text:
透明代理不能正常工作

使用环境：
树莓派最新Lite系统，旁路由，静态IP（192.168.1.64），已经开启IPv4@IPv6转发，上网设备已设置默认网关和DNS为树莓派。
问题描述：
参考v2ray白话文中关于Tproxy配置，透明代理不能工作。上网设备为两台手机，一台能上CN网，一台完全无法联网，周末调试了两天，无法解决问题。v2ray error错误日志在最后
v2ray配置：
{
"log":{
"loglevel": "warning",
"access": "/var/log/v2ray/access.log",
"error": "/var/log/v2ray/error.log"
},
"dns": {
"servers": [
"1.1.1.1",
"8.8.8.8",
"114.114.114.114",
{
"address": "223.5.5.5",
"port": 53,
"domains": [
"geosite:cn",
"ntp.org",
"我的域名"
]
}
]
},
"inbounds": [
{
"tag":"transparent",
"port": 11080,
"protocol": "dokodemo-door",
"settings": {
"network": "tcp,udp",
"followRedirect": true
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
},
"streamSettings": {
"sockopt": {
"tproxy": "tproxy" // 透明代理使用 TPROXY 方式
}
}
},
{
"port": 1080,
"protocol": "socks",
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
},
"settings": {
"auth": "noauth"
}
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "VMess",
"settings": {
"vnext": [
{
"address": "我的域名",
"port": 443,
"users": [
{
"id": "",
"alterId": 64
}
]
}
]
},
"streamSettings": {
"network": "ws",
"security": "tls",
"wsSettings": {
"path": "/"
},
"sockopt": {
"mark": 255
}
},
"mux": {
"enabled": false
}
},
{
"tag": "block",
"protocol": "blackhole",
"settings": {
"response": {
"type": "http"
}
}
},
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"domainStrategy": "UseIP"
},
"streamSettings": {
"sockopt": {
"mark": 255
}
}
},
{
"tag": "dns-out",
"protocol": "dns",
"streamSettings": {
"sockopt": {
"mark": 255
}
}
}
],
"routing": {
"domainStrategy": "IPOnDemand",
"rules": [
{ // 劫持 53 端口 UDP 流量，使用 V2Ray 的 DNS
"type": "field",
"outboundTag": "dns-out",
"inboundTag": [
"transparent"
],
"port": 53,
"network": "udp"
},
{ // 直连 123 端口 UDP 流量（NTP 协议）
"type": "field",
"outboundTag": "direct",
"inboundTag": [
"transparent"
],
"port": 123,
"network": "udp"
},
{
"type": "field",
"outboundTag": "direct",
"ip": [
"223.5.5.5",
"114.114.114.114"
]
},
{
"type": "field",
"outboundTag": "proxy",   // 改为你自己代理的出站 tag
"ip": [
"8.8.8.8",
"1.1.1.1"
]
},
  {  // 广告拦截
    "type": "field",
    "outboundTag": "block",
    "domain": [
      "geosite:category-ads-all"
    ]
  },
  { // BT 流量直连
    "type": "field",
    "protocol":["bittorrent"],
    "outboundTag": "direct"
  },
  {
    "type": "field",
    "outboundTag": "direct",
    "domain": [
      "geosite:cn"
    ]
  },
  {
    "type": "field",
    "outboundTag": "direct",
    "ip": [
      "geoip:cn",
      "geoip:private"
    ]
  }
]

}
}
iptables配置（包括 IP rule和IP router）：
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
V2RAY      all  --  anywhere             anywhere
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
V2RAY_MASK  all  --  anywhere             anywhere
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
Chain V2RAY (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             localhost
RETURN     all  --  anywhere             base-address.mcast.net/4
RETURN     all  --  anywhere             255.255.255.255
RETURN     tcp  --  anywhere             192.168.0.0/16
RETURN     udp  --  anywhere             192.168.0.0/16       udp dpt:!domain
TPROXY     udp  --  anywhere             anywhere             TPROXY redirect 0.0.0.0:11080 mark 0x1/0xffffffff
TPROXY     tcp  --  anywhere             anywhere             TPROXY redirect 0.0.0.0:11080 mark 0x1/0xffffffff
Chain V2RAY_MASK (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             base-address.mcast.net/4
RETURN     all  --  anywhere             255.255.255.255
RETURN     tcp  --  anywhere             192.168.0.0/16
RETURN     udp  --  anywhere             192.168.0.0/16       udp dpt:!domain
RETURN     all  --  anywhere             anywhere             mark match 0xff
MARK       udp  --  anywhere             anywhere             MARK set 0x1
MARK       tcp  --  anywhere             anywhere             MARK set 0x1
root@raspberrypi:~# /usr/bin/v2ray/v2ray -test -config /etc/v2ray/config.json
V2Ray 4.23.1 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.13 linux/arm)
A unified platform for anti-censorship.
2020/05/24 22:23:23 [Info] v2ray.com/core/common/platform/ctlcmd:
v2ctl> Read config:  /etc/v2ray/config.json
Configuration OK.
root@raspberrypi:~# ip rule
0:      from all lookup local
32765:  from all fwmark 0x1 lookup 100
32766:  from all lookup main
32767:  from all lookup default
root@raspberrypi:~# ip route
default via 192.168.1.1 dev wlan0 src 192.168.1.64 metric 303
192.168.1.0/24 dev wlan0 proto dhcp scope link src 192.168.1.64 metric 303
v2ray error日志：
2020/05/24 22:46:09 [Warning] v2ray.com/core: V2Ray 4.23.1 started
2020/05/24 22:46:16 [Warning] v2ray.com/core/app/proxyman/outbound: failed to process outbound traffic > v2ray.com/core/proxy/vmess/outbound: failed to find an available destination > v2ray.com/core/common/retry: [v2ray.com/core/transport/internet/websocket: failed to dial WebSocket > v2ray.com/core/transport/internet/websocket: failed to dial to (wss://我的域名/ray):  > dial tcp: operation was canceled] > v2ray.com/core/common/retry: all retry attempts failed
2020/05/24 22:46:19 [Warning] v2ray.com/core/app/proxyman/outbound: failed to process outbound traffic > v2ray.com/core/proxy/vmess/outbound: failed to find an available destination > v2ray.com/core/common/retry: [v2ray.com/core/transport/internet/websocket: failed to dial WebSocket > v2ray.com/core/transport/internet/websocket: failed to dial to (wss://我的域名/ray):  > dial tcp: operation was canceled] > v2ray.com/core/common/retry: all retry attempts failed
2020/05/24 22:46:19 [Warning] v2ray.com/core/app/proxyman/outbound: failed to process outbound traffic > v2ray.com/core/proxy/vmess/outbound: failed to find an available destination > v2ray.com/core/common/retry: [v2ray.com/core/transport/internet/websocket: failed to dial WebSocket > v2ray.com/core/transport/internet/websocket: failed to dial to (wss://我的域名/ray):  > dial tcp: operation was canceled] > v2ray.com/core/common/retry: all retry attempts failed
设备接入旁路有网关后，短时间v2ray生成大量错误日志，都是如上重复的日志。个人理解是outbound找不到出口，在旁路由内部形成了回环，但是无法定位问题，所以前来求助。

补充一下，在PC的装的v2ray客户端能正常工作，v2ray服务器和客户端均为最新版

打开 info 日志看看，是不是有SO_MARK 设置失败的问题. 如果这个标记没设置成功，就会出现环回。
如果系统iptables支持cgroup2，可以考虑改用-m  cgroup --path来避免环回。如下面这条规则是在systemd环境下的配置，他的含义是来自 v2ray group进程的消息直接出去，不重新路由.
    iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
    iptables -t mangle -A OUTPUT -j V2RAY_MASK

打开 info 日志看看，是不是有SO_MARK 设置失败的问题. 如果这个标记没设置成功，就会出现环回。
如果系统iptables支持cgroup2，可以考虑改用-m cgroup --path来避免环回。如下面这条规则是在systemd环境下的配置，他的含义是来自 v2ray group进程的消息直接出去，不重新路由.
    iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
    iptables -t mangle -A OUTPUT -j V2RAY_MASK

看了一下内核日志，复制出来用mark搜索，后面都接的是=0x1，从来没有0xff，是不是表明没有打上直连标记？

打开 info 日志看看，是不是有SO_MARK 设置失败的问题. 如果这个标记没设置成功，就会出现环回。
如果系统iptables支持cgroup2，可以考虑改用-m cgroup --path来避免环回。如下面这条规则是在systemd环境下的配置，他的含义是来自 v2ray group进程的消息直接出去，不重新路由.
    iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
    iptables -t mangle -A OUTPUT -j V2RAY_MASK

看了一下内核日志，复制出来用mark搜索，后面都接的是=0x1，从来没有0xff，是不是表明没有打上直连标记？

May 25 20:36:47 raspberrypi kernel: [  191.454451] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53610 DF PROTO=UDP SPT=33838 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.454794] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53611 DF PROTO=UDP SPT=51150 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.454795] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53612 DF PROTO=UDP SPT=33838 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.455199] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53614 DF PROTO=UDP SPT=48099 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.455201] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53613 DF PROTO=UDP SPT=33838 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.455687] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53616 DF PROTO=UDP SPT=33838 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.455688] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53615 DF PROTO=UDP SPT=35615 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.456247] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1148 TOS=0x00 PREC=0x00 TTL=64 ID=30563 DF PROTO=TCP SPT=443 DPT=45996 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.456802] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=545 TOS=0x00 PREC=0x00 TTL=64 ID=32313 DF PROTO=TCP SPT=45704 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.456847] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53617 DF PROTO=UDP SPT=57440 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.456863] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=52863 DF PROTO=TCP SPT=443 DPT=45704 WINDOW=509 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.457291] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53619 DF PROTO=UDP SPT=34489 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.457293] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53620 DF PROTO=UDP SPT=41656 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.457294] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53618 DF PROTO=UDP SPT=53441 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.457619] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=268 TOS=0x00 PREC=0x00 TTL=64 ID=11448 DF PROTO=TCP SPT=443 DPT=45574 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.457753] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53621 DF PROTO=UDP SPT=53441 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.458150] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53623 DF PROTO=UDP SPT=50556 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.458152] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53622 DF PROTO=UDP SPT=36421 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.458400] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=648 TOS=0x00 PREC=0x00 TTL=64 ID=24703 DF PROTO=TCP SPT=45882 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.458459] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=50721 DF PROTO=TCP SPT=443 DPT=45882 WINDOW=508 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.458708] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1072 TOS=0x00 PREC=0x00 TTL=64 ID=26644 DF PROTO=TCP SPT=443 DPT=45868 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.458749] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53624 DF PROTO=UDP SPT=56977 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.459503] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53625 DF PROTO=UDP SPT=33584 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.460268] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53626 DF PROTO=UDP SPT=60413 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.460917] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53627 DF PROTO=UDP SPT=48439 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.461236] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=756 TOS=0x00 PREC=0x00 TTL=64 ID=50874 DF PROTO=TCP SPT=45868 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.461294] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=26645 DF PROTO=TCP SPT=443 DPT=45868 WINDOW=507 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.461519] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53628 DF PROTO=UDP SPT=44585 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.461739] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=152 TOS=0x00 PREC=0x00 TTL=64 ID=14467 DF PROTO=TCP SPT=443 DPT=45478 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.462000] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=37375 DF PROTO=TCP SPT=45478 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462046] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=14468 DF PROTO=TCP SPT=443 DPT=45478 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.462131] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=37376 DF PROTO=TCP SPT=45478 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462165] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=14469 DF PROTO=TCP SPT=443 DPT=45478 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.462245] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=37377 DF PROTO=TCP SPT=45478 DPT=443 WINDOW=501 RES=0x00 ACK FIN URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462377] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=64343 DF PROTO=TCP SPT=443 DPT=45416 WINDOW=512 RES=0x00 ACK FIN URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.462417] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=45416 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462553] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53629 DF PROTO=UDP SPT=60413 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462555] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53630 DF PROTO=UDP SPT=52528 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462790] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=826 TOS=0x00 PREC=0x00 TTL=64 ID=1675 DF PROTO=TCP SPT=45996 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.462840] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30564 DF PROTO=TCP SPT=443 DPT=45996 WINDOW=506 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.462957] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53631 DF PROTO=UDP SPT=46449 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463202] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=2018 TOS=0x00 PREC=0x00 TTL=64 ID=38787 DF PROTO=TCP SPT=443 DPT=45686 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.463249] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10734 DF PROTO=TCP SPT=45686 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463255] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53632 DF PROTO=UDP SPT=47988 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463337] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=881 TOS=0x00 PREC=0x00 TTL=64 ID=38789 DF PROTO=TCP SPT=443 DPT=45686 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.463376] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53633 DF PROTO=UDP SPT=54035 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463377] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10735 DF PROTO=TCP SPT=45686 DPT=443 WINDOW=495 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463392] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=14470 DF PROTO=TCP SPT=443 DPT=45478 WINDOW=512 RES=0x00 ACK FIN URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.463455] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=37378 DF PROTO=TCP SPT=45478 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463603] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=38377 DF PROTO=TCP SPT=45574 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463654] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=11449 DF PROTO=TCP SPT=443 DPT=45574 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.463732] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=38378 DF PROTO=TCP SPT=45574 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463765] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=11450 DF PROTO=TCP SPT=443 DPT=45574 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.463844] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=38379 DF PROTO=TCP SPT=45574 DPT=443 WINDOW=501 RES=0x00 ACK FIN URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.463889] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53634 DF PROTO=UDP SPT=38412 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.464477] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53635 DF PROTO=UDP SPT=40842 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.465297] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53636 DF PROTO=UDP SPT=47988 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.465787] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53637 DF PROTO=UDP SPT=53721 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.466265] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53638 DF PROTO=UDP SPT=60225 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.466865] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53639 DF PROTO=UDP SPT=39855 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.467433] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53641 DF PROTO=UDP SPT=37186 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.467435] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53640 DF PROTO=UDP SPT=41801 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.467900] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53642 DF PROTO=UDP SPT=41801 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.468297] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53643 DF PROTO=UDP SPT=38488 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.469976] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53644 DF PROTO=UDP SPT=45965 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.470503] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53645 DF PROTO=UDP SPT=45965 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.470694] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2076 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.470788] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2077 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.471518] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53646 DF PROTO=UDP SPT=41801 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.471946] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53648 DF PROTO=UDP SPT=41801 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.471947] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53647 DF PROTO=UDP SPT=53698 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.472375] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53649 DF PROTO=UDP SPT=41801 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.472376] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53650 DF PROTO=UDP SPT=52034 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.472867] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53652 DF PROTO=UDP SPT=45965 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.472869] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53651 DF PROTO=UDP SPT=60460 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.473285] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53653 DF PROTO=UDP SPT=45965 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.473756] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53654 DF PROTO=UDP SPT=45965 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.474020] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53655 DF PROTO=UDP SPT=60329 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.474572] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53656 DF PROTO=UDP SPT=48495 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475094] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53657 DF PROTO=UDP SPT=34523 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475289] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53658 DF PROTO=UDP SPT=45993 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475564] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53660 DF PROTO=UDP SPT=45993 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475565] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53659 DF PROTO=UDP SPT=51900 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475973] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53662 DF PROTO=UDP SPT=37535 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.475975] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53661 DF PROTO=UDP SPT=45993 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.476366] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53663 DF PROTO=UDP SPT=45993 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.476430] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53664 DF PROTO=UDP SPT=59683 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.476970] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53665 DF PROTO=UDP SPT=35271 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.477591] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53667 DF PROTO=UDP SPT=50382 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.477592] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53666 DF PROTO=UDP SPT=45993 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.477821] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=116 TOS=0x00 PREC=0x00 TTL=64 ID=10736 DF PROTO=TCP SPT=45686 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.477882] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=38790 DF PROTO=TCP SPT=443 DPT=45686 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.478092] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=260 TOS=0x00 PREC=0x00 TTL=64 ID=10737 DF PROTO=TCP SPT=45686 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.478132] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=38791 DF PROTO=TCP SPT=443 DPT=45686 WINDOW=511 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.478265] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53668 DF PROTO=UDP SPT=54690 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.478442] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53669 DF PROTO=UDP SPT=58888 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.478779] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53670 DF PROTO=UDP SPT=40554 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.478781] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53671 DF PROTO=UDP SPT=60264 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.478932] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53672 DF PROTO=UDP SPT=58888 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.479233] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53673 DF PROTO=UDP SPT=60264 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.479395] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53674 DF PROTO=UDP SPT=58888 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.479709] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53675 DF PROTO=UDP SPT=42682 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.480078] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53676 DF PROTO=UDP SPT=41953 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.480314] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53677 DF PROTO=UDP SPT=58888 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.481105] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53678 DF PROTO=UDP SPT=56227 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.481667] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53679 DF PROTO=UDP SPT=58888 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.482016] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=2018 TOS=0x00 PREC=0x00 TTL=64 ID=792 DF PROTO=TCP SPT=443 DPT=45632 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.482083] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30916 DF PROTO=TCP SPT=45632 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.482210] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1137 TOS=0x00 PREC=0x00 TTL=64 ID=794 DF PROTO=TCP SPT=443 DPT=45632 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.482869] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=223.5.5.5 DST=192.168.1.64 LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=43418 DF PROTO=UDP SPT=53 DPT=59880 LEN=55
May 25 20:36:47 raspberrypi kernel: [  191.483069] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1129 TOS=0x00 PREC=0x00 TTL=64 ID=21655 DF PROTO=TCP SPT=443 DPT=46262 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.483107] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=2018 TOS=0x00 PREC=0x00 TTL=64 ID=33103 DF PROTO=TCP SPT=443 DPT=45532 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.483165] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=4873 DF PROTO=TCP SPT=45532 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.483264] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1019 TOS=0x00 PREC=0x00 TTL=64 ID=33105 DF PROTO=TCP SPT=443 DPT=45532 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.483615] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53680 DF PROTO=UDP SPT=33662 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.483774] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53681 DF PROTO=UDP SPT=56471 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.484174] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53682 DF PROTO=UDP SPT=42153 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.484577] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53683 DF PROTO=UDP SPT=46479 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.484579] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53684 DF PROTO=UDP SPT=39065 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.484805] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1072 TOS=0x00 PREC=0x00 TTL=64 ID=35663 DF PROTO=TCP SPT=443 DPT=45956 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.484911] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=2018 TOS=0x00 PREC=0x00 TTL=64 ID=1620 DF PROTO=TCP SPT=443 DPT=45404 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.484966] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=31217 DF PROTO=TCP SPT=45404 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.485066] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=880 TOS=0x00 PREC=0x00 TTL=64 ID=1622 DF PROTO=TCP SPT=443 DPT=45404 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.485107] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=31218 DF PROTO=TCP SPT=45404 DPT=443 WINDOW=495 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.485469] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=242 TOS=0x00 PREC=0x00 TTL=64 ID=25612 DF PROTO=TCP SPT=45956 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.485523] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=35664 DF PROTO=TCP SPT=443 DPT=45956 WINDOW=511 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.485646] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=112 TOS=0x00 PREC=0x00 TTL=64 ID=25613 DF PROTO=TCP SPT=45956 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.485659] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53685 DF PROTO=UDP SPT=57374 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.485683] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=35665 DF PROTO=TCP SPT=443 DPT=45956 WINDOW=511 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.486122] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53686 DF PROTO=UDP SPT=38058 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.486123] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53687 DF PROTO=UDP SPT=46741 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.486580] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53689 DF PROTO=UDP SPT=34904 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.486582] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53688 DF PROTO=UDP SPT=53336 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.486983] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53690 DF PROTO=UDP SPT=38074 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.486984] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53691 DF PROTO=UDP SPT=53336 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.487190] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=404 TOS=0x00 PREC=0x00 TTL=64 ID=62583 DF PROTO=TCP SPT=46262 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.487250] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=21656 DF PROTO=TCP SPT=443 DPT=46262 WINDOW=510 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.487502] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53692 DF PROTO=UDP SPT=51739 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.487961] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53693 DF PROTO=UDP SPT=50624 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.488716] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53694 DF PROTO=UDP SPT=56849 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.490179] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53695 DF PROTO=UDP SPT=60798 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.490889] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53696 DF PROTO=UDP SPT=47876 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.491185] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53698 DF PROTO=UDP SPT=47876 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.491187] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53697 DF PROTO=UDP SPT=60798 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.491602] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53700 DF PROTO=UDP SPT=33519 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.491603] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53699 DF PROTO=UDP SPT=47876 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.492030] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53702 DF PROTO=UDP SPT=35998 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.492031] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53701 DF PROTO=UDP SPT=47876 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.492499] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53703 DF PROTO=UDP SPT=47876 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.492554] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=223.5.5.5 DST=192.168.1.64 LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=43419 DF PROTO=UDP SPT=53 DPT=59880 LEN=55
May 25 20:36:47 raspberrypi kernel: [  191.492667] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2078 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.492782] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2079 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.493018] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53704 DF PROTO=UDP SPT=37115 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.493459] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53705 DF PROTO=UDP SPT=51901 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.493973] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53706 DF PROTO=UDP SPT=60518 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.494528] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53707 DF PROTO=UDP SPT=39601 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.494751] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=25419 DF PROTO=TCP SPT=443 DPT=45986 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.494799] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=64028 DF PROTO=TCP SPT=45986 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.494991] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53708 DF PROTO=UDP SPT=54117 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.495297] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=16771 DF PROTO=TCP SPT=443 DPT=45936 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.495349] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=58188 DF PROTO=TCP SPT=45936 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.495443] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53709 DF PROTO=UDP SPT=54117 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.495839] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53710 DF PROTO=UDP SPT=54117 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.496236] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53711 DF PROTO=UDP SPT=54117 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.496725] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53712 DF PROTO=UDP SPT=54117 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.497370] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53713 DF PROTO=UDP SPT=48131 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.497865] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53714 DF PROTO=UDP SPT=48131 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.499482] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53715 DF PROTO=UDP SPT=34890 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.499889] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53716 DF PROTO=UDP SPT=34890 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.500563] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=64029 DF PROTO=TCP SPT=45986 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.500606] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25420 DF PROTO=TCP SPT=443 DPT=45986 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.500753] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=64030 DF PROTO=TCP SPT=45986 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.500786] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25421 DF PROTO=TCP SPT=443 DPT=45986 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.500859] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=64031 DF PROTO=TCP SPT=45986 DPT=443 WINDOW=501 RES=0x00 ACK FIN URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.501395] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53717 DF PROTO=UDP SPT=47724 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.501839] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53718 DF PROTO=UDP SPT=50301 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.502252] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53719 DF PROTO=UDP SPT=34890 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.502599] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53720 DF PROTO=UDP SPT=34890 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.503761] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53721 DF PROTO=UDP SPT=34890 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.504517] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53722 DF PROTO=UDP SPT=59403 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.504542] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53723 DF PROTO=UDP SPT=55339 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.504950] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53725 DF PROTO=UDP SPT=55559 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.504952] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53724 DF PROTO=UDP SPT=59403 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.505133] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25422 DF PROTO=TCP SPT=443 DPT=45986 WINDOW=512 RES=0x00 ACK FIN URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.505226] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=64032 DF PROTO=TCP SPT=45986 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.505557] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53726 DF PROTO=UDP SPT=55315 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.505833] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1512 TOS=0x00 PREC=0x00 TTL=64 ID=17216 DF PROTO=TCP SPT=443 DPT=45874 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.505888] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10202 DF PROTO=TCP SPT=45874 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.506027] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=1509 TOS=0x00 PREC=0x00 TTL=64 ID=17218 DF PROTO=TCP SPT=443 DPT=45874 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.506187] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=53727 DF PROTO=UDP SPT=50055 DPT=443 LEN=76 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.506246] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=58189 DF PROTO=TCP SPT=45936 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.506281] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16772 DF PROTO=TCP SPT=443 DPT=45936 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.506424] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=58190 DF PROTO=TCP SPT=45936 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.506460] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16773 DF PROTO=TCP SPT=443 DPT=45936 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.506540] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=58191 DF PROTO=TCP SPT=45936 DPT=443 WINDOW=501 RES=0x00 ACK FIN URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.506715] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53728 DF PROTO=UDP SPT=39766 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.507087] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53729 DF PROTO=UDP SPT=48406 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.507088] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53730 DF PROTO=UDP SPT=53060 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.507480] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53731 DF PROTO=UDP SPT=53060 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.507916] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53732 DF PROTO=UDP SPT=53060 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.508278] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53733 DF PROTO=UDP SPT=53060 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.508280] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53734 DF PROTO=UDP SPT=47956 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.508631] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53736 DF PROTO=UDP SPT=53060 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.508632] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53735 DF PROTO=UDP SPT=47956 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.509261] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53737 DF PROTO=UDP SPT=53432 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.509774] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53738 DF PROTO=UDP SPT=57348 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.509998] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16774 DF PROTO=TCP SPT=443 DPT=45936 WINDOW=512 RES=0x00 ACK FIN URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.510080] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=58192 DF PROTO=TCP SPT=45936 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.510090] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53739 DF PROTO=UDP SPT=55042 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.510155] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=11451 DF PROTO=TCP SPT=443 DPT=45574 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.511141] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=116 TOS=0x00 PREC=0x00 TTL=64 ID=31219 DF PROTO=TCP SPT=45404 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511190] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=1623 DF PROTO=TCP SPT=443 DPT=45404 WINDOW=512 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.511255] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53740 DF PROTO=UDP SPT=55042 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511362] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10203 DF PROTO=TCP SPT=45874 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511394] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=260 TOS=0x00 PREC=0x00 TTL=64 ID=31220 DF PROTO=TCP SPT=45404 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511428] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=1624 DF PROTO=TCP SPT=443 DPT=45404 WINDOW=511 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.511674] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=2018 TOS=0x00 PREC=0x00 TTL=64 ID=12359 DF PROTO=TCP SPT=443 DPT=45684 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.511724] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55075 DF PROTO=TCP SPT=45684 DPT=443 WINDOW=501 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511824] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=880 TOS=0x00 PREC=0x00 TTL=64 ID=12361 DF PROTO=TCP SPT=443 DPT=45684 WINDOW=512 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.511862] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55076 DF PROTO=TCP SPT=45684 DPT=443 WINDOW=495 RES=0x00 ACK URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.511897] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53741 DF PROTO=UDP SPT=55042 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.512111] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=223.5.5.5 DST=192.168.1.64 LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=43421 DF PROTO=UDP SPT=53 DPT=59880 LEN=55
May 25 20:36:47 raspberrypi kernel: [  191.512320] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53742 DF PROTO=UDP SPT=55042 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.512684] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53743 DF PROTO=UDP SPT=55042 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.513444] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53744 DF PROTO=UDP SPT=34755 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.513852] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=53745 DF PROTO=UDP SPT=34755 DPT=443 LEN=344 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.513907] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=223.5.5.5 DST=192.168.1.64 LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=43422 DF PROTO=UDP SPT=53 DPT=59880 LEN=55
May 25 20:36:47 raspberrypi kernel: [  191.514013] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2081 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.514090] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=223.5.5.5 LEN=59 TOS=0x00 PREC=0x00 TTL=64 ID=2082 DF PROTO=UDP SPT=59880 DPT=53 LEN=39 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.514167] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=104.31.80.191 LEN=374 TOS=0x00 PREC=0x00 TTL=64 ID=4874 DF PROTO=TCP SPT=45532 DPT=443 WINDOW=501 RES=0x00 ACK PSH URGP=0 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.514210] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=104.31.80.191 DST=192.168.1.64 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=33106 DF PROTO=TCP SPT=443 DPT=45532 WINDOW=510 RES=0x00 ACK URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.515463] IN=wlan0 OUT= MAC=dc:a6:32:ad:80:6d:34:68:95:ee:01:ef:08:00 SRC=192.168.1.100 DST=192.168.1.64 LEN=216 TOS=0x00 PREC=0x00 TTL=128 ID=17179 DF PROTO=TCP SPT=62465 DPT=22 WINDOW=32765 RES=0x00 ACK PSH URGP=0
May 25 20:36:47 raspberrypi kernel: [  191.516000] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53746 DF PROTO=UDP SPT=48425 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.517580] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53747 DF PROTO=UDP SPT=48425 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.518196] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53748 DF PROTO=UDP SPT=50920 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.518784] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53749 DF PROTO=UDP SPT=57414 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.519351] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53750 DF PROTO=UDP SPT=48425 DPT=443 LEN=1358 MARK=0x1
May 25 20:36:47 raspberrypi kernel: [  191.519974] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.64 DST=203.208.43.127 LEN=1378 TOS=0x00 PREC=0x00 TTL=64 ID=53751 DF PROTO=UDP SPT=48425 DPT=443 LEN=1358 MARK=0x1
唉，不会看日志

这种情况更像是时间没有同步，或其他原因导致服务端拒绝？

这种情况更像是时间没有同步，或其他原因导致服务端拒绝？

首先非常感谢。
昨天回去又调试了一个晚上，因为是外行，所以技术原理什么的都不懂，只能摸索。
1、你上面cgroup2，昨天试了一下，我的树莓派官方最新系统（buster）应该是不支持的。
2、服务器拒绝问题，除了时间没有同步问题，我PC的客户端使用正常，是不是表明其他问题可以排除了？
3、服务器的日志我看了，搜索了一下很像时间不同步的问题（之前我做过时间同步，服务器用的纽约的时区，本地用的是北京，手动调整的，时间相差在30S以内，但是还是不行），等晚上回去再试一下吧
现在新的疑问是，透明代理环境下，一旦服务器reject连接，在开启iptables的日志情况下，会在本地短时间形成大量的日志文件吗（一度达到了近2G，如果不手动停止的话，估计还会继续下去）？包括v2ray的error日志也是不断的生成，同样文件也会积累到很大，导致我不能用winSCP打开(目前用wifi连接到局域网)。

buster 应该是支持的, 我用的也是这个版本，只是不是树莓派的
root@A1:~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

内核默认支持cgroup的过滤
root@A1:~# cp /proc/config.gz /tmp/
root@A1:~# gunzip /tmp/config.gz
root@A1:~# grep -i xt_ /tmp/config | grep -i cgroup
CONFIG_NETFILTER_XT_MATCH_CGROUP=y

iptables版本
root@A1:~# iptables --version
iptables v1.8.2 (nf_tables)

v2ray通过systemd启动,启动后, 可以看到cgroup下有这个服务的信息
root@A1:~# ls /sys/fs/cgroup/systemd/system.slice/v2ray.service/
cgroup.clone_children  cgroup.procs  notify_on_release  tasks

另外，防火墙设置需要在v2ray启动后设置，否则cgoup不存在可能会导致规则不生效。
我的做法是增加下面文件来完成：
root@A1:~# cat /etc/systemd/system/v2ray.service.d/02_tproxy.conf
[Service]
ExecStartPost=-+/bin/bash /usr/bin/v2ray_firewall start
ExecStopPost=-+/bin/bash /usr/bin/v2ray_firewall stop
LimitNPROC=500
LimitNOFILE=1000000

v2ray_firewall是简单的创建防火墙规则的shell脚本，需要自己实现。
日志增长速度太快，这种还是可能存在环路，建议
先不要配置防火墙，看socks是否可以正常和服务端连接.
时间同步最好是开启ntp服务，让系统自动同步,这是一劳永逸的方法。参见systemd-timesyncd.service

我没开access log 所以不确定日志的大小问题，这部分没有经验。

root@raspberrypi:~# iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
iptables v1.8.2 (nf_tables): Couldn't load match `cgroup':No such file or directory
是不是不支持的意思？

root@raspberrypi:~# iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
iptables v1.8.2 (nf_tables): Couldn't load match `cgroup':No such file or directory
是不是不支持的意思？

可能是v2ray还没启动，对应的cgroup路径不存在

root@raspberrypi:~# iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
iptables v1.8.2 (nf_tables): Couldn't load match `cgroup':No such file or directory
是不是不支持的意思？

可能是v2ray还没启动，对应的cgroup路径不存在

我的iptables 版本和你的一样，

这个我是可以重现的，但是和iptables连用就出现上面的问题

之前给出的命令有问题, 应该是ls /sys/fs/cgroup/unified/system.slice/v2ray.service 因为cgourp v2的根路径是/sys/fs/cgroup/unified.
估计应该也是有的。
这种情况，可以从两个方面进行进一步的分析

通过strace命令跟踪iptable的执行过程，看报错点上下有什么特殊的线索
strace iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN

查看dmesg的输出，看有什么报错

另外，除了通过cgoup过滤这个方法，还可以让v2ray在专门的用户下运行，通过用户名来过滤，参考这里https://github.com/Dreamacro/clash/issues/158#issuecomment-480444965

root@raspberrypi:~# ls /sys/fs/cgroup/unified/system.slice/v2ray.service cgroup.controllers  cgroup.max.descendants  cgroup.subtree_control  cpu.stat cgroup.events       cgroup.procs            cgroup.threads cgroup.max.depth    cgroup.stat             cgroup.type root@raspberrypi:~# strace iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN execve("/usr/sbin/iptables", ["iptables", "-t", "mangle", "-A", "OUTPUT", "-m", "cgroup", "--path", "system.slice/v2ray.service", "-j", "RETURN"], 0xbe8ef778 /* 18 vars                                                                      */) = 0 brk(NULL)                               = 0x162000 uname({sysname="Linux", nodename="raspberrypi", ...}) = 0 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f12000 access("/etc/ld.so.preload", R_OK)      = 0 openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=54, ...}) = 0 mmap2(NULL, 54, PROT_READ|PROT_WRITE, MAP_PRIVATE, 3, 0) = 0xb6f11000 close(3)                                = 0 readlink("/proc/self/exe", "/usr/sbin/xtables-nft-multi", 4096) = 27 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libarmmem-v7l.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\254\3\0\0004\0\0\0"..., 512) = 512 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 _llseek(3, 16748, [16748], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960 _llseek(3, 16424, [16424], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45 fstat64(3, {st_mode=S_IFREG|0644, st_size=17708, ...}) = 0 mmap2(NULL, 81964, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6ecf000 mprotect(0xb6ed3000, 61440, PROT_NONE)  = 0 mmap2(0xb6ee2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ee2000 close(3)                                = 0 munmap(0xb6f11000, 54)                  = 0 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=27697, ...}) = 0 mmap2(NULL, 27697, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb6f0b000 close(3)                                = 0 openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libmnl.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0004\25\0\0004\0\0\0"..., 512) = 512 _llseek(3, 16736, [16736], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 16388, [16388], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 16736, [16736], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 16388, [16388], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 16736, [16736], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 16388, [16388], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 16736, [16736], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 16388, [16388], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 16736, [16736], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 16388, [16388], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 fstat64(3, {st_mode=S_IFREG|0644, st_size=17816, ...}) = 0 mmap2(NULL, 81928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6eba000 mprotect(0xb6ebe000, 61440, PROT_NONE)  = 0 mmap2(0xb6ecd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ecd000 close(3)                                = 0 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnftnl.so.11", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\314Z\0\0004\0\0\0"..., 512) = 512 _llseek(3, 133060, [133060], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 132712, [132712], SEEK_SET)  = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 133060, [133060], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 132712, [132712], SEEK_SET)  = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 133060, [133060], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 132712, [132712], SEEK_SET)  = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 133060, [133060], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 132712, [132712], SEEK_SET)  = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 133060, [133060], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 132712, [132712], SEEK_SET)  = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 fstat64(3, {st_mode=S_IFREG|0644, st_size=134100, ...}) = 0 mmap2(NULL, 198252, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e89000 mprotect(0xb6ea8000, 61440, PROT_NONE)  = 0 mmap2(0xb6eb7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e000) = 0xb6eb7000 close(3)                                = 0 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnetfilter_conntrack.so.3", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\330<\0\0004\0\0\0"..., 512) = 512 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 _llseek(3, 91016, [91016], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800 _llseek(3, 90724, [90724], SEEK_SET)    = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47 fstat64(3, {st_mode=S_IFREG|0644, st_size=91816, ...}) = 0 mmap2(NULL, 156308, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e62000 mprotect(0xb6e78000, 61440, PROT_NONE)  = 0 mmap2(0xb6e87000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0xb6e87000 close(3)                                = 0 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnfnetlink.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\08\22\0\0004\0\0\0"..., 512) = 512 _llseek(3, 20936, [20936], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680 _llseek(3, 20672, [20672], SEEK_SET)    = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49 _llseek(3, 20936, [20936], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680 _llseek(3, 20672, [20672], SEEK_SET)    = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49 _llseek(3, 20936, [20936], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680 _llseek(3, 20672, [20672], SEEK_SET)    = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49 _llseek(3, 20936, [20936], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680 _llseek(3, 20672, [20672], SEEK_SET)    = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49 _llseek(3, 20936, [20936], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680 _llseek(3, 20672, [20672], SEEK_SET)    = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49 fstat64(3, {st_mode=S_IFREG|0644, st_size=21616, ...}) = 0 mmap2(NULL, 53440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e54000 mprotect(0xb6e59000, 28672, PROT_NONE)  = 0 mmap2(0xb6e60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0xb6e60000 close(3)                                = 0 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libxtables.so.12", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\370$\0\0004\0\0\0"..., 512) = 512 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(3, 45408, [45408], SEEK_SET)    = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040 _llseek(3, 45064, [45064], SEEK_SET)    = 0 read(3, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 fstat64(3, {st_mode=S_IFREG|0644, st_size=46448, ...}) = 0 mmap2(NULL, 121636, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e36000 mprotect(0xb6e41000, 61440, PROT_NONE)  = 0 mmap2(0xb6e50000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa000) = 0xb6e50000 mmap2(0xb6e52000, 6948, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6e52000 close(3)                                = 0 openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libm.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\240r\0\0004\0\0\0"..., 512) = 512 _llseek(3, 463312, [463312], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 462960, [462960], SEEK_SET)  = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49 _llseek(3, 463312, [463312], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 462960, [462960], SEEK_SET)  = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49 _llseek(3, 463312, [463312], SEEK_SET)  = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 462960, [462960], SEEK_SET)  = 0 read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49 fstat64(3, {st_mode=S_IFREG|0644, st_size=464392, ...}) = 0 mmap2(NULL, 528504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6db4000 mprotect(0xb6e25000, 61440, PROT_NONE)  = 0 mmap2(0xb6e34000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0xb6e34000 close(3)                                = 0 openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\300x\1\0004\0\0\0"..., 512) = 512 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 1293204, [1293204], SEEK_SET) = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800 _llseek(3, 1289788, [1289788], SEEK_SET) = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 fstat64(3, {st_mode=S_IFREG|0755, st_size=1296004, ...}) = 0 mmap2(NULL, 1364764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c66000 mprotect(0xb6d9e000, 65536, PROT_NONE)  = 0 mmap2(0xb6dae000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x138000) = 0xb6dae000 mmap2(0xb6db1000, 8988, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6db1000 close(3)                                = 0 openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libdl.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0 \n\0\0004\0\0\0"..., 512) = 512 _llseek(3, 8688, [8688], SEEK_SET)      = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 8340, [8340], SEEK_SET)      = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 8688, [8688], SEEK_SET)      = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 8340, [8340], SEEK_SET)      = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 _llseek(3, 8688, [8688], SEEK_SET)      = 0 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080 _llseek(3, 8340, [8340], SEEK_SET)      = 0 read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47 fstat64(3, {st_mode=S_IFREG|0644, st_size=9768, ...}) = 0 mmap2(NULL, 73924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c53000 mprotect(0xb6c55000, 61440, PROT_NONE)  = 0 mmap2(0xb6c64000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb6c64000 close(3)                                = 0 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f09000 set_tls(0xb6f09a90)                     = 0 mprotect(0xb6dae000, 8192, PROT_READ)   = 0 mprotect(0xb6c64000, 4096, PROT_READ)   = 0 mprotect(0xb6e34000, 4096, PROT_READ)   = 0 mprotect(0xb6e50000, 4096, PROT_READ)   = 0 mprotect(0xb6e60000, 4096, PROT_READ)   = 0 mprotect(0xb6ecd000, 4096, PROT_READ)   = 0 mprotect(0xb6e87000, 4096, PROT_READ)   = 0 mprotect(0xb6eb7000, 8192, PROT_READ)   = 0 mprotect(0xb6ee2000, 4096, PROT_READ)   = 0 mprotect(0x47000, 4096, PROT_READ)      = 0 mprotect(0xb6f14000, 4096, PROT_READ)   = 0 munmap(0xb6f0b000, 27697)               = 0 brk(NULL)                               = 0x162000 brk(0x183000)                           = 0x183000 socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3 bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0 getsockname(3, {sa_family=AF_NETLINK, nl_pid=996, nl_groups=00000000}, [12]) = 0 stat64("/usr/lib/arm-linux-gnueabihf/xtables/libipt_cgroup.so", 0xbe9110f8) = -1 ENOENT (No such file or directory) stat64("/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0,\5\0\0004\0\0\0"..., 512) = 512 _llseek(4, 4732, [4732], SEEK_SET)      = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000 _llseek(4, 4400, [4400], SEEK_SET)      = 0 read(4, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(4, 4732, [4732], SEEK_SET)      = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000 _llseek(4, 4400, [4400], SEEK_SET)      = 0 read(4, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(4, 4732, [4732], SEEK_SET)      = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000 _llseek(4, 4400, [4400], SEEK_SET)      = 0 read(4, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(4, 4732, [4732], SEEK_SET)      = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000 _llseek(4, 4400, [4400], SEEK_SET)      = 0 read(4, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 _llseek(4, 4732, [4732], SEEK_SET)      = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000 _llseek(4, 4400, [4400], SEEK_SET)      = 0 read(4, "A,\0\0\0aeabi\0\1\"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45 fstat64(4, {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0 mmap2(NULL, 69940, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb6c41000 mprotect(0xb6c42000, 61440, PROT_NONE)  = 0 mmap2(0xb6c51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0xb6c51000 close(4)                                = 0 mprotect(0xb6c51000, 4096, PROT_READ)   = 0 gettimeofday({tv_sec=1590585661, tv_usec=646382}, NULL) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4 bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0 getsockname(4, {sa_family=AF_NETLINK, nl_pid=-62603628, nl_groups=00000000}, [12]) = 0 sendto(4, {{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x00                                                                     \x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=4                                                                     232363668}, {error=-ENOENT, msg={{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 close(4)                                = 0 gettimeofday({tv_sec=1590585661, tv_usec=662172}, NULL) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4 bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0 getsockname(4, {sa_family=AF_NETLINK, nl_pid=-372981224, nl_groups=00000000}, [12]) = 0 sendto(4, {{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     921986072}, {error=-ENOENT, msg={{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 close(4)                                = 0 gettimeofday({tv_sec=1590585661, tv_usec=678020}, NULL) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4 bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0 getsockname(4, {sa_family=AF_NETLINK, nl_pid=-408350909, nl_groups=00000000}, [12]) = 0 sendto(4, {{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     886616387}, {error=-ENOENT, msg={{len=48, type=0xb00 /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 close(4)                                = 0 write(2, "iptables v1.8.2 (nf_tables): ", 29iptables v1.8.2 (nf_tables): ) = 29 write(2, "Couldn't load match cgroup':No "..., 55Couldn't load match cgroup':No such file or directory ) = 55 write(2, "\n", 1 )                       = 1 write(2, "Try iptables -h' or 'iptables -"..., 61Try iptables -h' or 'iptables --help' for more information.

root@raspberrypi:~# ls /sys/fs/cgroup/unified/system.slice/v2ray.service
cgroup.controllers  cgroup.max.descendants  cgroup.subtree_control  cpu.stat
cgroup.events       cgroup.procs            cgroup.threads
cgroup.max.depth    cgroup.stat             cgroup.type
root@raspberrypi:~# strace iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
execve("/usr/sbin/iptables", ["iptables", "-t", "mangle", "-A", "OUTPUT", "-m", "cgroup", "--path", "system.slice/v2ray.service", "-j", "RETURN"], 0xbe8ef778 /* 18 vars                                                                      /) = 0
brk(NULL)                               = 0x162000
uname({sysname="Linux", nodename="raspberrypi", ...}) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f12000
access("/etc/ld.so.preload", R_OK)      = 0
openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=54, ...}) = 0
mmap2(NULL, 54, PROT_READ|PROT_WRITE, MAP_PRIVATE, 3, 0) = 0xb6f11000
close(3)                                = 0
readlink("/proc/self/exe", "/usr/sbin/xtables-nft-multi", 4096) = 27
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libarmmem-v7l.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\254\3\0\0004\0\0\0"..., 512) = 512
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=17708, ...}) = 0
mmap2(NULL, 81964, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6ecf000
mprotect(0xb6ed3000, 61440, PROT_NONE)  = 0
mmap2(0xb6ee2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ee2000
close(3)                                = 0
munmap(0xb6f11000, 54)                  = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=27697, ...}) = 0
mmap2(NULL, 27697, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb6f0b000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libmnl.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0004\25\0\0004\0\0\0"..., 512) = 512
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=17816, ...}) = 0
mmap2(NULL, 81928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6eba000
mprotect(0xb6ebe000, 61440, PROT_NONE)  = 0
mmap2(0xb6ecd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ecd000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnftnl.so.11", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\314Z\0\0004\0\0\0"..., 512) = 512
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=134100, ...}) = 0
mmap2(NULL, 198252, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e89000
mprotect(0xb6ea8000, 61440, PROT_NONE)  = 0
mmap2(0xb6eb7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e000) = 0xb6eb7000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnetfilter_conntrack.so.3", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\330<\0\0004\0\0\0"..., 512) = 512
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0644, st_size=91816, ...}) = 0
mmap2(NULL, 156308, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e62000
mprotect(0xb6e78000, 61440, PROT_NONE)  = 0
mmap2(0xb6e87000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0xb6e87000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnfnetlink.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\08\22\0\0004\0\0\0"..., 512) = 512
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
fstat64(3, {st_mode=S_IFREG|0644, st_size=21616, ...}) = 0
mmap2(NULL, 53440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e54000
mprotect(0xb6e59000, 28672, PROT_NONE)  = 0
mmap2(0xb6e60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0xb6e60000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libxtables.so.12", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\370$\0\0004\0\0\0"..., 512) = 512
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=46448, ...}) = 0
mmap2(NULL, 121636, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e36000
mprotect(0xb6e41000, 61440, PROT_NONE)  = 0
mmap2(0xb6e50000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa000) = 0xb6e50000
mmap2(0xb6e52000, 6948, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6e52000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libm.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\240r\0\0004\0\0\0"..., 512) = 512
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
fstat64(3, {st_mode=S_IFREG|0644, st_size=464392, ...}) = 0
mmap2(NULL, 528504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6db4000
mprotect(0xb6e25000, 61440, PROT_NONE)  = 0
mmap2(0xb6e34000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0xb6e34000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\300x\1\0004\0\0\0"..., 512) = 512
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0755, st_size=1296004, ...}) = 0
mmap2(NULL, 1364764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c66000
mprotect(0xb6d9e000, 65536, PROT_NONE)  = 0
mmap2(0xb6dae000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x138000) = 0xb6dae000
mmap2(0xb6db1000, 8988, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6db1000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libdl.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0 \n\0\0004\0\0\0"..., 512) = 512
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0644, st_size=9768, ...}) = 0
mmap2(NULL, 73924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c53000
mprotect(0xb6c55000, 61440, PROT_NONE)  = 0
mmap2(0xb6c64000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb6c64000
close(3)                                = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f09000
set_tls(0xb6f09a90)                     = 0
mprotect(0xb6dae000, 8192, PROT_READ)   = 0
mprotect(0xb6c64000, 4096, PROT_READ)   = 0
mprotect(0xb6e34000, 4096, PROT_READ)   = 0
mprotect(0xb6e50000, 4096, PROT_READ)   = 0
mprotect(0xb6e60000, 4096, PROT_READ)   = 0
mprotect(0xb6ecd000, 4096, PROT_READ)   = 0
mprotect(0xb6e87000, 4096, PROT_READ)   = 0
mprotect(0xb6eb7000, 8192, PROT_READ)   = 0
mprotect(0xb6ee2000, 4096, PROT_READ)   = 0
mprotect(0x47000, 4096, PROT_READ)      = 0
mprotect(0xb6f14000, 4096, PROT_READ)   = 0
munmap(0xb6f0b000, 27697)               = 0
brk(NULL)                               = 0x162000
brk(0x183000)                           = 0x183000
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3
bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(3, {sa_family=AF_NETLINK, nl_pid=996, nl_groups=00000000}, [12]) = 0
stat64("/usr/lib/arm-linux-gnueabihf/xtables/libipt_cgroup.so", 0xbe9110f8) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 4
read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0,\5\0\0004\0\0\0"..., 512) = 512
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(4, {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0
mmap2(NULL, 69940, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb6c41000
mprotect(0xb6c42000, 61440, PROT_NONE)  = 0
mmap2(0xb6c51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0xb6c51000
close(4)                                = 0
mprotect(0xb6c51000, 4096, PROT_READ)   = 0
gettimeofday({tv_sec=1590585661, tv_usec=646382}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-62603628, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x00                                                                     \x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=4                                                                     232363668}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
gettimeofday({tv_sec=1590585661, tv_usec=662172}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-372981224, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     921986072}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
gettimeofday({tv_sec=1590585661, tv_usec=678020}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-408350909, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     886616387}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
write(2, "iptables v1.8.2 (nf_tables): ", 29iptables v1.8.2 (nf_tables): ) = 29
write(2, "Couldn't load match cgroup':No "..., 55Couldn't load match cgroup':No such file or directory
) = 55
write(2, "\n", 1
)                       = 1
write(2, "Try iptables -h' or 'iptables -"..., 61Try iptables -h' or 'iptables --help' for more information.

root@raspberrypi:~# ls /sys/fs/cgroup/unified/system.slice/v2ray.service
cgroup.controllers  cgroup.max.descendants  cgroup.subtree_control  cpu.stat
cgroup.events       cgroup.procs            cgroup.threads
cgroup.max.depth    cgroup.stat             cgroup.type
root@raspberrypi:~# strace iptables -t mangle -A OUTPUT -m cgroup --path system.slice/v2ray.service -j RETURN
execve("/usr/sbin/iptables", ["iptables", "-t", "mangle", "-A", "OUTPUT", "-m", "cgroup", "--path", "system.slice/v2ray.service", "-j", "RETURN"], 0xbe8ef778 /* 18 vars                                                                      /) = 0
brk(NULL)                               = 0x162000
uname({sysname="Linux", nodename="raspberrypi", ...}) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f12000
access("/etc/ld.so.preload", R_OK)      = 0
openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=54, ...}) = 0
mmap2(NULL, 54, PROT_READ|PROT_WRITE, MAP_PRIVATE, 3, 0) = 0xb6f11000
close(3)                                = 0
readlink("/proc/self/exe", "/usr/sbin/xtables-nft-multi", 4096) = 27
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libarmmem-v7l.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\254\3\0\0004\0\0\0"..., 512) = 512
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
_llseek(3, 16748, [16748], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 960) = 960
_llseek(3, 16424, [16424], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\2\n\3\f\1\22\4\24"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=17708, ...}) = 0
mmap2(NULL, 81964, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6ecf000
mprotect(0xb6ed3000, 61440, PROT_NONE)  = 0
mmap2(0xb6ee2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ee2000
close(3)                                = 0
munmap(0xb6f11000, 54)                  = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=27697, ...}) = 0
mmap2(NULL, 27697, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb6f0b000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libmnl.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0004\25\0\0004\0\0\0"..., 512) = 512
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 16736, [16736], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 16388, [16388], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=17816, ...}) = 0
mmap2(NULL, 81928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6eba000
mprotect(0xb6ebe000, 61440, PROT_NONE)  = 0
mmap2(0xb6ecd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xb6ecd000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnftnl.so.11", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\314Z\0\0004\0\0\0"..., 512) = 512
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 133060, [133060], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 132712, [132712], SEEK_SET)  = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=134100, ...}) = 0
mmap2(NULL, 198252, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e89000
mprotect(0xb6ea8000, 61440, PROT_NONE)  = 0
mmap2(0xb6eb7000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e000) = 0xb6eb7000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnetfilter_conntrack.so.3", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\330<\0\0004\0\0\0"..., 512) = 512
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
_llseek(3, 91016, [91016], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 800) = 800
_llseek(3, 90724, [90724], SEEK_SET)    = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0644, st_size=91816, ...}) = 0
mmap2(NULL, 156308, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e62000
mprotect(0xb6e78000, 61440, PROT_NONE)  = 0
mmap2(0xb6e87000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0xb6e87000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnfnetlink.so.0", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\08\22\0\0004\0\0\0"..., 512) = 512
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
_llseek(3, 20936, [20936], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 680) = 680
_llseek(3, 20672, [20672], SEEK_SET)    = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 49) = 49
fstat64(3, {st_mode=S_IFREG|0644, st_size=21616, ...}) = 0
mmap2(NULL, 53440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e54000
mprotect(0xb6e59000, 28672, PROT_NONE)  = 0
mmap2(0xb6e60000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0xb6e60000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libxtables.so.12", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\370$\0\0004\0\0\0"..., 512) = 512
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(3, 45408, [45408], SEEK_SET)    = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1040) = 1040
_llseek(3, 45064, [45064], SEEK_SET)    = 0
read(3, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(3, {st_mode=S_IFREG|0644, st_size=46448, ...}) = 0
mmap2(NULL, 121636, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6e36000
mprotect(0xb6e41000, 61440, PROT_NONE)  = 0
mmap2(0xb6e50000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa000) = 0xb6e50000
mmap2(0xb6e52000, 6948, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6e52000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libm.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\240r\0\0004\0\0\0"..., 512) = 512
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
_llseek(3, 463312, [463312], SEEK_SET)  = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 462960, [462960], SEEK_SET)  = 0
read(3, "A0\0\0\0aeabi\0\1&\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 49) = 49
fstat64(3, {st_mode=S_IFREG|0644, st_size=464392, ...}) = 0
mmap2(NULL, 528504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6db4000
mprotect(0xb6e25000, 61440, PROT_NONE)  = 0
mmap2(0xb6e34000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0xb6e34000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\300x\1\0004\0\0\0"..., 512) = 512
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 1293204, [1293204], SEEK_SET) = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2800) = 2800
_llseek(3, 1289788, [1289788], SEEK_SET) = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0755, st_size=1296004, ...}) = 0
mmap2(NULL, 1364764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c66000
mprotect(0xb6d9e000, 65536, PROT_NONE)  = 0
mmap2(0xb6dae000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x138000) = 0xb6dae000
mmap2(0xb6db1000, 8988, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb6db1000
close(3)                                = 0
openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libdl.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0 \n\0\0004\0\0\0"..., 512) = 512
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
_llseek(3, 8688, [8688], SEEK_SET)      = 0
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1080) = 1080
_llseek(3, 8340, [8340], SEEK_SET)      = 0
read(3, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\23\1\24"..., 47) = 47
fstat64(3, {st_mode=S_IFREG|0644, st_size=9768, ...}) = 0
mmap2(NULL, 73924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb6c53000
mprotect(0xb6c55000, 61440, PROT_NONE)  = 0
mmap2(0xb6c64000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb6c64000
close(3)                                = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f09000
set_tls(0xb6f09a90)                     = 0
mprotect(0xb6dae000, 8192, PROT_READ)   = 0
mprotect(0xb6c64000, 4096, PROT_READ)   = 0
mprotect(0xb6e34000, 4096, PROT_READ)   = 0
mprotect(0xb6e50000, 4096, PROT_READ)   = 0
mprotect(0xb6e60000, 4096, PROT_READ)   = 0
mprotect(0xb6ecd000, 4096, PROT_READ)   = 0
mprotect(0xb6e87000, 4096, PROT_READ)   = 0
mprotect(0xb6eb7000, 8192, PROT_READ)   = 0
mprotect(0xb6ee2000, 4096, PROT_READ)   = 0
mprotect(0x47000, 4096, PROT_READ)      = 0
mprotect(0xb6f14000, 4096, PROT_READ)   = 0
munmap(0xb6f0b000, 27697)               = 0
brk(NULL)                               = 0x162000
brk(0x183000)                           = 0x183000
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3
bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(3, {sa_family=AF_NETLINK, nl_pid=996, nl_groups=00000000}, [12]) = 0
stat64("/usr/lib/arm-linux-gnueabihf/xtables/libipt_cgroup.so", 0xbe9110f8) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0
openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/xtables/libxt_cgroup.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 4
read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0,\5\0\0004\0\0\0"..., 512) = 512
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
_llseek(4, 4732, [4732], SEEK_SET)      = 0
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1000) = 1000
_llseek(4, 4400, [4400], SEEK_SET)      = 0
read(4, "A,\0\0\0aeabi\0\1"\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., 45) = 45
fstat64(4, {st_mode=S_IFREG|0644, st_size=5732, ...}) = 0
mmap2(NULL, 69940, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb6c41000
mprotect(0xb6c42000, 61440, PROT_NONE)  = 0
mmap2(0xb6c51000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0xb6c51000
close(4)                                = 0
mprotect(0xb6c51000, 4096, PROT_READ)   = 0
gettimeofday({tv_sec=1590585661, tv_usec=646382}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-62603628, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x00                                                                     \x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=4                                                                     232363668}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
gettimeofday({tv_sec=1590585661, tv_usec=662172}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-372981224, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     921986072}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
gettimeofday({tv_sec=1590585661, tv_usec=678020}, NULL) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=-408350909, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=48, type=0xb00 / NLMSG_??? /, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x72\x6f\x75\x70\x00\x5e                                                                     \x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}, 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=68, type=NLMSG_ERROR, flags=0, seq=1590585661, pid=3                                                                     886616387}, {error=-ENOENT, msg={{len=48, type=0xb00 / NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1590585661, pid=0}, "\x02\x00\x00\x00\x0b\x00\x01\x00\x63\x67\x                                                                     72\x6f\x75\x70\x00\x5e\x08\x00\x02\x00\x00\x00\x00\x02\x08\x00\x03\x00\x00\x00\x00\x00"}}}, iov_len=16536}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68
close(4)                                = 0
write(2, "iptables v1.8.2 (nf_tables): ", 29iptables v1.8.2 (nf_tables): ) = 29
write(2, "Couldn't load match cgroup':No "..., 55Couldn't load match cgroup':No such file or directory
) = 55
write(2, "\n", 1
)                       = 1
write(2, "Try iptables -h' or 'iptables -"..., 61Try iptables -h' or 'iptables --help' for more information.

从报错点看，应该是内核返回的报错，核对一下xt_cgroup配置是y还是m，如果是m，需要手动加载一下。

如果是y，那可能是内核的问题，或systemd的问题？查看系统是否更新到了最新版本.  这方面我也没有什么思路了。
我这边用的是5.4.32内核，241版本systemd没有问题。
root@A1:~# uname -a
Linux A1 5.4.32-rockchip64 #20.02.11 SMP PREEMPT Tue Apr 14 17:30:19 CEST 2020 aarch64 GNU/Linux
root@A1:~# systemctl --version
systemd 241 (241)
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid

从报错点看，应该是内核返回的报错，核对一下xt_cgroup配置是y还是m，如果是m，需要手动加载一下。

如果是y，那可能是内核的问题，或systemd的问题？查看系统是否更新到了最新版本. 这方面我也没有什么思路了。
我这边用的是5.4.32内核，241版本systemd没有问题。
root@A1:~# uname -a
Linux A1 5.4.32-rockchip64 #20.02.11 SMP PREEMPT Tue Apr 14 17:30:19 CEST 2020 aarch64 GNU/Linux
root@A1:~# systemctl --version
systemd 241 (241)
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid

今天无意中搜到，应该是最新版本的问题，https://github.com/v2ray/v2ray-core/issues/2378

应该是解决问题了，我的v2ray用的是在线脚本安装的，最新的V4.23.1的官方脚本的 v2ray.service 配置有问题，不能做so_mark标记，按照前楼的方法，已经解决问题。现在是墙过不去，应该是我的v2ray配置有问题，阿里的DNS服务器不能解析我的域名，回去之后改一下试试看是不是完全ok了，当然这是另外一个问题了

应该是解决问题了，我的v2ray用的是在线脚本安装的，最新的V4.23.1的官方脚本的 v2ray.service 配置有问题，不能做so_mark标记，按照前楼的方法，已经解决问题。现在是墙过不去，应该是我的v2ray配置有问题，阿里的DNS服务器不能解析我的域名，回去之后改一下试试看是不是完全ok了，当然这是另外一个问题了

之前疏忽没测试透明代理相关导致的问题，抱歉

authors: jerry-ch-issue lisongmin unknowndev233