root@j7200-evm:~# tcpdump -i br0 -n
[ 1724.766081] device br0 entered promiscuous mode
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
23:16:52.734108 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:52.734429 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:53.002702 IP 192.168.5.11.63520 > 8.8.8.8.53: 50022+ A? dns.msftncsi.com. (34)
23:16:53.002799 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:16:53.036305 IP 192.168.5.11.63520 > 8.8.8.8.53: 50022+ A? dns.msftncsi.com. (34)
23:16:53.728042 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:53.728515 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:54.039261 IP 192.168.5.11.63520 > 8.8.8.8.53: 50022+ A? dns.msftncsi.com. (34)
23:16:54.084889 IP 192.168.5.11.65235 > 8.8.8.8.53: 57906+ A? gms.ahnlab.com. (32)
23:16:54.734450 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:54.734780 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:55.733115 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:55.733536 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:56.041411 IP 192.168.5.11.63520 > 8.8.8.8.53: 50022+ A? dns.msftncsi.com. (34)
23:16:56.041532 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:16:56.721861 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:56.722504 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:57.736340 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:57.737229 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:58.620763 IP 192.168.5.12.63348 > 8.8.8.8.53: 49695+ A? dns.msftncsi.com. (34)
23:16:58.620859 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:16:58.740436 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:58.741091 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:16:59.024765 IP 192.168.5.12.61418 > 8.8.8.8.53: 28637+ A? go.microsoft.com. (34)
23:16:59.024848 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:16:59.620158 IP 192.168.5.12.63348 > 8.8.8.8.53: 49695+ A? dns.msftncsi.com. (34)
23:16:59.620250 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:16:59.729227 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:16:59.729431 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:00.023593 IP 192.168.5.12.61418 > 8.8.8.8.53: 28637+ A? go.microsoft.com. (34)
23:17:00.046241 IP 192.168.5.11.63520 > 8.8.8.8.53: 50022+ A? dns.msftncsi.com. (34)
23:17:00.046319 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:00.621317 IP 192.168.5.12.63348 > 8.8.8.8.53: 49695+ A? dns.msftncsi.com. (34)
23:17:00.730494 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:00.730784 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:01.034222 IP 192.168.5.12.61418 > 8.8.8.8.53: 28637+ A? go.microsoft.com. (34)
23:17:01.738869 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:01.739331 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:02.626249 IP 192.168.5.12.63348 > 8.8.8.8.53: 49695+ A? dns.msftncsi.com. (34)
23:17:02.626344 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:17:02.735414 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:02.736009 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:03.036242 IP 192.168.5.12.61418 > 8.8.8.8.53: 28637+ A? go.microsoft.com. (34)
23:17:03.735865 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:03.736891 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:04.059577 IP 192.168.5.11.49354 > 8.8.8.8.53: 14679+ A? dns.msftncsi.com. (34)
23:17:04.059665 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:04.061012 IP 192.168.5.11.54930 > 8.8.8.8.53: 12543+ AAAA? dns.msftncsi.com. (34)
23:17:04.061046 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:04.089085 IP 192.168.5.11.49354 > 8.8.8.8.53: 14679+ A? dns.msftncsi.com. (34)
23:17:04.089085 IP 192.168.5.11.54930 > 8.8.8.8.53: 12543+ AAAA? dns.msftncsi.com. (34)
23:17:04.401231 IP 192.168.5.11.137 > 192.168.5.255.137: UDP, length 50
23:17:04.483781 IP 192.168.5.11.49767 > 192.168.5.254.8013: Flags [S], seq 3259069474, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:04.483850 IP 192.168.5.254.8013 > 192.168.5.11.49767: Flags [R.], seq 0, ack 3259069475, win 0, length 0
23:17:04.728112 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:04.728378 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:04.985154 IP 192.168.5.11.49767 > 192.168.5.254.8013: Flags [S], seq 3259069474, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:04.985274 IP 192.168.5.254.8013 > 192.168.5.11.49767: Flags [R.], seq 0, ack 1, win 0, length 0
23:17:05.090676 IP 192.168.5.11.49354 > 8.8.8.8.53: 14679+ A? dns.msftncsi.com. (34)
23:17:05.090676 IP 192.168.5.11.54930 > 8.8.8.8.53: 12543+ AAAA? dns.msftncsi.com. (34)
23:17:05.165840 IP 192.168.5.11.137 > 192.168.5.255.137: UDP, length 50
23:17:05.498068 IP 192.168.5.11.49767 > 192.168.5.254.8013: Flags [S], seq 3259069474, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:05.498161 IP 192.168.5.254.8013 > 192.168.5.11.49767: Flags [R.], seq 0, ack 1, win 0, length 0
23:17:05.573574 IP 192.168.5.11.49768 > 192.168.5.254.8013: Flags [S], seq 659041508, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:05.573618 IP 192.168.5.254.8013 > 192.168.5.11.49768: Flags [R.], seq 0, ack 659041509, win 0, length 0
23:17:05.724298 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:05.724613 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:05.923441 IP 192.168.5.11.137 > 192.168.5.255.137: UDP, length 50
23:17:06.075274 IP 192.168.5.11.49768 > 192.168.5.254.8013: Flags [S], seq 659041508, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:06.075336 IP 192.168.5.254.8013 > 192.168.5.11.49768: Flags [R.], seq 0, ack 1, win 0, length 0
23:17:06.576429 IP 192.168.5.11.49768 > 192.168.5.254.8013: Flags [S], seq 659041508, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:17:06.576515 IP 192.168.5.254.8013 > 192.168.5.11.49768: Flags [R.], seq 0, ack 1, win 0, length 0
23:17:06.626255 IP 192.168.5.12.63348 > 8.8.8.8.53: 49695+ A? dns.msftncsi.com. (34)
23:17:06.626311 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:17:06.735463 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:06.735773 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:07.048161 IP 192.168.5.12.61418 > 8.8.8.8.53: 28637+ A? go.microsoft.com. (34)
23:17:07.048254 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 70
23:17:07.093019 IP 192.168.5.11.49354 > 8.8.8.8.53: 14679+ A? dns.msftncsi.com. (34)
23:17:07.093066 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:07.093179 IP 192.168.5.11.54930 > 8.8.8.8.53: 12543+ AAAA? dns.msftncsi.com. (34)
23:17:07.221831 ARP, Request who-has 192.168.5.254 (70:ff:76:1d:92:c1) tell 192.168.5.12, length 46
23:17:07.221851 ARP, Reply 192.168.5.254 is-at 70:ff:76:1d:92:c1, length 28
23:17:07.725116 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:07.726312 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:08.720838 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:08.721373 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:09.727460 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:09.727694 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:09.801188 ARP, Request who-has 192.168.5.254 (70:ff:76:1d:92:c1) tell 192.168.5.11, length 46
23:17:09.801206 ARP, Reply 192.168.5.254 is-at 70:ff:76:1d:92:c1, length 28
23:17:10.643648 ARP, Request who-has 192.168.5.254 tell 192.168.5.12, length 46
23:17:10.643705 ARP, Reply 192.168.5.254 is-at 70:ff:76:1d:92:c1, length 28
23:17:10.725714 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:10.726331 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:11.056414 IP 192.168.5.12.52525 > 8.8.8.8.53: 32765+ A? officeclient.microsoft.com. (44)
23:17:11.056507 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 80
23:17:11.092954 IP 192.168.5.11.54930 > 8.8.8.8.53: 12543+ AAAA? dns.msftncsi.com. (34)
23:17:11.093000 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:11.092954 IP 192.168.5.11.49354 > 8.8.8.8.53: 14679+ A? dns.msftncsi.com. (34)
23:17:11.093033 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:11.729354 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:11.729749 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:12.057715 IP 192.168.5.12.52525 > 8.8.8.8.53: 32765+ A? officeclient.microsoft.com. (44)
23:17:12.057802 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 80
23:17:12.723758 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:12.724075 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:13.067624 IP 192.168.5.12.52525 > 8.8.8.8.53: 32765+ A? officeclient.microsoft.com. (44)
23:17:13.067713 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 80
23:17:13.735818 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:13.736247 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:14.733333 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:14.733910 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:15.076955 IP 192.168.5.12.52525 > 8.8.8.8.53: 32765+ A? officeclient.microsoft.com. (44)
23:17:15.077044 IP 192.168.5.254 > 192.168.5.12: ICMP net 8.8.8.8 unreachable, length 80
23:17:15.097513 IP 192.168.5.11.61064 > 8.8.8.8.53: 9793+ AAAA? dns.msftncsi.com. (34)
23:17:15.097553 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:15.127080 IP 192.168.5.11.61064 > 8.8.8.8.53: 9793+ AAAA? dns.msftncsi.com. (34)
23:17:15.127106 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70
23:17:15.733128 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:15.733814 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:16.130301 IP 192.168.5.11.61064 > 8.8.8.8.53: 9793+ AAAA? dns.msftncsi.com. (34)
23:17:16.307947 ARP, Request who-has 192.168.5.12 tell 192.168.5.254, length 28
23:17:16.308145 ARP, Reply 192.168.5.12 is-at 3c:97:0e:ce:9c:4a, length 46
23:17:16.729606 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:16.729912 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:17.728353 ARP, Request who-has 192.168.5.11 tell 192.168.5.12, length 46
23:17:17.728622 ARP, Reply 192.168.5.11 is-at 88:36:6c:fa:d9:15, length 46
23:17:18.139612 IP 192.168.5.11.61064 > 8.8.8.8.53: 9793+ AAAA? dns.msftncsi.com. (34)
23:17:18.139697 IP 192.168.5.254 > 192.168.5.11: ICMP net 8.8.8.8 unreachable, length 70