These are examples of tcpdump output showing the different forms of interception.
09:49:16.614785 IP 8.8.8.8.53 > 108.214.94.90.46810: 2859* 1/0/1 A 192.168.1.254 (68)
09:49:17.464706 IP 8.8.8.8.53 > 108.214.94.90.44573: 44048* 1/0/0 A 192.168.1.254 (56)
09:49:17.464858 IP 8.8.8.8.53 > 108.214.94.90.44573: 44048* 1/0/0 A 192.168.1.254 (56)
09:49:17.464946 IP 8.8.4.4.53 > 108.214.94.90.44573: 44048* 1/0/0 A 192.168.1.254 (56)
09:49:17.465087 IP 8.8.4.4.53 > 108.214.94.90.44573: 44048* 1/0/0 A 192.168.1.254 (56)
09:49:20.953051 IP 8.8.8.8.53 > 108.214.94.90.54446: 59242* 1/0/0 A 192.168.1.254 (49)
09:49:21.849814 IP 8.8.8.8.53 > 108.214.94.90.57584: 17238* 1/0/0 A 192.168.1.254 (54)
09:49:22.713480 IP 8.8.8.8.53 > 108.214.94.90.48468: 48176* 1/0/0 A 192.168.1.254 (62)
09:49:22.715184 IP 8.8.8.8.53 > 108.214.94.90.23875: 58856* 1/0/0 A 192.168.1.254 (62)
09:49:22.717659 IP 8.8.8.8.53 > 108.214.94.90.57335: 3846* 1/0/0 A 192.168.1.254 (62)
09:49:22.723833 IP 8.8.4.4.53 > 108.214.94.90.63224: 14169* 1/0/0 A 192.168.1.254 (62)
09:49:22.725160 IP 8.8.8.8.53 > 108.214.94.90.40049: 32958* 1/0/0 A 192.168.1.254 (62)
09:49:22.733485 IP 8.8.8.8.53 > 108.214.94.90.31781: 58946* 1/0/0 A 192.168.1.254 (62)
09:49:22.733527 IP 8.8.8.8.53 > 108.214.94.90.54613: 6004* 1/0/0 A 192.168.1.254 (62)
09:49:22.733749 IP 8.8.4.4.53 > 108.214.94.90.61024: 37506* 1/0/0 A 192.168.1.254 (62)
09:49:22.737718 IP 8.8.8.8.53 > 108.214.94.90.51206: 36662* 1/0/0 A 192.168.1.254 (62)
09:49:22.738689 IP 8.8.8.8.53 > 108.214.94.90.56551: 34427* 1/0/0 A 192.168.1.254 (62)
09:49:22.741183 IP 8.8.8.8.53 > 108.214.94.90.61180: 46888* 1/0/0 A 192.168.1.254 (62)
09:49:22.741704 IP 8.8.4.4.53 > 108.214.94.90.64702: 8840* 1/0/0 A 192.168.1.254 (62)
09:49:22.750239 IP 8.8.8.8.53 > 108.214.94.90.61333: 61237* 1/0/0 A 192.168.1.254 (62)
09:49:22.750282 IP 8.8.8.8.53 > 108.214.94.90.60326: 55279* 1/0/0 A 192.168.1.254 (62)
09:49:22.751152 IP 8.8.8.8.53 > 108.214.94.90.49247: 11077* 1/0/0 A 192.168.1.254 (62)
09:49:22.751767 IP 8.8.4.4.53 > 108.214.94.90.49152: 64593* 1/0/0 A 192.168.1.254 (62)
09:49:22.838936 IP 8.8.8.8.53 > 108.214.94.90.45690: 41299* 1/0/0 A 192.168.1.254 (62)
09:49:22.839673 IP 8.8.8.8.53 > 108.214.94.90.29121: 42993* 1/0/0 A 192.168.1.254 (62)
09:49:22.840161 IP 8.8.8.8.53 > 108.214.94.90.64897: 31953* 1/0/0 A 192.168.1.254 (62)
09:49:22.842692 IP 8.8.4.4.53 > 108.214.94.90.55013: 43366* 1/0/0 A 192.168.1.254 (62)
09:49:26.618406 IP 192.168.1.254.53 > 108.214.94.90.51135: 3391* 1/0/1 A 192.168.1.254 (65)
09:49:26.853723 IP 8.8.8.8.53 > 108.214.94.90.58757: 62486* 1/0/0 A 192.168.1.254 (54)
09:49:28.089034 IP 8.8.8.8.53 > 108.214.94.90.35329: 41050* 1/0/0 A 192.168.1.254 (47)
09:49:31.030077 IP 8.8.8.8.53 > 108.214.94.90.60831: 55667* 1/0/0 A 192.168.1.254 (63)
09:49:33.902730 IP 8.8.8.8.53 > 108.214.94.90.46098: 55711* 1/0/0 A 192.168.1.254 (48)
09:49:34.920228 IP 8.8.8.8.53 > 108.214.94.90.46098: 55711* 1/0/0 A 192.168.1.254 (48)
09:49:35.879316 IP 8.8.8.8.53 > 108.214.94.90.52720: 30017* 1/0/0 A 192.168.1.254 (50)
09:49:35.879454 IP 8.8.4.4.53 > 108.214.94.90.52720: 30017* 1/0/0 A 192.168.1.254 (50)
09:49:35.930218 IP 8.8.8.8.53 > 108.214.94.90.41941: 55711* 1/0/0 A 192.168.1.254 (48)
09:49:38.227359 IP 8.8.8.8.53 > 108.214.94.90.57683: 34381* 1/0/0 A 192.168.1.254 (48)
09:49:39.241575 IP 8.8.8.8.53 > 108.214.94.90.36785: 34381* 1/0/0 A 192.168.1.254 (48)
09:49:43.532757 IP 8.8.8.8.53 > 108.214.94.90.46714: 37202* 1/0/1 A 192.168.1.254 (62)
09:49:44.077113 IP 8.8.8.8.53 > 108.214.94.90.43244: 12411* 1/0/0 A 192.168.1.254 (50)
09:49:44.533375 IP 8.8.8.8.53 > 108.214.94.90.41812: 24784* 1/0/1 A 192.168.1.254 (62)
09:49:44.709903 IP 8.8.4.4.53 > 108.214.94.90.43899: 38644* 1/0/1 A 192.168.1.254 (59)
09:49:44.710071 IP 8.8.8.8.53 > 108.214.94.90.43899: 38644* 1/0/1 A 192.168.1.254 (59)
09:49:44.710146 IP 1.1.1.1.53 > 108.214.94.90.43899: 38644* 1/0/1 A 192.168.1.254 (59)
09:49:46.532922 IP 8.8.8.8.53 > 108.214.94.90.56029: 39440* 1/0/1 A 192.168.1.254 (62)
09:49:46.713063 IP 8.8.8.8.53 > 108.214.94.90.55145: 21839* 1/0/0 A 192.168.1.254 (43)
09:49:46.713170 IP 8.8.8.8.53 > 108.214.94.90.58465: 48471* 1/0/0 A 192.168.1.254 (52)
09:49:46.713340 IP 8.8.8.8.53 > 108.214.94.90.54466: 1152* 1/0/0 A 192.168.1.254 (47)
09:49:46.713341 IP 8.8.8.8.53 > 108.214.94.90.49688: 46298* 1/0/0 A 192.168.1.254 (56)
09:49:46.714392 IP 8.8.8.8.53 > 108.214.94.90.34487: 27485* 1/0/0 A 192.168.1.254 (66)
09:49:46.714397 IP 8.8.8.8.53 > 108.214.94.90.50331: 25893* 1/0/0 A 192.168.1.254 (58)
09:49:46.715401 IP 8.8.8.8.53 > 108.214.94.90.49894: 26111* 1/0/0 A 192.168.1.254 (52)
09:49:47.280509 IP 8.8.8.8.53 > 108.214.94.90.56704: 63733* 1/0/1 A 192.168.1.254 (65)
09:49:50.531788 IP 8.8.8.8.53 > 108.214.94.90.57730: 33655* 1/0/1 A 192.168.1.254 (62)
09:49:57.032433 IP 8.8.8.8.53 > 108.214.94.90.37855: 2478* 1/0/0 A 192.168.1.254 (52)
09:49:57.032566 IP 8.8.4.4.53 > 108.214.94.90.37855: 2478* 1/0/0 A 192.168.1.254 (52)
09:49:58.534325 IP 8.8.8.8.53 > 108.214.94.90.35347: 6952* 1/0/1 A 192.168.1.254 (62)
09:49:59.716100 IP 8.8.8.8.53 > 108.214.94.90.48036: 63248* 1/0/1 A 192.168.1.254 (59)
09:50:00.554748 IP 8.8.8.8.53 > 108.214.94.90.48964: 42064* 1/0/0 A 192.168.1.254 (59)
09:50:04.803852 IP 8.8.8.8.53 > 108.214.94.90.57200: 38228* 1/0/0 A 192.168.1.254 (59)
09:50:05.559957 IP 8.8.8.8.53 > 108.214.94.90.50654: 57602* 1/0/0 A 192.168.1.254 (59)
09:50:06.235014 IP 8.8.4.4.53 > 108.214.94.90.47606: 14148* 1/0/1 A 192.168.1.254 (70)
09:50:06.235037 IP 1.1.1.1.53 > 108.214.94.90.47606: 14148* 1/0/1 A 192.168.1.254 (70)
09:50:06.235110 IP 8.8.8.8.53 > 108.214.94.90.47606: 14148* 1/0/1 A 192.168.1.254 (70)
09:50:06.831877 IP 8.8.8.8.53 > 108.214.94.90.49102: 53461* 1/0/0 A 192.168.1.254 (59)
09:50:09.899488 IP 8.8.8.8.53 > 108.214.94.90.38765: 42235* 1/0/0 A 192.168.1.254 (48)
09:50:10.000561 IP 8.8.8.8.53 > 108.214.94.90.49693: 39562* 1/0/1 A 192.168.1.254 (59)
09:50:10.563784 IP 8.8.8.8.53 > 108.214.94.90.59502: 52894* 1/0/0 A 192.168.1.254 (59)
09:50:10.598425 IP 8.8.8.8.53 > 108.214.94.90.35710: 19386* 1/0/0 A 192.168.1.254 (50)
09:50:10.625967 IP 8.8.8.8.53 > 108.214.94.90.37666: 7059* 1/0/0 A 192.168.1.254 (43)
09:50:10.655101 IP 8.8.8.8.53 > 108.214.94.90.33942: 17550* 1/0/0 A 192.168.1.254 (52)
09:50:10.691831 IP 8.8.8.8.53 > 108.214.94.90.34437: 65073* 1/0/0 A 192.168.1.254 (45)
09:50:10.721228 IP 8.8.8.8.53 > 108.214.94.90.33166: 16436* 1/0/0 A 192.168.1.254 (45)
09:50:10.757831 IP 8.8.8.8.53 > 108.214.94.90.41294: 22987* 1/0/0 A 192.168.1.254 (44)
09:50:13.827111 IP 192.168.1.254.53 > 108.214.94.90.45476: 12659* 1/0/1 A 192.168.1.254 (99)
Datadog trying to query cloud provider's metadata apis.
09:50:01.606487 IP 108.214.94.90.58826 > 169.254.169.254.80: Flags [P.], seq 1:122, ack 1, win 502, length 121: HTTP: GET /latest/meta-data/hostname HTTP/1.1
09:50:01.610322 IP 169.254.169.254.80 > 108.214.94.90.58826: Flags [P.], seq 1:565, ack 122, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
09:50:01.611972 IP 108.214.94.90.58842 > 169.254.169.254.80: Flags [P.], seq 1:158, ack 1, win 502, length 157: HTTP: GET /computeMetadata/v1/instance/hostname HTTP/1.1
09:50:01.614763 IP 169.254.169.254.80 > 108.214.94.90.58842: Flags [P.], seq 1:565, ack 158, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
09:50:01.616233 IP 108.214.94.90.58858 > 169.254.169.254.80: Flags [P.], seq 1:178, ack 1, win 502, length 177: HTTP: GET /metadata/instance/compute/vmId?api-version=2017-04-02&format=text HTTP/1.1
09:50:01.619198 IP 169.254.169.254.80 > 108.214.94.90.58858: Flags [P.], seq 1:565, ack 178, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
09:50:01.620859 IP 108.214.94.90.23284 > 100.100.100.200.80: Flags [P.], seq 1:125, ack 1, win 502, length 124: HTTP: GET /latest/meta-data/instance-id HTTP/1.1
09:50:01.623561 IP 100.100.100.200.80 > 108.214.94.90.23284: Flags [P.], seq 1:565, ack 125, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
09:50:01.624984 IP 108.214.94.90.58862 > 169.254.169.254.80: Flags [P.], seq 1:145, ack 1, win 502, length 144: HTTP: GET /opc/v2/instance/id HTTP/1.1
09:50:01.628227 IP 169.254.169.254.80 > 108.214.94.90.58862: Flags [P.], seq 1:565, ack 145, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
09:50:01.630012 IP 108.214.94.90.58874 > 169.254.169.254.80: Flags [P.], seq 1:204, ack 1, win 502, length 203: HTTP: PUT /instance_identity/v1/token?version=2022-03-08 HTTP/1.1
09:50:01.632677 IP 169.254.169.254.80 > 108.214.94.90.58874: Flags [P.], seq 1:565, ack 204, win 501, length 564: HTTP: HTTP/1.1 400 Bad Request
Google doing a generate_204 query on one of it's apis and getting redirect by the gateway.
09:50:08.794004 IP 108.214.94.90.58303 > 142.250.72.227.80: Flags [P.], seq 1:114, ack 1, win 4096, options [nop,nop,TS val 1378192536 ecr 4067416761], length 113: HTTP: HEAD /generate_204 HTTP/1.1
09:50:08.914912 IP 142.250.72.227.80 > 108.214.94.90.58303: Flags [P.], seq 1:507, ack 114, win 509, options [nop,nop,TS val 4067416884 ecr 1378192536], length 506: HTTP: HTTP/1.1 302 Found
The redirect being followed to http://192.168.1.254/cgi-bin/intercept.ha .
09:50:10.256395 IP 108.214.94.90.37206 > 192.168.1.254.80: Flags [P.], seq 1:115, ack 1, win 502, options [nop,nop,TS val 1579269207 ecr 4067418225], length 114: HTTP: GET /cgi-bin/intercept.ha HTTP/1.1
09:50:10.412909 IP 192.168.1.254.80 > 108.214.94.90.37206: Flags [.], seq 1:2897, ack 115, win 509, options [nop,nop,TS val 4067418382 ecr 1579269207], length 2896: HTTP: HTTP/1.1 200 OK
09:50:10.412952 IP 192.168.1.254.80 > 108.214.94.90.37206: Flags [.], seq 2897:13033, ack 115, win 509, options [nop,nop,TS val 4067418382 ecr 1579269207], length 10136: HTTP
09:50:10.413117 IP 192.168.1.254.80 > 108.214.94.90.37206: Flags [.], seq 13033:14481, ack 115, win 509, options [nop,nop,TS val 4067418382 ecr 1579269207], length 1448: HTTP
09:50:10.413961 IP 192.168.1.254.80 > 108.214.94.90.37206: Flags [P.], seq 14481:16038, ack 115, win 509, options [nop,nop,TS val 4067418383 ecr 1579269364], length 1557: HTTP