Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] auto #141

Open
ops244 opened this issue Dec 21, 2024 · 21 comments
Open

[BUG] auto #141

ops244 opened this issue Dec 21, 2024 · 21 comments

Comments

@ops244
Copy link

ops244 commented Dec 21, 2024

Опишите проблему
не работает режим auto, другие работают

Модель маршрутизатора
hopper se

Провайдер
mts

Выполните команды и приложите их вывод
opkg info nfqws-keenetic

Package: nfqws-keenetic
Version: 2.6.6
Depends: iptables, busybox
Conflicts: tpws-keenetic
Status: install user installed
Section: net
Architecture: aarch64-3.10
Size: 117666
Filename: nfqws-keenetic_2.6.6_aarch64-3.10.ipk
Conffiles:
 /opt/etc/nfqws/nfqws.conf d897b5561e5f36b8dc0304f407eef540157f76fc2789dfe61ed17af3c2d486ad
 /opt/etc/nfqws/user.list 45dc2adaa172b86d73369c6ed12a8a0e648b851b66293b11514c3b1d4bd3fce6
 /opt/etc/nfqws/auto.list e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 /opt/etc/nfqws/exclude.list 3ffc3588b7ed7f4585a6563b186d6e57c0d19ba1276f6b8ec595ce015b1da562
Description: NFQWS service
Installed-Time: 1734803282

/opt/etc/init.d/S51nfqws restart

Stopping NFQWS service...
Policy 'nfqws' not found. All traffic will be processed.
github version v69.7 (594e613fcb3669e377d1f564873e15459dc5f229)

we have 3 user defined desync profile(s) and default low priority profile 0
Loading hostlist /opt/etc/nfqws/exclude.list
loading plain text list
Loaded 35 hosts from /opt/etc/nfqws/exclude.list
Loading hostlist /opt/etc/nfqws/auto.list
loading plain text list
Loaded 0 hosts from /opt/etc/nfqws/auto.list
Loading hostlist /opt/etc/nfqws/user.list
loading plain text list
Loaded 15 hosts from /opt/etc/nfqws/user.list
Started NFQWS service

cat /opt/etc/nfqws/nfqws.conf

# Provider network interface, e.g. eth3
# You can specify multiple interfaces separated by space, e.g. ISP_INTERFACE="et                                                h3 nwg1"
ISP_INTERFACE="eth3"

# All arguments here: https://github.com/bol-van/zapret (search for `nfqws` on t                                                he page)
# HTTP(S) strategy
NFQWS_ARGS="--dpi-desync=fake,multisplit --dpi-desync-split-pos=1,midsld --dpi-d                                                esync-ttl=0 --dpi-desync-repeats=16 --dpi-desync-fooling=badseq,md5sig --dpi-des                                                ync-fake-tls=/opt/etc/nfqws/tls_clienthello.bin"

# QUIC strategy
NFQWS_ARGS_QUIC="--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --dp                                                i-desync-fake-quic=/opt/etc/nfqws/quic_initial.bin"

# UDP strategy (doesn't use lists from NFQWS_EXTRA_ARGS)
NFQWS_ARGS_UDP="--filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-prot                                                ocol --dpi-desync-repeats=6 --dpi-desync-cutoff=n2"

# auto - automatically detects blocked resources and adds them to the auto.list
NFQWS_EXTRA_ARGS="--hostlist=/opt/etc/nfqws/user.list --hostlist-auto=/opt/etc/n                                                fqws/auto.list --hostlist-auto-debug=/opt/var/log/nfqws.log --hostlist-exclude=/                                                opt/etc/nfqws/exclude.list"

# list - applies rules only to domains in the user.list
#NFQWS_EXTRA_ARGS="--hostlist=/opt/etc/nfqws/user.list"

# all  - applies rules to all traffic except domains from exclude.list
#NFQWS_EXTRA_ARGS="--hostlist-exclude=/opt/etc/nfqws/exclude.list"

# IPv6 support
IPV6_ENABLED=0

# TCP ports for iptables rules
TCP_PORTS=443

# UDP ports for iptables rules
UDP_PORTS=443,50000:50099

# Keenetic policy name
POLICY_NAME="nfqws"

# Syslog logging level (0 - silent, 1 - debug)
LOG_LEVEL=0

NFQUEUE_NUM=200
USER=nobody
CONFIG_VERSION=5

ps | grep nfqws

 5070 nobody     664 S    /opt/usr/bin/nfqws --daemon --pidfile=/opt/var/run/n
 5189 root      5976 S    grep nfqws

iptables-save | grep 200

-A POSTROUTING -o eth3 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth3 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass

sysctl net.netfilter.nf_conntrack_checksum

net.netfilter.nf_conntrack_checksum = 0
@ops244 ops244 changed the title [BUG] [BUG] auto Dec 21, 2024
@Anonym-tsk
Copy link
Owner

А что не работает то? Домены из user.list работают?

@ops244
Copy link
Author

ops244 commented Dec 21, 2024

Если вручную прописать, то работает, сам не прописывает

@vemneyy
Copy link

vemneyy commented Jan 2, 2025

Такая же шняга на Viva. Причём если брать с bol-van/zapret, то такой проблемы не наблюдается. Проблема именно с этой репой

@Anonym-tsk
Copy link
Owner

Подбирайте стратегию, она может отличаться у разных провайдеров.

@Anonym-tsk Anonym-tsk closed this as not planned Won't fix, can't repro, duplicate, stale Jan 7, 2025
@vemneyy
Copy link

vemneyy commented Jan 7, 2025

Проблема не в стратегии. С user-листами всё функционирует корректно, но при переключении на auto это работает некорректно. Домены тупо в дебаг логе не отображаются

@Anonym-tsk
Copy link
Owner

Так бывает. Некоторые правила в стратегии могут влиять на определение недоступных ресурсов. В частности, у меня такое было с cutoff

@vemneyy
Copy link

vemneyy commented Jan 7, 2025

Но постойте. Ровно с такой же стратегией с bol-van/zapret всё работает прекрасно. Ничего плохого про ваш проект не говорю, но это явно странно, что только с вашим форком такое наблюдается

@Anonym-tsk
Copy link
Owner

Ну я даже не знаю. Конфиг тут обрезанный. Выложите полностью?

@ops244
Copy link
Author

ops244 commented Jan 7, 2025

Получается это у вас конфиг обрезанный, он полный

@ops244
Copy link
Author

ops244 commented Jan 7, 2025

или мотните конфиг вправо, я не виноват, что тут так вставляется (если вы это имеете ввиду)
прекрасная причина для закрытия бага - "ну я даже не знаю"

@Anonym-tsk
Copy link
Owner

Приложите содержимое /opt/var/log/nfqws.log

@vemneyy
Copy link

vemneyy commented Jan 7, 2025 •
edited
Loading

Лог прям пустой. В него ничего не пишется. Вот прям совсем пустой. Сервис запускается успешно:

Stopping NFQWS service...
Policy 'nfqws' not found. All traffic will be processed.
github version v69.7 (594e613fcb3669e377d1f564873e15459dc5f229)

we have 3 user defined desync profile(s) and default low priority profile 0
Loading hostlist /opt/etc/nfqws/exclude.list
loading plain text list
Loaded 35 hosts from /opt/etc/nfqws/exclude.list
Loading hostlist /opt/etc/nfqws/auto.list
loading plain text list
Loaded 0 hosts from /opt/etc/nfqws/auto.list
Started NFQWS service

Но лог пустой, как пустыня

@Anonym-tsk
Copy link
Owner

В конфиге включите LOG_LEVEL=1
Перезапустите nfqws
Подключитесь в cli роутера, введите show log
Попробуйте браузером заходить на ресурсы, которых нет в листах
Пришлите лог из терминала

@Anonym-tsk Anonym-tsk reopened this Jan 7, 2025
@vemneyy
Copy link

vemneyy commented Jan 8, 2025 

I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: play.google.com
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for play.google.com : positive
I [Jan  8 19:11:37] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:37] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:37] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2483 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2484 len=40 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.42 proto=tcp ttl=127 sport=59059 dport=443 flags=A seq=39085220
                    ack_seq=1829282607
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2484 pass unmodified
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2485 len=1452 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.42 proto=tcp ttl=127 sport=59059 dport=443 flags=A seq=39085220
                    ack_seq=1829282607
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 CC 01 00 06 C8 03 03 47 66 0F C7 3F F2 67 02 EE 9C E5 F2 AD CE FB 11 EB DA B0 F3
                    EF ... : ...........Gf..?.g.............. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: starting reassemble. now we have 1412/1745
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 39085220-39086631
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2485 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2486 len=373 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.42 proto=tcp ttl=127 sport=59059 dport=443 flags=AP seq=39086632
                    ack_seq=1829282607
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=333 : D8 7B AB 27 26 8E CC C4 D9 33 2A 84 B2 94 4E 77 C3 CA 8B 41 F2 45 0B E1 4C 19 7F F0 5C 58 FB C8
                    ... : .{.'&....3*...Nw...A.E..L.\X.. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: reassemble : feeding data payload size=333. now we have 1745/1745
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 39085220-39086964
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.42 proto=tcp ttl=127 sport=59059 dport=443 flags=A seq=39085220
                    ack_seq=1829282607
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 CC 01 00 06 C8 03 03 47 66 0F C7 3F F2 67 02 EE 9C E5 F2 AD CE FB 11 EB DA B0 F3
                    EF ... : ...........Gf..?.g.............. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: optimizationguide-pa.googleapis.com
I [Jan  8 19:11:37] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:37] nfqws[6060]: discovered hostname
I [Jan  8 19:11:37] nfqws[6060]: desync profile search for tcp target=142.250.74.42:443 l7proto=tls hostname='optimizationguide-
                    pa.googleapis.com'
I [Jan  8 19:11:37] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : positive
I [Jan  8 19:11:37] nfqws[6060]: dpi desync src=10.155.3.127:59059 dst=142.250.74.42:443
I [Jan  8 19:11:37] nfqws[6060]: multisplit pos: 1 1681
I [Jan  8 19:11:37] nfqws[6060]: normalized multisplit pos: 1
I [Jan  8 19:11:37] nfqws[6060]: sending fake : 16 03 01 02 87 01 00 02 83 03 03 5F 15 63 CB 06 EA 1C DD 40 76 F5 8C 44 50 6E 01 F3 A3 83 AC C2
                    ... : [email protected]...... ...
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 1 0-0 len=1 seqovl=0 : 16 : .
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 2 1-1411 len=1411 seqovl=0 : 03 01 06 CC 01 00 06 C8 03 03 47 66 0F C7 3F F2 67 02 EE
                    9C E5 F2 AD CE FB 11 EB DA B0 F3 EF DE ... : ..........Gf..?.g............... ...
I [Jan  8 19:11:37] nfqws[6060]: DROPPING delayed packet #1
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #2 offset 1412
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.42 proto=tcp ttl=127 sport=59059 dport=443 flags=AP seq=39086632
                    ack_seq=1829282607
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=333 : D8 7B AB 27 26 8E CC C4 D9 33 2A 84 B2 94 4E 77 C3 CA 8B 41 F2 45 0B E1 4C 19 7F F0 5C 58 FB C8
                    ... : .{.'&....3*...Nw...A.E..L.\X.. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: optimizationguide-pa.googleapis.com
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for optimizationguide-pa.googleapis.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for googleapis.com : positive
I [Jan  8 19:11:37] nfqws[6060]: dpi desync src=10.155.3.127:59059 dst=142.250.74.42:443
I [Jan  8 19:11:37] nfqws[6060]: multisplit pos: 1 1681
I [Jan  8 19:11:37] nfqws[6060]: normalized multisplit pos: 269
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 1 0-268 len=269 seqovl=0 : D8 7B AB 27 26 8E CC C4 D9 33 2A 84 B2 94 4E 77 C3 CA 8B 41
                    F2 45 0B E1 4C 19 7F F0 5C 58 FB C8 ... : .{.'&....3*...Nw...A.E..L.\X.. ...
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 2 269-332 len=64 seqovl=0 : 65 61 70 69 73 2E 63 6F 6D 00 12 00 00 00 10 00 0E 00 0C
                    02 68 32 08 68 74 74 70 2F 31 2E 31 00 ... : eapis.com...........h2.http/1.1. ...
I [Jan  8 19:11:37] nfqws[6060]: DROPPING delayed packet #2
I [Jan  8 19:11:37] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2486 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2487 len=40 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=A seq=2914958496
                    ack_seq=781453184
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2487 pass unmodified
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2488 len=1452 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=A seq=2914958496
                    ack_seq=781453184
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 B8 01 00 06 B4 03 03 C7 D6 E7 A5 2E 62 A0 AB 36 5A DB 62 61 1C 3F 4B 3E 46 EB F8
                    0F ... : ................b..6Z.ba.?K>F... ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: starting reassemble. now we have 1412/1725
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 2914958496-2914959907
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2488 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2489 len=353 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=AP seq=2914959908
                    ack_seq=781453184
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=313 : 67 6C 65 2E 63 6F 6D 00 1B 00 03 02 00 02 00 2B 00 07 06 0A 0A 03 04 03 03 00 17 00 00 44 69 00
                    ... : gle.com........+.............Di. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: reassemble : feeding data payload size=313. now we have 1725/1725
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 2914958496-2914960220
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=A seq=2914958496
                    ack_seq=781453184
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 B8 01 00 06 B4 03 03 C7 D6 E7 A5 2E 62 A0 AB 36 5A DB 62 61 1C 3F 4B 3E 46 EB F8
                    0F ... : ................b..6Z.ba.?K>F... ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: play.google.com
I [Jan  8 19:11:37] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:37] nfqws[6060]: discovered hostname
I [Jan  8 19:11:37] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=tls hostname='play.google.com'
I [Jan  8 19:11:37] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for play.google.com : positive
I [Jan  8 19:11:37] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:37] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #2 offset 1412
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=AP seq=2914959908
                    ack_seq=781453184
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=313 : 67 6C 65 2E 63 6F 6D 00 1B 00 03 02 00 02 00 2B 00 07 06 0A 0A 03 04 03 03 00 17 00 00 44 69 00
                    ... : gle.com........+.............Di. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: play.google.com
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for play.google.com : positive
I [Jan  8 19:11:37] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:37] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:37] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2489 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2490 len=40 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.78 proto=tcp ttl=127 sport=59061 dport=443 flags=A seq=1018148504
                    ack_seq=539742404
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2490 pass unmodified
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2491 len=1452 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.78 proto=tcp ttl=127 sport=59061 dport=443 flags=A seq=1018148504
                    ack_seq=539742404
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 E3 01 00 06 DF 03 03 0D AA BD E6 78 0F 9A 7E 97 75 AC 2E A8 98 6A 3D 7D C0 09 31
                    9C ... : ...............x..~.u....j=}..1. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: starting reassemble. now we have 1412/1768
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 1018148504-1018149915
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2491 drop
I [Jan  8 19:11:37] nfqws[6060]: packet: id=2492 len=396 mark=00000000
I [Jan  8 19:11:37] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.78 proto=tcp ttl=127 sport=59061 dport=443 flags=AP seq=1018149916
                    ack_seq=539742404
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=356 : FC 95 7D FA BE AD 56 10 AC 54 B8 29 60 C6 C7 62 1F FD 09 AB F0 76 AF 07 55 2D 2D 30 4E 86 44 49
                    ... : ..}...V..T.)`..b.....v..U--0N.DI ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: reassemble : feeding data payload size=356. now we have 1768/1768
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: req retrans : seq interval 1018148504-1018150271
I [Jan  8 19:11:37] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.78 proto=tcp ttl=127 sport=59061 dport=443 flags=A seq=1018148504
                    ack_seq=539742404
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=1412 : 16 03 01 06 E3 01 00 06 DF 03 03 0D AA BD E6 78 0F 9A 7E 97 75 AC 2E A8 98 6A 3D 7D C0 09 31
                    9C ... : ...............x..~.u....j=}..1. ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: encrypted-tbn0.gstatic.com
I [Jan  8 19:11:37] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:37] nfqws[6060]: discovered hostname
I [Jan  8 19:11:37] nfqws[6060]: desync profile search for tcp target=142.250.74.78:443 l7proto=tls hostname='encrypted-tbn0.gstatic.com'
I [Jan  8 19:11:37] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for gstatic.com : positive
I [Jan  8 19:11:37] nfqws[6060]: dpi desync src=10.155.3.127:59061 dst=142.250.74.78:443
I [Jan  8 19:11:37] nfqws[6060]: multisplit pos: 1 427
I [Jan  8 19:11:37] nfqws[6060]: normalized multisplit pos: 1 427
I [Jan  8 19:11:37] nfqws[6060]: sending fake : 16 03 01 02 87 01 00 02 83 03 03 5F 15 63 CB 06 EA 1C DD 40 76 F5 8C 44 50 6E 01 F3 A3 83 AC C2
                    ... : [email protected]...... ...
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 1 0-0 len=1 seqovl=0 : 16 : .
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 2 1-426 len=426 seqovl=0 : 03 01 06 E3 01 00 06 DF 03 03 0D AA BD E6 78 0F 9A 7E 97 75
                    AC 2E A8 98 6A 3D 7D C0 09 31 9C CE ... : ..............x..~.u....j=}..1.. ...
I [Jan  8 19:11:37] nfqws[6060]: sending multisplit part 3 427-1411 len=985 seqovl=0 : 61 74 69 63 2E 63 6F 6D 00 0A 00 0C 00 0A 4A 4A 11 EC 00
                    1D 00 17 00 18 00 0B 00 02 01 00 00 23 ... : atic.com......JJ...............# ...
I [Jan  8 19:11:37] nfqws[6060]: DROPPING delayed packet #1
I [Jan  8 19:11:37] nfqws[6060]: REPLAYING delayed packet #2 offset 1412
I [Jan  8 19:11:37] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.78 proto=tcp ttl=127 sport=59061 dport=443 flags=AP seq=1018149916
                    ack_seq=539742404
I [Jan  8 19:11:37] nfqws[6060]: TCP: len=356 : FC 95 7D FA BE AD 56 10 AC 54 B8 29 60 C6 C7 62 1F FD 09 AB F0 76 AF 07 55 2D 2D 30 4E 86 44 49
                    ... : ..}...V..T.)`..b.....v..U--0N.DI ...
I [Jan  8 19:11:37] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:37] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:37] nfqws[6060]: hostname: encrypted-tbn0.gstatic.com
I [Jan  8 19:11:37] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:37] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for gstatic.com : negative
I [Jan  8 19:11:37] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for gstatic.com : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for encrypted-tbn0.gstatic.com : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for gstatic.com : positive
I [Jan  8 19:11:49] nfqws[6060]: dpi desync src=10.155.3.127:59061 dst=142.250.74.78:443
I [Jan  8 19:11:49] nfqws[6060]: multisplit pos: 1 427
I [Jan  8 19:11:49] nfqws[6060]: all multisplit pos are outside of this packet
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:49] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2492 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2493 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=A seq=3487439931
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2493 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2494 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=A seq=3487439931
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 07 12 01 00 07 0E 03 03 BB 82 57 EC 49 45 29 32 23 04 7F CD 24 CA 2F 77 4D B2 C3 D5
                    2D ... : .............W.IE)2#.$./wM...- ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1400/1815
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 3487439931-3487441330
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2494 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2495 len=455 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=AP seq=3487441331
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=415 : 70 80 5C 00 0B 00 02 01 00 FF 01 00 01 00 00 17 00 00 00 1B 00 03 02 00 02 00 2D 00 02 01 01 00
                    ... : p.\.......................-..... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: reassemble : feeding data payload size=415. now we have 1815/1815
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 3487439931-3487441745
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=A seq=3487439931
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 07 12 01 00 07 0E 03 03 BB 82 57 EC 49 45 29 32 23 04 7F CD 24 CA 2F 77 4D B2 C3 D5
                    2D ... : .............W.IE)2#.$./wM...- ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:49] nfqws[6060]: discovered hostname
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.0.79:443 l7proto=tls hostname='meduza.io'
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #2 offset 1400
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=AP seq=3487441331
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=415 : 70 80 5C 00 0B 00 02 01 00 FF 01 00 01 00 00 17 00 00 00 1B 00 03 02 00 02 00 2D 00 02 01 01 00
                    ... : p.\.......................-..... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:49] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2495 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2496 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59051 dport=443 flags=A seq=47297881
                    ack_seq=621801296
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2496 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2497 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59051 dport=443 flags=A seq=47297881
                    ack_seq=621801296
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 06 D2 01 00 06 CE 03 03 58 7B EC DB 34 17 CE 5F 0F 42 1A 88 EA 73 39 FB 2A DA B1 AE
                    BD ... : ...........X{..4.._.B...s9.*.... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1400/1751
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 47297881-47299280
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2497 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2498 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59051 dport=443 flags=A seq=47299281
                    ack_seq=621801296
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2498 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2499 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=A seq=3487441746
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2499 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2500 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=S seq=1112804385 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2500 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2501 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=S seq=344898196 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2501 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2502 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=S seq=1112804385 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2502 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2503 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=S seq=3077457736 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=142.250.74.74:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2503 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2504 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=AP seq=2914958809
                    ack_seq=781453184
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : 50 50 3D 60 35 A3 05 01 A4 D6 B0 1D 43 55 8D F1 50 24 D1 B5 15 76 FB 0A B3 C6 29 3B 48 02 58
                    98 ... : PP=`5.......CU..P$...v....);H.X. ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2504 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2505 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59056 dport=443 flags=AP seq=1425416436
                    ack_seq=1319579142
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : BD C1 72 8A 00 0A 00 0C 00 0A AA AA 11 EC 00 1D 00 17 00 18 00 05 00 05 01 00 00 00 00 00 23
                    00 ... : ..r...........................#. ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2505 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2506 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=S seq=344898196 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2506 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2507 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=S seq=4135589328 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=142.250.74.74:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2507 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2508 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59048 dport=443 flags=S seq=2469589255 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2508 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2509 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59047 dport=443 flags=S seq=2397293546 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2509 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2510 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=S seq=3077457736 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2510 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2511 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=S seq=4135589328 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2511 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2512 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59051 dport=443 flags=AP seq=47298232
                    ack_seq=621801296
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 00 0E 00 0C 00 00 09 6D 65 64 75 7A 61 2E 69 6F 00 12 00 00 00 0B 00 02 01 00 44 69 00 05 00
                    03 ... : .......meduza.io..........Di.... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: reassemble session failed
I [Jan  8 19:11:49] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:11:49] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.0.79:443 l7proto=tls hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2512 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2513 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.4 => 157.240.252.63 proto=tcp ttl=63 sport=44180 dport=443 flags=S seq=3169766953 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2513 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2514 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=S seq=1112804385 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2514 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2515 len=71 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.113 => 94.139.252.232 proto=tcp ttl=63 sport=42172 dport=443 flags=AP seq=2617758942
                    ack_seq=3426818476
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=31 : 15 03 03 00 1A 00 00 00 00 00 00 00 02 00 90 FE 97 60 43 63 10 EE CE F5 07 59 73 9D 31 83 7B :
                    .................`Cc.....Ys.1.{
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=94.139.252.232:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2515 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2516 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=S seq=344898196 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2516 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2517 len=76 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.113 => 87.242.88.120 proto=tcp ttl=63 sport=47850 dport=443 flags=AP seq=2563100754
                    ack_seq=367048455
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=24 : 17 03 03 00 13 F2 4D 23 AC 51 D9 7F 98 57 9D C0 14 12 A8 B8 F4 59 33 8C :
                    ......M#.Q.W.......Y3.
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=87.242.88.120:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2517 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2518 len=71 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.113 => 94.139.252.232 proto=tcp ttl=63 sport=42170 dport=443 flags=AP seq=853203520
                    ack_seq=2598701703
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=31 : 15 03 03 00 1A 00 00 00 00 00 00 00 04 42 E3 5C 18 B8 7F 48 6F C0 99 1B 41 AD 2E DD C0 EF 45 :
                    .............B.\.Ho...A.....E
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=94.139.252.232:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2518 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2519 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59062 dport=443 flags=AP seq=3487440346
                    ack_seq=739126154
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 76 38 14 FC B7 47 ED 33 62 F2 28 C6 0C E4 A4 53 79 3C 9F 76 8F 5A CA 28 F3 77 2A AD 0C 88 0B
                    55 ... : v8...G.3b.(....Sy<.v.Z.(.w*....U ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: req retrans counter : 1/3
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2519 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2520 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=S seq=1001972696 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.0.79:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2520 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2521 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=S seq=3077457736 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2521 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2522 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=S seq=4135589328 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2522 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2523 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59056 dport=443 flags=A seq=1425416059
                    ack_seq=1319579142
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : 16 03 01 06 F8 01 00 06 F4 03 03 CD 08 0E 50 9E 30 20 DC A0 6F D6 9C 63 3F 69 7F A1 6C 34 FA
                    5B ... : ..............P.0 ..o..c?.l4.[ ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to TLS ClientHello without hostname in the SNI
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2523 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2524 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59060 dport=443 flags=A seq=2914958496
                    ack_seq=781453184
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : 16 03 01 06 B8 01 00 06 B4 03 03 C7 D6 E7 A5 2E 62 A0 AB 36 5A DB 62 61 1C 3F 4B 3E 46 EB F8
                    0F ... : ................b..6Z.ba.?K>F... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to TLS ClientHello without hostname in the SNI
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2524 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2525 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2525 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2526 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=S seq=1001972696 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2526 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2527 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2527 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2528 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2528 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2529 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=S seq=1001972696 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2529 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2530 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=S seq=1112804385 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2530 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2531 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=S seq=344898196 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2531 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2532 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2532 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2533 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=S seq=3638536495 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.1.79:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2533 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2534 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=S seq=323991159 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.1.79:443 l7proto=unknown hostname=''
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2534 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2535 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=S seq=3077457736 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2535 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2536 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=S seq=4135589328 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2536 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2537 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2537 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2538 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=S seq=3638536495 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2538 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2539 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=S seq=323991159 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2539 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2540 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=A seq=3077457737
                    ack_seq=461683310
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2540 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2541 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=A seq=3077457737
                    ack_seq=461683310
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : 16 03 01 07 00 01 00 06 FC 03 03 B3 63 D0 20 DB 77 7F 1C 8F 7D E3 E5 D8 77 E8 9D 1E 4C 13 2A
                    71 ... : ............c. ...}...w...L.*q ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1412/1797
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 3077457737-3077459148
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2541 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2542 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=A seq=4135589329
                    ack_seq=1623861782
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2542 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2543 len=1452 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=A seq=4135589329
                    ack_seq=1623861782
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1412 : 16 03 01 07 20 01 00 07 1C 03 03 B5 AA F0 B2 DE B8 C0 51 23 44 55 B8 F4 54 ED 54 A6 9D 82 FA
                    5E ... : .... .............Q#DU..T.T....^ ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1412/1829
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 4135589329-4135590740
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2543 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2544 len=60 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=S seq=1133477205 ack_seq=0
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2544 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2545 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=A seq=1133477206
                    ack_seq=3394658999
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2545 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2546 len=569 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=AP seq=1133477206
                    ack_seq=3394658999
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 4B A2 34 2E 89 BB E8 2A 63 B8 40 61 E6 10 6C 7A BA 9A BD B8 AF
                    ... : ...........K.4....*[email protected]..... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 1133477206-1133477722
I [Jan  8 19:11:49] nfqws[6060]: hostname: api.telegram.org
I [Jan  8 19:11:49] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:49] nfqws[6060]: discovered hostname
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=tls hostname='api.telegram.org'
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for api.telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2546 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2547 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=A seq=3638536496
                    ack_seq=1727567524
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2547 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2548 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=A seq=3638536496
                    ack_seq=1727567524
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 07 12 01 00 07 0E 03 03 89 A4 04 53 81 72 F5 DE 18 94 7A 7A 48 92 D0 FA F6 AF D7 A1
                    D1 ... : ..............S.r....zzH........ ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1400/1815
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 3638536496-3638537895
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2548 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2549 len=455 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=AP seq=3638537896
                    ack_seq=1727567524
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=415 : 3B 80 A6 C2 02 D0 1A 74 74 7A E0 2D 22 39 4F CF 60 4B A7 0D 4E C7 18 48 8F 70 FF FC FC 7C 6D C6
                    ... : ;......ttz.-"9O.`K..N..H.p...|m. ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: reassemble : feeding data payload size=415. now we have 1815/1815
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 3638536496-3638538310
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=A seq=3638536496
                    ack_seq=1727567524
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 07 12 01 00 07 0E 03 03 89 A4 04 53 81 72 F5 DE 18 94 7A 7A 48 92 D0 FA F6 AF D7 A1
                    D1 ... : ..............S.r....zzH........ ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:49] nfqws[6060]: discovered hostname
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.1.79:443 l7proto=tls hostname='meduza.io'
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #2 offset 1400
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59076 dport=443 flags=AP seq=3638537896
                    ack_seq=1727567524
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=415 : 3B 80 A6 C2 02 D0 1A 74 74 7A E0 2D 22 39 4F CF 60 4B A7 0D 4E C7 18 48 8F 70 FF FC FC 7C 6D C6
                    ... : ;......ttz.-"9O.`K..N..H.p...|m. ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:49] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2549 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2550 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=A seq=1133477723
                    ack_seq=3394658999
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2550 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2551 len=40 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=A seq=323991160
                    ack_seq=114470186
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2551 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2552 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=A seq=323991160
                    ack_seq=114470186
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 06 B2 01 00 06 AE 03 03 E7 D1 36 DE 15 8D A0 C8 1A 96 88 DE 8E 4C B3 B8 60 7E 82 22
                    97 ... : .............6..........L..`~.". ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1400/1719
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 323991160-323992559
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2552 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2553 len=359 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=AP seq=323992560
                    ack_seq=114470186
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=319 : 74 74 70 2F 31 2E 31 00 2D 00 02 01 01 00 0A 00 0C 00 0A 0A 0A 11 EC 00 1D 00 17 00 18 FE 0D 00
                    ... : ttp/1.1.-....................... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: reassemble : feeding data payload size=319. now we have 1719/1719
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 323991160-323992878
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=A seq=323991160
                    ack_seq=114470186
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 06 B2 01 00 06 AE 03 03 E7 D1 36 DE 15 8D A0 C8 1A 96 88 DE 8E 4C B3 B8 60 7E 82 22
                    97 ... : .............6..........L..`~.". ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:49] nfqws[6060]: discovered hostname
I [Jan  8 19:11:49] nfqws[6060]: desync profile search for tcp target=104.18.1.79:443 l7proto=tls hostname='meduza.io'
I [Jan  8 19:11:49] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:49] nfqws[6060]: REPLAYING delayed packet #2 offset 1400
I [Jan  8 19:11:49] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 104.18.1.79 proto=tcp ttl=127 sport=59077 dport=443 flags=AP seq=323992560
                    ack_seq=114470186
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=319 : 74 74 70 2F 31 2E 31 00 2D 00 02 01 01 00 0A 00 0C 00 0A 0A 0A 11 EC 00 1D 00 17 00 18 FE 0D 00
                    ... : ttp/1.1.-....................... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: hostname: meduza.io
I [Jan  8 19:11:49] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for meduza.io : negative
I [Jan  8 19:11:49] nfqws[6060]: hostlist check for io : negative
I [Jan  8 19:11:49] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:49] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:49] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2553 drop
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2554 len=52 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=7784 dport=443 flags=A seq=1133477723
                    ack_seq=3394660227
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2554 pass unmodified
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2555 len=1440 mark=00000000
I [Jan  8 19:11:49] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59051 dport=443 flags=A seq=47297881
                    ack_seq=621801296
I [Jan  8 19:11:49] nfqws[6060]: TCP: len=1400 : 16 03 01 06 D2 01 00 06 CE 03 03 58 7B EC DB 34 17 CE 5F 0F 42 1A 88 EA 73 39 FB 2A DA B1 AE
                    BD ... : ...........X{..4.._.B...s9.*.... ...
I [Jan  8 19:11:49] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:49] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:49] nfqws[6060]: starting reassemble. now we have 1400/1751
I [Jan  8 19:11:49] nfqws[6060]: req retrans : seq interval 47297881-47299280
I [Jan  8 19:11:49] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:49] nfqws[6060]: packet: id=2555 drop
I [Jan  8 19:11:50] nfqws[6060]: packet: id=2556 len=52 mark=00000000
I [Jan  8 19:11:50] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=S seq=878115229 ack_seq=0
I [Jan  8 19:11:50] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=unknown hostname=''
I [Jan  8 19:11:53] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2556 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2557 len=52 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=S seq=1001972696 ack_seq=0
I [Jan  8 19:11:53] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2557 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2558 len=76 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.113 => 185.26.182.94 proto=tcp ttl=63 sport=47378 dport=443 flags=AP seq=1815542297
                    ack_seq=2288269023
I [Jan  8 19:11:53] nfqws[6060]: TCP: len=24 : 17 03 03 00 13 B2 F0 C5 A5 22 C9 AC 45 F4 AB 86 FA 62 23 BF CE 55 82 64 :
                    ........."..E....b#..U.d
I [Jan  8 19:11:53] nfqws[6060]: desync profile search for tcp target=185.26.182.94:443 l7proto=unknown hostname=''
I [Jan  8 19:11:53] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:53] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2558 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2559 len=52 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=S seq=878115229 ack_seq=0
I [Jan  8 19:11:53] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2559 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2560 len=1452 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=AP seq=3077458122
                    ack_seq=461683310
I [Jan  8 19:11:53] nfqws[6060]: TCP: len=1412 : 05 11 A7 B2 9B BC C7 37 A3 75 9F DD 25 E6 3C 19 FB D2 97 BA DD 01 C7 8F 19 A0 44 99 6F 82 9E
                    F6 ... : .......7.u..%.<...........D.o... ...
I [Jan  8 19:11:53] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:53] nfqws[6060]: reassemble session failed
I [Jan  8 19:11:53] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:11:53] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:53] nfqws[6060]: desync profile search for tcp target=142.250.74.74:443 l7proto=tls hostname=''
I [Jan  8 19:11:53] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:53] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2560 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2561 len=1452 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=AP seq=4135589746
                    ack_seq=1623861782
I [Jan  8 19:11:53] nfqws[6060]: TCP: len=1412 : 13 0D D7 72 C9 B1 10 FE 81 1D 90 10 22 2D 38 24 F6 58 AA 47 95 05 49 71 68 AE BA 63 6A 28 70
                    8F ... : ...r........"-8$.X.G..Iqh..cj(p. ...
I [Jan  8 19:11:53] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:53] nfqws[6060]: reassemble session failed
I [Jan  8 19:11:53] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:11:53] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:53] nfqws[6060]: desync profile search for tcp target=142.250.74.74:443 l7proto=tls hostname=''
I [Jan  8 19:11:53] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:53] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2561 pass unmodified
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2562 len=52 mark=00000000
I [Jan  8 19:11:53] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=S seq=878115229 ack_seq=0
I [Jan  8 19:11:53] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:53] nfqws[6060]: packet: id=2562 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2563 len=52 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=S seq=1112804385 ack_seq=0
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2563 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2564 len=52 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=S seq=344898196 ack_seq=0
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2564 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2565 len=40 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=A seq=878115230
                    ack_seq=2881293184
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2565 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2566 len=1452 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=A seq=3077457737
                    ack_seq=461683310
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 07 00 01 00 06 FC 03 03 B3 63 D0 20 DB 77 7F 1C 8F 7D E3 E5 D8 77 E8 9D 1E 4C 13 2A
                    71 ... : ............c. ...}...w...L.*q ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1412/1797
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 3077457737-3077459148
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2566 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2567 len=425 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=AP seq=3077459149
                    ack_seq=461683310
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=385 : F0 40 46 61 44 63 78 33 C3 75 16 9A 9B 8C 3C C7 7C B4 8D 3A 0C B9 3B 71 35 06 51 A8 67 97 D3 4C
                    ... : [email protected]....<.|..:..;q5.Q.g..L ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: reassemble : feeding data payload size=385. now we have 1797/1797
I [Jan  8 19:11:54] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 3077457737-3077459533
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:54] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:54] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=A seq=3077457737
                    ack_seq=461683310
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 07 00 01 00 06 FC 03 03 B3 63 D0 20 DB 77 7F 1C 8F 7D E3 E5 D8 77 E8 9D 1E 4C 13 2A
                    71 ... : ............c. ...}...w...L.*q ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: hostname: ogads-pa.googleapis.com
I [Jan  8 19:11:54] nfqws[6060]: discovered hostname
I [Jan  8 19:11:54] nfqws[6060]: desync profile search for tcp target=142.250.74.74:443 l7proto=tls hostname='ogads-pa.googleapis.com'
I [Jan  8 19:11:54] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:54] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : positive
I [Jan  8 19:11:54] nfqws[6060]: dpi desync src=10.155.3.127:59069 dst=142.250.74.74:443
I [Jan  8 19:11:54] nfqws[6060]: multisplit pos: 1 157
I [Jan  8 19:11:54] nfqws[6060]: normalized multisplit pos: 1 157
I [Jan  8 19:11:54] nfqws[6060]: sending fake : 16 03 01 02 87 01 00 02 83 03 03 5F 15 63 CB 06 EA 1C DD 40 76 F5 8C 44 50 6E 01 F3 A3 83 AC C2
                    ... : [email protected]...... ...
I [Jan  8 19:11:54] nfqws[6060]: sending multisplit part 1 0-0 len=1 seqovl=0 : 16 : .
I [Jan  8 19:11:54] nfqws[6060]: sending multisplit part 2 1-156 len=156 seqovl=0 : 03 01 07 00 01 00 06 FC 03 03 B3 63 D0 20 DB 77 7F 1C 8F 7D
                    E3 E5 D8 77 E8 9D 1E 4C 13 2A 71 F5 ... : ...........c. ...}...w...L.*q. ...
I [Jan  8 19:11:54] nfqws[6060]: sending multisplit part 3 157-1411 len=1255 seqovl=0 : 65 61 70 69 73 2E 63 6F 6D 00 0A 00 0C 00 0A 9A 9A 11
                    EC 00 1D 00 17 00 18 00 2B 00 07 06 3A 3A ... : eapis.com.................+...:: ...
I [Jan  8 19:11:54] nfqws[6060]: DROPPING delayed packet #1
I [Jan  8 19:11:54] nfqws[6060]: REPLAYING delayed packet #2 offset 1412
I [Jan  8 19:11:54] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59069 dport=443 flags=AP seq=3077459149
                    ack_seq=461683310
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=385 : F0 40 46 61 44 63 78 33 C3 75 16 9A 9B 8C 3C C7 7C B4 8D 3A 0C B9 3B 71 35 06 51 A8 67 97 D3 4C
                    ... : [email protected]....<.|..:..;q5.Q.g..L ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: hostname: ogads-pa.googleapis.com
I [Jan  8 19:11:54] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for com : negative
I [Jan  8 19:11:54] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ogads-pa.googleapis.com : negative
I [Jan  8 19:11:54] nfqws[6060]: hostlist check for googleapis.com : positive
I [Jan  8 19:11:54] nfqws[6060]: dpi desync src=10.155.3.127:59069 dst=142.250.74.74:443
I [Jan  8 19:11:54] nfqws[6060]: multisplit pos: 1 157
I [Jan  8 19:11:54] nfqws[6060]: all multisplit pos are outside of this packet
I [Jan  8 19:11:54] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:54] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2567 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2568 len=1452 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.74 proto=tcp ttl=127 sport=59070 dport=443 flags=A seq=4135589329
                    ack_seq=1623861782
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 07 20 01 00 07 1C 03 03 B5 AA F0 B2 DE B8 C0 51 23 44 55 B8 F4 54 ED 54 A6 9D 82 FA
                    5E ... : .... .............Q#DU..T.T....^ ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1412/1829
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 4135589329-4135590740
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2568 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2569 len=40 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=A seq=1001972697
                    ack_seq=3541475814
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2569 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2570 len=1452 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=A seq=878115230
                    ack_seq=2881293184
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 07 18 01 00 07 14 03 03 7E 52 51 32 BC EC 87 A8 0D 5B 9C 94 7C 31 CE 29 84 6A 3D FF
                    55 ... : ...........~RQ2.....[..|1.).j=.U ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1412/1821
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 878115230-878116641
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2570 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2571 len=52 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=A seq=878116642
                    ack_seq=2881293184
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2571 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2572 len=1440 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=A seq=1001972697
                    ack_seq=3541475814
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1400 : 16 03 01 06 D2 01 00 06 CE 03 03 26 3B A2 84 F6 B0 35 52 CA 85 AC 5D D9 A3 6D 7B BA 06 F7 2A
                    6C ... : ...........&;....5R...]..m{...*l ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1400/1751
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 1001972697-1001974096
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2572 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2573 len=52 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=A seq=1001974097
                    ack_seq=3541475814
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2573 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2574 len=40 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=A seq=1112804386
                    ack_seq=2550658571
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2574 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2575 len=1452 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=A seq=1112804386
                    ack_seq=2550658571
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 06 B8 01 00 06 B4 03 03 CE 0D F2 85 A2 4F 86 53 E6 ED 44 0D 44 B7 4F 05 8D C0 75 DE
                    95 ... : ................O.S..D.D.O...u.. ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1412/1725
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 1112804386-1112805797
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2575 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2576 len=40 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=A seq=344898197
                    ack_seq=3852432654
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2576 pass unmodified
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2577 len=1452 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=A seq=344898197
                    ack_seq=3852432654
I [Jan  8 19:11:54] nfqws[6060]: TCP: len=1412 : 16 03 01 07 18 01 00 07 14 03 03 E3 44 09 F1 01 59 EB 8F 4C 84 A4 07 94 EC 46 7B 4B AA 83 89
                    73 ... : ............D...Y..L.....F{K...s ...
I [Jan  8 19:11:54] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:54] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:54] nfqws[6060]: starting reassemble. now we have 1412/1821
I [Jan  8 19:11:54] nfqws[6060]: req retrans : seq interval 344898197-344899608
I [Jan  8 19:11:54] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2577 drop
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2578 len=60 mark=00000000
I [Jan  8 19:11:54] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=S seq=3094881101 ack_seq=0
I [Jan  8 19:11:54] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=unknown hostname=''
I [Jan  8 19:11:54] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:54] nfqws[6060]: packet: id=2578 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2579 len=52 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=A seq=3094881102
                    ack_seq=4013363721
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2579 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2580 len=569 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=AP seq=3094881102
                    ack_seq=4013363721
I [Jan  8 19:11:55] nfqws[6060]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 AA A4 C3 E0 91 EC 41 9D 5D 06 84 F5 F8 B7 11 74 05 CA FF 0D 9C
                    ... : .................A.]......t..... ...
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:55] nfqws[6060]: req retrans : seq interval 3094881102-3094881618
I [Jan  8 19:11:55] nfqws[6060]: hostname: api.telegram.org
I [Jan  8 19:11:55] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:55] nfqws[6060]: discovered hostname
I [Jan  8 19:11:55] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=tls hostname='api.telegram.org'
I [Jan  8 19:11:55] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:55] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for api.telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:11:55] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2580 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2581 len=52 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=A seq=3094881619
                    ack_seq=4013364949
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2581 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2582 len=52 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=A seq=3094881619
                    ack_seq=4013366177
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2582 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2583 len=52 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39848 dport=443 flags=A seq=3094881619
                    ack_seq=4013367405
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2583 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2584 len=52 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=S seq=3390401397 ack_seq=0
I [Jan  8 19:11:55] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:55] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2584 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2585 len=40 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=A seq=3390401398
                    ack_seq=3843168582
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2585 pass unmodified
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2586 len=1500 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=A seq=3390401398
                    ack_seq=3843168582
I [Jan  8 19:11:55] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 97 A1 50 67 D7 AF 39 BC C4 45 EC E1 5E F3 83 E0 03 60 FB 77
                    CB ... : .............Pg..9..E..^....`.w. ...
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:55] nfqws[6060]: starting reassemble. now we have 1460/1783
I [Jan  8 19:11:55] nfqws[6060]: req retrans : seq interval 3390401398-3390402857
I [Jan  8 19:11:55] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2586 drop
I [Jan  8 19:11:55] nfqws[6060]: packet: id=2587 len=363 mark=00000000
I [Jan  8 19:11:55] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=AP seq=3390402858
                    ack_seq=3843168582
I [Jan  8 19:11:55] nfqws[6060]: TCP: len=323 : DC C6 79 D9 F5 6F 4A 26 9D 3E 00 1D 00 20 9F 23 53 8A 9F 4F AA A0 3B 4F 66 83 59 A6 E9 32 B4 86
                    ... : ..y..oJ&.>... .#S..O..;Of.Y..2.. ...
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: reassemble : feeding data payload size=323. now we have 1783/1783
I [Jan  8 19:11:55] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:55] nfqws[6060]: req retrans : seq interval 3390401398-3390403180
I [Jan  8 19:11:55] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:55] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:55] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=A seq=3390401398
                    ack_seq=3843168582
I [Jan  8 19:11:55] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 97 A1 50 67 D7 AF 39 BC C4 45 EC E1 5E F3 83 E0 03 60 FB 77
                    CB ... : .............Pg..9..E..^....`.w. ...
I [Jan  8 19:11:55] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:55] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:55] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:55] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:55] nfqws[6060]: discovered hostname
I [Jan  8 19:11:55] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:55] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:55] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:55] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:55] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=AP seq=3390402858
                    ack_seq=3843168582
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=323 : DC C6 79 D9 F5 6F 4A 26 9D 3E 00 1D 00 20 9F 23 53 8A 9F 4F AA A0 3B 4F 66 83 59 A6 E9 32 B4 86
                    ... : ..y..oJ&.>... .#S..O..;Of.Y..2.. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2587 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2588 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59084 dport=443 flags=AP seq=3390401721
                    ack_seq=3843168582
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 17 C7 CB F6 31 7A 01 04 77 F0 B3 9B F8 5B 56 C0 21 50 46 29 20 23 42 C9 B7 34 53 B6 08 32 FC
                    32 ... : ....1z..w....[V.!PF) #B..4S..2.2 ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: req retrans counter : 1/3
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2588 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2589 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=S seq=2566750652 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2589 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2590 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=A seq=2566750653
                    ack_seq=2013696422
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2590 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2591 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=A seq=2566750653
                    ack_seq=2013696422
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 1E 94 73 32 C0 FB 17 DA 17 92 79 05 FF C0 D8 6D 05 D5 18 0D
                    64 ... : .............s2......y....m....d ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1719
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2566750653-2566752112
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2591 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2592 len=299 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=AP seq=2566752113
                    ack_seq=2013696422
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : 53 60 4A 2E 53 56 36 85 2F 7F 00 90 50 0D 81 71 05 27 EA 1F 39 C6 D1 BE 6A 3F 87 BD A1 7F F9 35
                    ... : S`J.SV6...P..q.'..9...j?...5 ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=259. now we have 1719/1719
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2566750653-2566752371
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=A seq=2566750653
                    ack_seq=2013696422
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 1E 94 73 32 C0 FB 17 DA 17 92 79 05 FF C0 D8 6D 05 D5 18 0D
                    64 ... : .............s2......y....m....d ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59086 dport=443 flags=AP seq=2566752113
                    ack_seq=2013696422
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : 53 60 4A 2E 53 56 36 85 2F 7F 00 90 50 0D 81 71 05 27 EA 1F 39 C6 D1 BE 6A 3F 87 BD A1 7F F9 35
                    ... : S`J.SV6...P..q.'..9...j?...5 ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2592 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2593 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=S seq=2583010548 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2593 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2594 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=S seq=2081095022 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2594 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2595 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=S seq=829653783 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2595 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2596 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=A seq=2583010549
                    ack_seq=3720359307
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2596 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2597 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=A seq=2583010549
                    ack_seq=3720359307
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 F7 49 D5 72 E4 80 52 64 F7 F1 5A 03 B2 B2 E4 7C F0 7E 9D 9A
                    B8 ... : ............I.r..Rd..Z....|.~... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1719
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2583010549-2583012008
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2597 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2598 len=299 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=AP seq=2583012009
                    ack_seq=3720359307
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : B1 6B 52 C6 12 8C 38 E2 8F 45 73 86 9D C7 67 2D 31 B8 16 F9 81 BB D6 BF 64 6C 35 62 29 1C C4 FA
                    ... : .kR...8..Es...g-1.......dl5b)... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=259. now we have 1719/1719
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2583010549-2583012267
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=A seq=2583010549
                    ack_seq=3720359307
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 F7 49 D5 72 E4 80 52 64 F7 F1 5A 03 B2 B2 E4 7C F0 7E 9D 9A
                    B8 ... : ............I.r..Rd..Z....|.~... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59087 dport=443 flags=AP seq=2583012009
                    ack_seq=3720359307
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : B1 6B 52 C6 12 8C 38 E2 8F 45 73 86 9D C7 67 2D 31 B8 16 F9 81 BB D6 BF 64 6C 35 62 29 1C C4 FA
                    ... : .kR...8..Es...g-1.......dl5b)... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2598 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2599 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=S seq=2811898418 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2599 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2600 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=A seq=2081095023
                    ack_seq=1462096146
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2600 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2601 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=A seq=829653784
                    ack_seq=4044579203
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2601 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2602 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=A seq=2081095023
                    ack_seq=1462096146
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 E8 6D C6 DE 29 94 59 53 E1 88 3F AB CD B2 0C 80 F7 03 BE CE
                    33 ... : ............m..).YS..?.........3 ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1815
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2081095023-2081096482
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2602 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2603 len=395 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=AP seq=2081096483
                    ack_seq=1462096146
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=355 : 7B AC 05 33 4F 31 C0 32 CE 5A 44 69 00 05 00 03 02 68 32 00 05 00 05 01 00 00 00 00 00 12 00 00
                    ... : {..3O1.2.ZDi.....h2............. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=355. now we have 1815/1815
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2081095023-2081096837
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=A seq=2081095023
                    ack_seq=1462096146
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 E8 6D C6 DE 29 94 59 53 E1 88 3F AB CD B2 0C 80 F7 03 BE CE
                    33 ... : ............m..).YS..?.........3 ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59088 dport=443 flags=AP seq=2081096483
                    ack_seq=1462096146
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=355 : 7B AC 05 33 4F 31 C0 32 CE 5A 44 69 00 05 00 03 02 68 32 00 05 00 05 01 00 00 00 00 00 12 00 00
                    ... : {..3O1.2.ZDi.....h2............. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2603 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2604 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=A seq=829653784
                    ack_seq=4044579203
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 94 9B DD E8 06 9C ED 58 9B B4 1A 1A 0F 37 DE F9 ED 26 29 87
                    E5 ... : ..................X.....7...&).. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1815
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 829653784-829655243
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2604 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2605 len=395 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=AP seq=829655244
                    ack_seq=4044579203
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=355 : 68 32 FE 0D 01 1A 00 00 01 00 01 5A 00 20 48 A9 5A 8F B0 D5 9C 42 72 6F E5 C1 5F 8D 1E 32 C8 9F
                    ... : h2.........Z. H.Z....Bro.._..2.. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=355. now we have 1815/1815
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 829653784-829655598
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=A seq=829653784
                    ack_seq=4044579203
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 94 9B DD E8 06 9C ED 58 9B B4 1A 1A 0F 37 DE F9 ED 26 29 87
                    E5 ... : ..................X.....7...&).. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59089 dport=443 flags=AP seq=829655244
                    ack_seq=4044579203
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=355 : 68 32 FE 0D 01 1A 00 00 01 00 01 5A 00 20 48 A9 5A 8F B0 D5 9C 42 72 6F E5 C1 5F 8D 1E 32 C8 9F
                    ... : h2.........Z. H.Z....Bro.._..2.. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2605 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2606 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=S seq=1651312591 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2606 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2607 len=52 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=S seq=709799063 ack_seq=0
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2607 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2608 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=A seq=2811898419
                    ack_seq=1760576915
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2608 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2609 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=A seq=2811898419
                    ack_seq=1760576915
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 80 E1 D6 DC A0 BB 86 7F BD 7D AF C2 FE FD E1 6D 67 AA 8C 55
                    3D ... : ..................}.....mg..U= ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1719
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2811898419-2811899878
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2609 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2610 len=299 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=AP seq=2811899879
                    ack_seq=1760576915
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : 88 13 6B 56 40 0A 90 96 43 59 59 8F A8 3D 4F C3 1E 13 D8 82 E0 F3 BA 17 F3 B9 AC A6 C1 61 30 9D
                    ... : [email protected]..=O..............a0. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=259. now we have 1719/1719
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 2811898419-2811900137
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=A seq=2811898419
                    ack_seq=1760576915
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 80 E1 D6 DC A0 BB 86 7F BD 7D AF C2 FE FD E1 6D 67 AA 8C 55
                    3D ... : ..................}.....mg..U= ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59090 dport=443 flags=AP seq=2811899879
                    ack_seq=1760576915
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=259 : 88 13 6B 56 40 0A 90 96 43 59 59 8F A8 3D 4F C3 1E 13 D8 82 E0 F3 BA 17 F3 B9 AC A6 C1 61 30 9D
                    ... : [email protected]..=O..............a0. ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2610 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2611 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=A seq=1651312592
                    ack_seq=1929531768
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2611 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2612 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=A seq=1651312592
                    ack_seq=1929531768
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 D2 01 00 06 CE 03 03 99 05 C2 62 38 29 E7 BC 6D 82 ED D3 1D 00 B9 70 2C 14 C6 47
                    52 ... : ..............b8)..m......p,..GR ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1751
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 1651312592-1651314051
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2612 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2613 len=331 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=AP seq=1651314052
                    ack_seq=1929531768
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=291 : 00 00 00 00 00 0E 00 0C 00 00 09 6E 74 63 2E 70 61 72 74 79 44 69 00 05 00 03 02 68 32 FE 0D 00
                    ... : ...........ntc.partyDi.....h2... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=291. now we have 1751/1751
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 1651312592-1651314342
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=A seq=1651312592
                    ack_seq=1929531768
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 D2 01 00 06 CE 03 03 99 05 C2 62 38 29 E7 BC 6D 82 ED D3 1D 00 B9 70 2C 14 C6 47
                    52 ... : ..............b8)..m......p,..GR ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59091 dport=443 flags=AP seq=1651314052
                    ack_seq=1929531768
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=291 : 00 00 00 00 00 0E 00 0C 00 00 09 6E 74 63 2E 70 61 72 74 79 44 69 00 05 00 03 02 68 32 FE 0D 00
                    ... : ...........ntc.partyDi.....h2... ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2613 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2614 len=40 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=A seq=709799064
                    ack_seq=551461478
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2614 pass unmodified
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2615 len=1500 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=A seq=709799064
                    ack_seq=551461478
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 D2 01 00 06 CE 03 03 7E D2 B3 1B 1A 69 B9 0B 8C C8 92 CD 73 2A 6F A3 F5 5A 6A AA
                    7C ... : ...........~....i......s*o..Zj.| ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: starting reassemble. now we have 1460/1751
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 709799064-709800523
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2615 drop
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2616 len=331 mark=00000000
I [Jan  8 19:11:56] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=AP seq=709800524
                    ack_seq=551461478
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=291 : CB 2F 2B 3F 1A ED A1 C7 57 BA 5F DB 6E D9 67 F3 6A 69 9F 89 A9 7D 00 1D 00 20 78 30 B4 D4 DE 57
                    ... : ./+?....W._.n.g.ji...}... x0...W ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: reassemble : feeding data payload size=291. now we have 1751/1751
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: req retrans : seq interval 709799064-709800814
I [Jan  8 19:11:56] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=A seq=709799064
                    ack_seq=551461478
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=1460 : 16 03 01 06 D2 01 00 06 CE 03 03 7E D2 B3 1B 1A 69 B9 0B 8C C8 92 CD 73 2A 6F A3 F5 5A 6A AA
                    7C ... : ...........~....i......s*o..Zj.| ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:11:56] nfqws[6060]: discovered hostname
I [Jan  8 19:11:56] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:11:56] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:11:56] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:11:56] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59092 dport=443 flags=AP seq=709800524
                    ack_seq=551461478
I [Jan  8 19:11:56] nfqws[6060]: TCP: len=291 : CB 2F 2B 3F 1A ED A1 C7 57 BA 5F DB 6E D9 67 F3 6A 69 9F 89 A9 7D 00 1D 00 20 78 30 B4 D4 DE 57
                    ... : ./+?....W._.n.g.ji...}... x0...W ...
I [Jan  8 19:11:56] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:56] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:11:56] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:11:56] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:11:56] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:11:56] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:11:56] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:11:56] nfqws[6060]: reassemble session finished
I [Jan  8 19:11:56] nfqws[6060]: packet: id=2616 drop
I [Jan  8 19:11:57] nfqws[6060]: packet: id=2617 len=52 mark=00000000
I [Jan  8 19:11:57] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=S seq=3359199395 ack_seq=0
I [Jan  8 19:11:57] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:11:57] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:11:57] nfqws[6060]: packet: id=2617 pass unmodified
I [Jan  8 19:11:57] nfqws[6060]: packet: id=2618 len=40 mark=00000000
I [Jan  8 19:11:57] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:11:57] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:11:57] nfqws[6060]: packet: id=2618 pass unmodified
I [Jan  8 19:11:57] nfqws[6060]: packet: id=2619 len=1500 mark=00000000
I [Jan  8 19:11:57] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:11:57] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 89 D4 E0 6B 79 C7 B8 AF 93 9A 6C 7D 35 DF 50 67 A9 71 55 3E
                    D8 ... : ..............ky.....l}5.Pg.qU>. ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: starting reassemble. now we have 1460/1783
I [Jan  8 19:12:00] nfqws[6060]: req retrans : seq interval 3359199396-3359200855
I [Jan  8 19:12:00] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2619 drop
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2620 len=363 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=AP seq=3359200856
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=323 : 0D 00 FA 00 00 01 00 01 65 00 20 29 13 BB 7E D4 30 4C 9F A7 A1 F4 05 D2 08 C1 EE 32 A3 B8 F1 38
                    ... : ........e. )..~.0L.........2...8 ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: reassemble : feeding data payload size=323. now we have 1783/1783
I [Jan  8 19:12:00] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: req retrans : seq interval 3359199396-3359201178
I [Jan  8 19:12:00] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:12:00] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:12:00] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 89 D4 E0 6B 79 C7 B8 AF 93 9A 6C 7D 35 DF 50 67 A9 71 55 3E
                    D8 ... : ..............ky.....l}5.Pg.qU>. ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:00] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:00] nfqws[6060]: discovered hostname
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:00] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:12:00] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:12:00] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=AP seq=3359200856
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=323 : 0D 00 FA 00 00 01 00 01 65 00 20 29 13 BB 7E D4 30 4C 9F A7 A1 F4 05 D2 08 C1 EE 32 A3 B8 F1 38
                    ... : ........e. )..~.0L.........2...8 ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:00] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:00] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:00] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:12:00] nfqws[6060]: reassemble session finished
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2620 drop
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2621 len=1500 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=AP seq=3359199719
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1460 : B4 C9 32 2C 6D 9C C7 C9 43 92 10 E9 25 35 15 09 92 46 04 AE 98 1A D4 96 1B 37 EA 07 74 59 89
                    65 ... : ..2,m...C...%5...F.......7..tY.e ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: req retrans counter : 1/3
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2621 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2622 len=52 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=S seq=296295206 ack_seq=0
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2622 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2623 len=1500 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 89 D4 E0 6B 79 C7 B8 AF 93 9A 6C 7D 35 DF 50 67 A9 71 55 3E
                    D8 ... : ..............ky.....l}5.Pg.qU>. ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: req retrans counter : 2/3
I [Jan  8 19:12:00] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to TLS ClientHello without hostname in the SNI
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2623 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2624 len=1500 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 89 D4 E0 6B 79 C7 B8 AF 93 9A 6C 7D 35 DF 50 67 A9 71 55 3E
                    D8 ... : ..............ky.....l}5.Pg.qU>. ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: req retrans threshold reached : 3/3
I [Jan  8 19:12:00] nfqws[6060]: auto hostlist (profile 3) : ntc.party : fail counter 1/3
I [Jan  8 19:12:00] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to TLS ClientHello without hostname in the SNI
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2624 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2625 len=52 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=S seq=296295206 ack_seq=0
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2625 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2626 len=1440 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 104.18.0.79 proto=tcp ttl=127 sport=59073 dport=443 flags=AP seq=1001973048
                    ack_seq=3541475814
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1400 : 4C 85 30 FF CA 7E F3 7D F3 2F 13 4B 47 23 77 B1 BF 6F 35 EC 3D 7B B4 C2 DA 00 05 00 05 01 00
                    00 ... : L.0..~.}./.KG#w..o5.={.......... ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: reassemble session failed
I [Jan  8 19:12:00] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:12:00] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=104.18.0.79:443 l7proto=tls hostname=''
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2626 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2627 len=1452 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59080 dport=443 flags=AP seq=878115639
                    ack_seq=2881293184
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1412 : 9B 2C C8 59 71 ED 2B 2F 01 AE 3F D1 44 BC 39 0C 63 8B D8 3C 8A CD 75 C5 DF F9 6F B3 BD CE 03
                    14 ... : .,.Yq.+/..?.D.9.c..<..u...o..... ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: reassemble session failed
I [Jan  8 19:12:00] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:12:00] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=tls hostname=''
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2627 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2628 len=1500 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59093 dport=443 flags=A seq=3359199396
                    ack_seq=3641423389
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1460 : 16 03 01 06 F2 01 00 06 EE 03 03 89 D4 E0 6B 79 C7 B8 AF 93 9A 6C 7D 35 DF 50 67 A9 71 55 3E
                    D8 ... : ..............ky.....l}5.Pg.qU>. ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to TLS ClientHello without hostname in the SNI
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2628 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2629 len=1452 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=AP seq=344898606
                    ack_seq=3852432654
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1412 : D9 69 97 89 6D 01 51 C3 CE 75 5B 2A BD C6 55 A0 F9 00 0A 00 0C 00 0A 3A 3A 11 EC 00 1D 00 17
                    00 ... : .i..m.Q..u[*..U........::....... ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: reassemble session failed
I [Jan  8 19:12:00] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:12:00] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=tls hostname=''
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2629 pass unmodified
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2630 len=1452 mark=00000000
I [Jan  8 19:12:00] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=AP seq=1112804699
                    ack_seq=2550658571
I [Jan  8 19:12:00] nfqws[6060]: TCP: len=1412 : C0 41 97 BC 79 95 53 52 94 51 9F 55 84 8A 77 3F 5E 69 54 8A 95 14 B6 B7 22 40 75 76 CE 26 28
                    44 ... : .A..y.SR.Q.U..w?^iT....."@uv.&(D ...
I [Jan  8 19:12:00] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:00] nfqws[6060]: reassemble session failed
I [Jan  8 19:12:00] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:12:00] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:00] nfqws[6060]: desync profile search for tcp target=142.250.74.142:443 l7proto=tls hostname=''
I [Jan  8 19:12:00] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:00] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:00] nfqws[6060]: packet: id=2630 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2631 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=S seq=296295206 ack_seq=0
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2631 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2632 len=353 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59065 dport=443 flags=AP seq=1112805798
                    ack_seq=2550658571
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=313 : 58 F7 C6 7D FA 56 B9 DC 90 5D 91 09 4A 47 D5 8E 5D F2 57 E4 0D D3 8E E3 B6 8D 33 49 00 0A 00 0C
                    ... : X..}.V...]..JG..].W.......3I.... ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2632 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2633 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=S seq=115394157 ack_seq=0
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2633 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2634 len=40 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 142.250.74.142 proto=tcp ttl=127 sport=59067 dport=443 flags=A seq=344900018
                    ack_seq=3852435478
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2634 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2635 len=40 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=A seq=296295207
                    ack_seq=3566461916
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2635 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2636 len=1500 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=A seq=296295207
                    ack_seq=3566461916
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 16 03 01 06 D2 01 00 06 CE 03 03 2C E4 AC B5 57 4A 39 DE F2 68 12 3C 50 5B 30 AD A6 EE 59 CC
                    00 ... : ...........,...WJ9..h.<P[0...Y.. ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: starting reassemble. now we have 1460/1751
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 296295207-296296666
I [Jan  8 19:12:01] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2636 drop
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2637 len=40 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=A seq=115394158
                    ack_seq=8383881
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2637 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2638 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=A seq=296296667
                    ack_seq=3566461916
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2638 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2639 len=1500 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=A seq=115394158
                    ack_seq=8383881
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 53 CE DC 93 90 E2 5C D2 C0 0D D7 C7 C7 C2 E8 EF 22 84 73 F4
                    56 ... : ...........S.....\.........".s.V ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: starting reassemble. now we have 1460/1815
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 115394158-115395617
I [Jan  8 19:12:01] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2639 drop
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2640 len=395 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=AP seq=115395618
                    ack_seq=8383881
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=355 : 25 18 7A FF D4 80 9D 20 8B EC E8 AA E0 06 23 E6 E9 4F C9 B8 95 F0 98 AF 96 A5 B1 18 63 B1 7A D8
                    ... : %.z.... ......#..O..........c.z. ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: reassemble : feeding data payload size=355. now we have 1815/1815
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 115394158-115395972
I [Jan  8 19:12:01] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:12:01] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:12:01] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=A seq=115394158
                    ack_seq=8383881
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 16 03 01 07 12 01 00 07 0E 03 03 53 CE DC 93 90 E2 5C D2 C0 0D D7 C7 C7 C2 E8 EF 22 84 73 F4
                    56 ... : ...........S.....\.........".s.V ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:01] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:01] nfqws[6060]: discovered hostname
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:01] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:12:01] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:12:01] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59098 dport=443 flags=AP seq=115395618
                    ack_seq=8383881
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=355 : 25 18 7A FF D4 80 9D 20 8B EC E8 AA E0 06 23 E6 E9 4F C9 B8 95 F0 98 AF 96 A5 B1 18 63 B1 7A D8
                    ... : %.z.... ......#..O..........c.z. ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:01] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:01] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:12:01] nfqws[6060]: reassemble session finished
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2640 drop
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2641 len=60 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=S seq=3659362982 ack_seq=0
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=unknown hostname=''
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2641 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2642 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=A seq=3659362983
                    ack_seq=1762914796
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2642 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2643 len=569 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=AP seq=3659362983
                    ack_seq=1762914796
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=517 : 16 03 01 02 00 01 00 01 FC 03 03 1D A7 6C C7 01 1B D0 0E D0 40 0E 26 4B 96 74 61 B0 03 B7 BC 2C
                    ... : .............l......@.&K.ta...., ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 3659362983-3659363499
I [Jan  8 19:12:01] nfqws[6060]: hostname: api.telegram.org
I [Jan  8 19:12:01] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:01] nfqws[6060]: discovered hostname
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=149.154.167.220:443 l7proto=tls hostname='api.telegram.org'
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for api.telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for api.telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for telegram.org : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for org : negative
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2643 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2644 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=A seq=3659363500
                    ack_seq=1762916024
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2644 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2645 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=A seq=3659363500
                    ack_seq=1762917252
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2645 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2646 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.1.210 => 149.154.167.220 proto=tcp ttl=63 sport=39860 dport=443 flags=A seq=3659363500
                    ack_seq=1762918480
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2646 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2647 len=1500 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59094 dport=443 flags=AP seq=296295498
                    ack_seq=3566461916
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 7F D2 84 4B 58 97 89 88 B3 E5 78 B6 67 FD 94 0B A3 A8 5D 98 ED 2A 29 AA 19 4D 38 55 C8 FF DE
                    C8 ... :..KX.....x.g.....]..*)..M8U.... ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: reassemble session failed
I [Jan  8 19:12:01] nfqws[6060]: SENDING 1 delayed packets
I [Jan  8 19:12:01] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname=''
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to unknown protocol
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2647 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2648 len=52 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=S seq=770523965 ack_seq=0
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=unknown hostname=''
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2648 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2649 len=40 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=A seq=770523966
                    ack_seq=4016099948
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2649 pass unmodified
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2650 len=1500 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=A seq=770523966
                    ack_seq=4016099948
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 CA 04 11 CD 50 A4 66 98 2B C8 DD 2B FD 39 0C 75 DB 80 E3 FB
                    69 ... : ...............P.f.+..+.9.u....i ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains partial TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: starting reassemble. now we have 1460/1719
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 770523966-770525425
I [Jan  8 19:12:01] nfqws[6060]: DELAY desync until reasm is complete (#1)
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2650 drop
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2651 len=299 mark=00000000
I [Jan  8 19:12:01] nfqws[6060]: IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=AP seq=770525426
                    ack_seq=4016099948
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=259 : 2D D1 49 58 06 48 81 02 6A C7 35 4B DD 07 5E 47 58 C7 6B 94 3A 53 C8 83 2D 82 18 3F 6B 47 C5 11
                    ... : -.IX.H..j.5K..^GX.k.:S..-..?kG.. ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: reassemble : feeding data payload size=259. now we have 1719/1719
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: req retrans : seq interval 770523966-770525684
I [Jan  8 19:12:01] nfqws[6060]: DELAY desync until reasm is complete (#2)
I [Jan  8 19:12:01] nfqws[6060]: REPLAYING delayed packet #1 offset 0
I [Jan  8 19:12:01] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=A seq=770523966
                    ack_seq=4016099948
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=1460 : 16 03 01 06 B2 01 00 06 AE 03 03 CA 04 11 CD 50 A4 66 98 2B C8 DD 2B FD 39 0C 75 DB 80 E3 FB
                    69 ... : ...............P.f.+..+.9.u....i ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:01] nfqws[6060]: discovered l7 protocol
I [Jan  8 19:12:01] nfqws[6060]: discovered hostname
I [Jan  8 19:12:01] nfqws[6060]: desync profile search for tcp target=130.255.77.28:443 l7proto=tls hostname='ntc.party'
I [Jan  8 19:12:01] nfqws[6060]: desync profile 3 matches
I [Jan  8 19:12:01] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:01] nfqws[6060]: SENDING delayed packet #1 unmodified
I [Jan  8 19:12:01] nfqws[6060]: REPLAYING delayed packet #2 offset 1460
I [Jan  8 19:12:01] nfqws[6060]: REPLAY IP4: 10.155.3.127 => 130.255.77.28 proto=tcp ttl=127 sport=59099 dport=443 flags=AP seq=770525426
                    ack_seq=4016099948
I [Jan  8 19:12:01] nfqws[6060]: TCP: len=259 : 2D D1 49 58 06 48 81 02 6A C7 35 4B DD 07 5E 47 58 C7 6B 94 3A 53 C8 83 2D 82 18 3F 6B 47 C5 11
                    ... : -.IX.H..j.5K..^GX.k.:S..-..?kG.. ...
I [Jan  8 19:12:01] nfqws[6060]: using cached desync profile 3
I [Jan  8 19:12:01] nfqws[6060]: packet contains full TLS ClientHello
I [Jan  8 19:12:01] nfqws[6060]: hostname: ntc.party
I [Jan  8 19:12:01] nfqws[6060]: * hostlist check for profile 3
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/exclude.list] exclude hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/auto.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: [/opt/etc/nfqws/user.list] include hostlist check for ntc.party : negative
I [Jan  8 19:12:01] nfqws[6060]: hostlist check for party : negative
I [Jan  8 19:12:01] nfqws[6060]: not applying tampering to this request
I [Jan  8 19:12:01] nfqws[6060]: SENDING delayed packet #2 unmodified
I [Jan  8 19:12:01] nfqws[6060]: reassemble session finished
I [Jan  8 19:12:01] nfqws[6060]: packet: id=2651 drop

@vemneyy
Copy link

vemneyy commented Jan 8, 2025

Пытался открыть ntc.party, которого в листах нет

@Anonym-tsk
Copy link
Owner

В вашем логе данные за 26 секунд
При этом, есть запись о том, что обнаружен недоступный ресурс.
auto hostlist (profile 3) : ntc.party : fail counter 1/3
Но запросов к нему было недостаточно для добавления в auto.list (нужно 3 обнаружения за 60 секунд).
Выглядит так, что все работает как и должно.

@vemneyy
Copy link

vemneyy commented Jan 10, 2025 •
edited
Loading

Заметил странную особенность. Когда включаешь auto без логирования в syslog, он вообще не работает. Но если включить логирование и открыть логи в терминале/веб-интерфейсе роутера, то сразу всё замечательно начинает работать. Но если просто включить в конфиге логирование - не поможет. Нужно именно что открывать этот лог, чтобы он в реал-тайме бегал

@SijyKijy
Copy link

Аналогичная проблема. Не работает на keenetic giga (kn-1012). Даже после переустановки Entware (ставил aarch64).

На keenetic ultra всё работает отлично. Но там стоит, вроде, mipsel

Модель маршрутизатора
keenetic giga (kn-1012)

Провайдер
SkyNet ethernet

Выполните команды и приложите их вывод
opkg info nfqws-keenetic

~ # opkg info nfqws-keenetic
Package: nfqws-keenetic
Version: 2.7.4
Depends: iptables, busybox
Conflicts: tpws-keenetic
Status: install user installed
Section: net
Architecture: all
Size: 840604
Filename: nfqws-keenetic_2.7.4_all_entware.ipk
Conffiles:
 /opt/etc/nfqws/nfqws.conf b6dd057fe45c8a96ea726f3df841d9aa5cd8ef62175c6b85d92789fc22f74305
 /opt/etc/nfqws/user.list 45dc2adaa172b86d73369c6ed12a8a0e648b851b66293b11514c3b1d4bd3fce6
 /opt/etc/nfqws/auto.list e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 /opt/etc/nfqws/exclude.list 2e08dbc89cee7e1d339c7f15e8ff2d1033488ee8ef40e2f42e1eb0a18fdcef4c
Description: NFQWS service
Installed-Time: 1737572823

/opt/etc/init.d/S51nfqws restart

~ # /opt/etc/init.d/S51nfqws restart
Stopping NFQWS service...
github version v69.9 (35d676406cede0e689910fa9d5b0b2cc7f5b7c1a)

we have 3 user defined desync profile(s) and default low priority profile 0
Loading hostlist /opt/etc/nfqws/exclude.list
loading plain text list
Loaded 37 hosts from /opt/etc/nfqws/exclude.list
Loading hostlist /opt/etc/nfqws/auto.list
loading plain text list
Loaded 0 hosts from /opt/etc/nfqws/auto.list
Loading hostlist /opt/etc/nfqws/user.list
loading plain text list
Loaded 15 hosts from /opt/etc/nfqws/user.list
Started NFQWS service

cat /opt/etc/nfqws/nfqws.conf

~ # cat /opt/etc/nfqws/nfqws.conf
# Provider network interface, e.g. eth3
# You can specify multiple interfaces separated by space, e.g. ISP_INTERFACE="eth3 nwg1"
ISP_INTERFACE="eth2.4"

# All arguments here: https://github.com/bol-van/zapret (search for `nfqws` on the page)
# HTTP(S) strategy
NFQWS_ARGS="--dpi-desync=fake,multisplit --dpi-desync-split-pos=1,midsld --dpi-desync-ttl=0 --dpi-desync-repeats=16 --dpi-desync-fooling=badseq,md5sig --dpi-desync-fake-tls=/opt/etc/nfqws/tls_clienthello.bin"

# QUIC strategy
NFQWS_ARGS_QUIC="--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=/opt/etc/nfqws/quic_initial.bin"

# UDP strategy (doesn't use lists from NFQWS_EXTRA_ARGS)
NFQWS_ARGS_UDP="--filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-repeats=6 --dpi-desync-cutoff=n2"

# auto - automatically detects blocked resources and adds them to the auto.list
NFQWS_EXTRA_ARGS="--hostlist=/opt/etc/nfqws/user.list --hostlist-auto=/opt/etc/nfqws/auto.list --hostlist-auto-debug=/opt/var/log/nfqws.log --hostlist-exclude=/opt/etc/nfqws/exclude.list"

# list - applies rules only to domains in the user.list
#NFQWS_EXTRA_ARGS="--hostlist=/opt/etc/nfqws/user.list"

# all  - applies rules to all traffic except domains from exclude.list
#NFQWS_EXTRA_ARGS="--hostlist-exclude=/opt/etc/nfqws/exclude.list"

# IPv6 support
IPV6_ENABLED=0

# TCP ports for iptables rules
TCP_PORTS=443

# UDP ports for iptables rules
UDP_PORTS=443,50000:50099

# Keenetic policy name
POLICY_NAME="nfqws"
# Policy mode (0 - include, 1 - exclude)
POLICY_EXCLUDE=0

# Syslog logging level (0 - silent, 1 - debug)
LOG_LEVEL=0

NFQUEUE_NUM=200
USER=nobody
CONFIG_VERSION=5

ps | grep nfqws

~ # ps | grep nfqws
 7069 nobody     628 S    /opt/usr/bin/nfqws --daemon --pidfile=/opt/var/run/nfqws.pid --user=nobody --qnum=200 --filt
 7096 root      5976 S    grep nfqws

iptables-save | grep 200

~ # iptables-save | grep 200
-A POSTROUTING -o eth2.4 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth2.4 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass

sysctl net.netfilter.nf_conntrack_checksum

~ # sysctl net.netfilter.nf_conntrack_checksum
net.netfilter.nf_conntrack_checksum = 0

@alexunderrrqw
Copy link

А я правильно понимаю что nfqws болт кладет на белый список - и ломает/кодирует весь трафик?
У меня сайты начинают отваливаться, и не открываться после установки по мануалу
В конфиге активировал опцию LIST - но как только включаю скрипт у меня сразу отваливается чатжипити

@LimpingK
Copy link

А я правильно понимаю что nfqws болт кладет на белый список - и ломает/кодирует весь трафик?

Вообще-то нет.
Если сомневаетесь, удобно посмотреть в GUI на nfqws.log
и добавить в exclude.list то, что ломать не надо.

@edazzz3
Copy link

edazzz3 commented Feb 5, 2025

А возможно сделать так, чтобы обрабатывался только трафик, который проходит через авто лист и user list? А например все сайты .ru были типа в exclude list?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@Anonym-tsk @ops244 @SijyKijy @LimpingK @alexunderrrqw @vemneyy @edazzz3