Connected, with Critters

[JT Strickland]

I think this may be part of it
14:06:31.898353 IP xxx.xxx.xxx.xxx.xxxxx > unn-45-134-140-17.datapacket.com.4500: UDP-encap: ESP(spi=0xc2eef460,seq=0x220), length 152
14:06:31.898366 IP xxx.xxx.xxx.xxx.xxxxx> unn-45-134-140-17.datapacket.com.4500: UDP-encap: ESP(spi=0xc2eef460,seq=0x221), length 104
14:06:31.898375 IP xxx.xxx.xxx.xxx.xxxxx > unn-45-134-140-17.datapacket.com.4500: UDP-encap: ESP(spi=0xc2eef460,seq=0x222), length 1320
14:06:31.898384 IP xxx.xxx.xxx.xxx.xxxxx > unn-45-134-140-17.datapacket.com.4500: UDP-encap: ESP(spi=0xc2eef460,seq=0x223), length 728

 

[ColinTaylor]

I've got 100 packets now, what should I look for or post? I don't really want to air all of my dirty laundry on a public forum.

As we have no idea what the problem is I would capture all traffic to a file and then examine that file in Wireshark. Then look for errors related to the Ethernet header.

For example:

tcpdump -i eth0 -s0 -U -w capture.pcap

P.S. What is your WAN connection type? Is it PPPoE?

 

[JT Strickland]

As we have no idea what the problem is I would capture all traffic to a file and then examine that file in Wireshark. Then look for errors related to the Ethernet header.

For example:

tcpdump -i eth0 -s0 -U -w capture.pcap

P.S. What is your WAN connection type? Is it PPPoE?

OK, static IP

 

[JT Strickland]

How long should I let it run, and how do I stop the file dump?

 

[ColinTaylor]

How long should I let it run, and how do I stop the file dump?

I got the impression that these messages were constantly flooding the log. In which case you just need to run it for long enough to capture a bunch of them. Press Control-C to stop the capture.

 

[JT Strickland]

I got the impression that these messages were constantly flooding the log. In which case you just need to run it for long enough to capture a bunch of them. Press Control-C to stop the capture.

Oh, OK, I thought you meant like for a day or two. I thought it might fill up my router memory after a while. I'll let it run for a while from the console then.

 

[JT Strickland]

It returned

tcpdump: capture.pcap: Read-only file system

 

[ColinTaylor]

It returned
tcpdump: capture.pcap: Read-only file system

Obviously you have to place the output file on some writable filesystem, like the USB drive.

 

[JT Strickland]

Obviously you have to place the output file on some writable filesystem, like the USB drive.

Sorry, this is new to me. How do I specify the usb drive in the code? I have a 220 Gb SSD attached.
Looks like /dev/sda1/USB4AWM from the disk check utility

 

[Suzib6sw]

OK, I had included the prompt (#) in my code. That's why it didn't run.
I've got 100 packets now, what should I look for or post? I don't really want to air all of my dirty laundry on a public forum.

I though this had been discussed before.. The issue has been there for a long time in Asus's code. Turn off Guest 1 and turn on Guest 2 instead
]

 

[JT Strickland]

I though this had been discussed before.. The issue has been there for a long time in Asus's code. Turn off Guest 1 and turn on Guest 2 instead
]

Guest network 1 is disabled, 2 is the only active guest network.

 

[Tech9]

I though this had been discussed before

The same error log comes in different conditions, perhaps GN1 is one of them. This is what it looks like in log server on AC86U, latest available Asuswrt 45956, IPv6 + NAT acceleration, no GN used. Note the time, multiple per second. Most are 0000, some 0800. The syslog flows like a river.

 

[JT Strickland]

me too

 

[JT Strickland]

I've got a few thousand packets captured and opened the file in wireguard, but I don't have a clue what I'm looking at.
Like Colin Taylor said, I probably can't do anything about it even if I knew what was triggering it.