 0000 4000 4001 95ef c0a8 0002  E..T..@.@.......
      0x0010:  6cb1 775e 0800 d64a f946 0000 7cd9 ab94  l.w^...J.F..|...
      0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0050:  0000 0000                                ....
09:00:48.044176 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.2 > 108.177.119.94: ICMP echo request, id 63814, seq 1, length 64
      0x0000:  4500 0054 0000 4000 4001 95ef c0a8 0002  E..T..@.@.......
      0x0010:  6cb1 775e 0800 95eb f946 0001 ad37 bb94  l.w^.....F...7..
      0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
      0x0050:  0000 0000                                ....

and this for AC66U (the problematic one):

09:07:16.655875 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.2 > 108.177.119.94: ICMP echo request, id 27906, seq 0, length 64
    0x0000:  4500 0054 0000 4000 4001 95ef c0a8 0002  E..T..@.@.......
    0x0010:  6cb1 775e 0800 638c 6d02 0000 de6b 4905  l.w^..c.m....kI.
    0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0050:  0000 0000                                ....
09:07:17.668123 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.2 > 108.177.119.94: ICMP echo request, id 27906, seq 1, length 64
    0x0000:  4500 0054 0000 4000 4001 95ef c0a8 0002  E..T..@.@.......
    0x0010:  6cb1 775e 0800 7e18 6d02 0001 b4de 5805  l.w^..~.m.....X.
    0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0050:  0000 0000                                ....

With N56U I see (using tcpdump) the request travelling from eth0 through ppp0 to Internet and back; with AC66U the above result is all I see (the request is received by eth0 then nothing).

What could possibly be the problem?

EDIT4 (below I pointed a possible problem)

Another way of viewing the above results (already saved as *.pcap files) is with tshark (1th frame only).

For N56U I get:

$tshark -r n56u-eth0-dst.pcap -V
Frame 1: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)
    Encapsulation type: Ethernet (1)
    Arrival Time: May  5, 2018 09:00:47.036839000 EEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1525500047.036839000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 98 bytes (784 bits)
    Capture Length: 98 bytes (784 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:icmp:data]
Ethernet II, Src: Motorola_1b:ed:f2 (98:0c:a5:1b:ed:f2), Dst: AsrockIn_7c:28:bf (d0:50:99:7c:28:bf)
    Destination: AsrockIn_7c:28:bf (d0:50:99:7c:28:bf)
        Address: AsrockIn_7c:28:bf (d0:50:99:7c:28:bf)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Motorola_1b:ed:f2 (98:0c:a5:1b:ed:f2)
        Address: Motorola_1b:ed:f2 (98:0c:a5:1b:ed:f2)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.0.2, Dst: 108.177.119.94
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 84
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: ICMP (1)
    Header checksum: 0x95ef [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.0.2
    Destination: 108.177.119.94
    [Source GeoIP: Unknown]
    [Destination GeoIP: United States, AS15169 Google Inc., Mountain View, CA, 37.419201, -122.057404]
        [Destination GeoIP Country: United States]
        [Destination GeoIP AS Number: AS15169 Google Inc.]
        [Destination GeoIP City: Mountain View, CA]
        [Destination GeoIP Latitude: 37.419201]
        [Destination GeoIP Longitude: -122.057404]
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0xd64a [correct]
    [Checksum Status: Good]
    Identifier (BE): 63814 (0xf946)
    Identifier (LE): 18169 (0x46f9)
    Sequence number (BE): 0 (0x0000)
    Sequence number (LE): 0 (0x0000)
    Data (56 bytes)

0000  7c d9 ab 94 00 00 00 00 00 00 00 00 00 00 00 00   |...............
0010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030  00 00 00 00 00 00 00 00                           ........
        Data: 7cd9ab940000000000000000000000000000000000000000...
        [Length: 56]

For AC66U I get:

$tshark -r ac66u-eth0-dst.pcap -V
Frame 1: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)
    Encapsulation type: Ethernet (1)
    Arrival Time: May  5, 2018 09:07:16.655875000 EEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1525500436.655875000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 98 bytes (784 bits)
    Capture Length: 98 bytes (784 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:icmp:data]
Ethernet II, Src: AsustekC_cb:20:d0 (2c:56:dc:cb:20:d0), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
        Address: Broadcast (ff:ff:ff:ff:ff:ff)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: AsustekC_cb:20:d0 (2c:56:dc:cb:20:d0)
        Address: AsustekC_cb:20:d0 (2c:56:dc:cb:20:d0)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.0.2, Dst: 108.177.119.94
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 84
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: ICMP (1)
    Header checksum: 0x95ef [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.0.2
    Destination: 108.177.119.94
    [Source GeoIP: Unknown]
    [Destination GeoIP: United States, AS15169 Google Inc., Mountain View, CA, 37.419201, -122.057404]
        [Destination GeoIP Country: United States]
        [Destination GeoIP AS Number: AS15169 Google Inc.]
        [Destination GeoIP City: Mountain View, CA]
        [Destination GeoIP Latitude: 37.419201]
        [Destination GeoIP Longitude: -122.057404]
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0x638c [correct]
    [Checksum Status: Good]
    Identifier (BE): 27906 (0x6d02)
    Identifier (LE): 621 (0x026d)
    Sequence number (BE): 0 (0x0000)
    Sequence number (LE): 0 (0x0000)
    Data (56 bytes)

0000  de 6b 49 05 00 00 00 00 00 00 00 00 00 00 00 00   .kI.............
0010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030  00 00 00 00 00 00 00 00                           ........
        Data: de6b49050000000000000000000000000000000000000000...
        [Length: 56]

I guess the section (for AC66U):

Destination: Broadcast (ff:ff:ff:ff:ff:ff)

might signal a problem? Any clue about it?

  • What is the operation mode on your ASUS devices? Should show on the home page up top (at least, it does on my RT-AC56U) or be under Administration → Operation Mode. Also, what does tcpdump say without --direction=in (or alternatively, with inout). Also, the same on the ppp0 interface, to see if the packets are going through the NAS or not. – derobert May 2 '18 at 20:07
  • The operation mode is Wireless router mode (the default mode). Both routers have all setting besides the WAN with factory defaults. When changing RT-AC66U WAN to pppoe connection it connects to Internet and works fine. I'll try in the evening with tcpdump as you suggested. For the command: ping -c 1 -s 1472 -I eth0 192.168.0.1 both routers yield same result. Same happens for e.g. ping -c 1 -s 1550 -I eth0 192.168.0.1 which of course means more than 1 tcp packet. – adrhc May 3 '18 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.