I'm looking for the person and device that is accessing the 10.0.0.1 on my Network, that is right. I have an Asus Router that has been illegally partitioned by I would assume who configured 10.0.0.1 as a Private IP Address, I have 3 Public IP Address, mine, and in the routing table two others that did not have the same subnet mask but recently that changed. And the Asus router has the standard Private IP Address of 192.168.50.1 but someone configured Port Forwarding to 192.168.1.1 with Vlans and a br0 of that goes to my side of the router because it has the same subnet mask. I realize some of this information has nothing to do with Wireshark, but it lets you know the scenario.
Thank you so very much in advance.
Frame 12: 1292 bytes on wire, 1292 bytes captured on interface \Device\NPF_{6911}, id 0 Interface id: 0 (\Device\NPF_{6911}, Interface name: \Device\NPF_{6911} Interface description: EXTREME MIRACLES Encapsulation type: Ethernet (1) Arrival Time: Jul 17, 2022 12:56:30.504782000 Central Daylight Time [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.443152000 seconds] [Time delta from previous displayed frame: 0.443152000 seconds] [Time since reference or first frame: 0.830789000 seconds] Frame Number: 12 Frame Length: 1292 bytes (10336 bits) Capture Length: 1292 bytes (10336 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:quic:tls:tls:tls:tls:tls:tls:tls:tls:tls:tls:tls] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum.status=="Bad" || edp.checksum.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad"|| sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad"] Ethernet II, Src: Dell_ Dst: ASUSTekC_ Destination: ASUSTekC) Source: Dell_ Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.50.112 (192.168.50.112), Dst: 10.0.0.1 (10.0.0.1) 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1278 Identification: 0x3f35 (16181) Flags: 0x40, Don't fragment 0... .... = Security flag: Not evil .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 128 Protocol: UDP (17) Header Checksum: 0x0000 incorrect, should be 0xb9a0(may be caused by "IP checksum offload"?) [Header checksum status: Bad] [Calculated Checksum: 0xb9a0] Source Address: 192.168.50.112 (192.168.50.112) <source or="" destination="" address:="" 192.168.50.112="" (192.168.50.112)>="" <[source="" host:="" 192.168.50.112]>="" <[source="" or="" destination="" host:="" 192.168.50.112]>="" destination="" address:="" 10.0.0.1="" (10.0.0.1)="" <source="" or="" destination="" address:="" 10.0.0.1="" (10.0.0.1)>="" <[destination="" host:="" 10.0.0.1]>="" <[source="" or="" destination="" host:="" 10.0.0.1]>="" user="" datagram="" protocol,="" src="" port:="" 65178="" (65178),="" dst="" port:="" https="" (443)="" quic="" ietf="" quic="" connection="" information="" [connection="" number:="" 7]="" [packet="" length:="" 1250]="" 1...="" ....="Header" form:="" long="" header="" (1)="" .1..="" ....="Fixed" bit:="" true="" ..00="" ....="Packet" type:="" initial="" (0)="" ....="" 00..="Reserved:" 0="" ....="" ..00="Packet" number="" length:="" 1="" bytes="" (0)="" version:="" 1="" (0x00000001)="" destination="" connection="" id="" length:="" 8="" destination="" connection="" id:="" b5="" b9="" 5b="" f6="" c4="" 09="" 61="" 77="" source="" connection="" id="" length:="" 0="" token="" length:="" 0="" length:="" 1232="" packet="" number:="" 9="" payload:="" 52="" 64="" 2f="" 72="" 11="" bd="" 89="" 62="" a2="" cd="" 38="" 13="" dd="" af="" 06="" 9b="" 30="" 43="" bf="" 58="" a0="" be="" ce="" 9d="" …="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 290="" length:="" 5="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 4="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 4]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 288="" length:="" 1="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 161="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 161]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 271="" length:="" 1="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 187="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 187]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 272="" length:="" 1="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 13="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 13]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 295="" length:="" 1="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 23="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 23]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 289="" length:="" 1="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 480="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 480]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 89="" length:="" 92="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 181="" length:="" 90="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" padding="" length:="" 5="" frame="" type:="" padding="" (0x0000000000000000)="" [padding="" length:="" 5]="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 3="" length:="" 86="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 273="" length:="" 15="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" ping="" frame="" type:="" ping="" (0x0000000000000001)="" crypto="" frame="" type:="" crypto="" (0x0000000000000006)="" offset:="" 0="" length:="" 3="" crypto="" data="" tlsv1.3="" record="" layer:="" handshake="" protocol:="" multiple="" handshake="" messages="" handshake="" protocol:="" encrypted="" extensions="" (fragment)<="" p="">
