Host 1 (direct connect to router) tcpdump -n -e -ttt -i pflog0 tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes 000000 rule 0/0(match): block in on bge0: 60.224.185.113.4461 > 72.232.135.90.80: F 1036924808:1036924808(0) ack 1855180894 win 65535 000346 rule 0/0(match): block in on bge0: 60.224.185.113.4462 > 72.232.135.90.80: F 838861239:838861239(0) ack 471144513 win 65535 9. 294620 rule 0/0(match): block in on bge0: 218.26.191.171.1494 > 72.232.135.94.1434: UDP, length 376 76. 182089 rule 0/0(match): block in on bge0: 71.235.215.13.2716 > 72.232.135.90.80: R 2097572890:2097572890(0) ack 97795372 win 0 008004 rule 0/0(match): block in on bge0: 71.235.215.13.2715 > 72.232.135.90.80: R 1805995146:1805995146(0) ack 3071870860 win 0 44. 411373 rule 0/0(match): block in on bge0: 60.224.185.113.4474 > 72.232.135.90.80: R 533606115:533606115(0) ack 2253533851 win 0 112. 739967 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 72.232.135.94.53: 22016% [1au][|domain] 000022 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 72.232.135.94.53: 11008% [1au][|domain] 000106 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 72.232.135.94.53: 51853% [1au][|domain] 000157 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 72.232.135.94.53: 35757% [1au][|domain] 1. 209684 rule 0/0(match): block in on bge0: 67.32.118.46.38189 > 72.232.135.94.53: 42349 [1au][|domain] 771114 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 72.232.135.94.53: 41394 [1au][|domain] 99. 474278 rule 0/0(match): block in on bge0: 202.100.109.213.1332 > 72.232.135.90.1434: UDP, length 376 740. 225307 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 72.232.135.90.1026: UDP, length 421 000362 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 72.232.135.91.1027: UDP, length 421 000342 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 72.232.135.90.1027: UDP, length 421 000498 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 72.232.135.94.1027: UDP, length 421 000342 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 72.232.135.94.1026: UDP, length 421 q^C 18 packets captured 18 packets received by filter 0 packets dropped by kernel Host 2 (pppoe via mpd) tcpdump -etttti pflog0 tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 68 bytes 2007-03-19 08:19:35.242979 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:36.252372 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:37.262760 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:38.272179 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:39.283060 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:40.293969 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:41.303382 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:42.313291 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:43.322976 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:44.323519 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:45.333175 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:46.343322 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:47.342637 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:48.353287 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:49.363422 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:49.815579 rule 5/0(match): block in on ng0: 28.253.227.137 > 68.249.177.115: [|udp] 2007-03-19 08:19:50.372605 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:51.383244 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:52.392666 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:53.403300 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp] 2007-03-19 08:19:54.412479 rule 1/0(match): block in on ng0: access.savagedata.net > 68.249.177.115: [|icmp]