Ethernet Data Traffic hidden from capture - networking

I have a puzzle I am not able to figure out, I would appreciate any help.
I am connected to a remote desktop using windows default remote desktop utility (Windows 8 locally, Windows 7 remotely).
The remote desktop is not in the same sub-network as my own.
Connection is made through default port 3389. Using Wireshark locally I can confirm the TCP connection being established and the data flow.
Running Wireshark in the remote desktop, I don`t see any flow of data between the two computers.
If I send a ICMP ping from the remote desktop to my computer, it works well and I can see it in Wireshark both remotely as well as locally. But if I send the ICMP ping from my computer to the remote desktop, it fails. I see it leaving my computer through Wireshark, but it never reaches the remote desktop (I don`t see it in Wireshark).
I don't think it is a firewall issue (specially since it can't explain why Wireshark won`t capture the port 3389 RPC flow).
Does anyone have any idea of what might be going on?

I found the main issue.
In Wireshark, turns out it is possible to configure the capture interface with a filter.
To change it, go to: Capture->Interfaces
On the interface being used, stop capturing to enable the Options, there it is possible to configure a capture filter.

Related

SIM5320A, device connected to 3G Network but can't ping server

I've been trying to make this SIM5320A module send HTTP requests to my server but even though it appears connected to the internet I can't seem to ping any server or make any requests.
I'm sending AT commands through a terminal on my Linux PC.
AT+CPIN appears READY
I've configured through the AT+CGDCONT, AT+SOCKSETPN = 1 and AT+CGSOCKCONT commands, adding my service provider's APN.
AT+NETOPEN returns OK. Running it again returns Network is already opened.
AT+CPSI? show's that it's connected to the WCDMA network and is online.
AT+IPADDR throws a proper IPv4 address.
So I'm trying to do AT+CPING="google.com",1 but it just won't connect.
I've even been able of sending a SMS and reading GPS coordinates, just failing in the internet stuff.
Am I missing any configuration steps? There is so little information online on this device.

Internet Connectivity Check

Hi all and thanks in advance for your help.
I have a situation where I have a need to test an unstable Internet connection on one internal network and send out an email alert on any issues (obviously requiring an Internet connection) through another network - .
I have hardware with dual nic and plan on writing something simple in vb.
Is there a way I can disable ping on my 'good' connection forcing it through the test network yet allowing smtp?
I've looked into routing and done some basic testing but it seems the ping automatically reroutes through the good network shortly after the bad network fails?
Any advice warmly received.
You should not even think about blocking ICMP. This is a good way to cause many, many problems. Instead, you should explicitly specify which interface to use for the ping requests.
If you're using a command-line ping, you usually do this by specifying the source IP to use for sending the packets. For example, on OS X, you can run the command
ping -c 5 -S 10.0.1.13 8.8.8.8
to ping Google's public DNS server (8.8.8.8) using the interface whose IP address is 10.0.1.13. If the interface with that IP is down, the ping will fail.
The specific flag varies from implementation to implementation.
If you're writing your own ping code, IIRC, you just need to bind the socket to that source address with the bind() system call.

Is it possible to connect with remote desktop but not be able to ping to the same machine?

It seems I have this weird issue I can't really understand. I am able to connect to a remote computer (windows machine) with remote desktop perfectly but I am not be able to ping to it. When I ping I get timeout all the time. It is the same ip address and I am using the same computer, so there are no firewall issue I think. From what I know ping is using it own protocol (different than TCP and UDP) so you don't ping to a precific port
Yes it is. The system administrator, and the network administrators (of the several networks you need to use to access the remote machines), are able configure their boxes to disable ICMP. Then ping does not work, but HTTP or ssh (or whatever protocol your remote desktop uses) could work.
ICMP is often disabled for security reasons, and to lower the load on the remote computer. It makes slightly harder to find the remote host.

TCP Connect Fails

I have two applications that talk via TCP, both of which run on Windows XP machines. The client is a third-party application for which I have only the executable, no source. The IP address of the server it connects to is set in a text configuration file. The server is an application I am writing.
All netmasks are 255.255.255.0.
In all cases, the client runs on 192.168.142.202.
I am seeing a case where if I run my server on 192.168.142.207, everything works, but if I move my server over to another machine on the same subnet (192.168.142.105), everything does not work fine. Specifically, the connection does not seem to get properly established. I have looked at what's going on in Wireshark and would like to request assistance interpeting what I see.
On the server side, I see the 3-way handshake: SYN, SYN/ACK, ACK. I get no error codes on the return of accept(), and netstat shows the connection as established.
On the client side, the connection does not seem to be established properly. This causes the client to reconnect periodically, and it will also occasionally close all of the not-correctly-connected sockets that get created as a result. When I look at the client side in Wireshark, I most often see a SYN, SYN, SYN pattern, rather that the expected 3-way handshake. Occassionally, the 3-way handshake does appear, but even then, the client doesn't seem to be happy with the connection because it closes it.
I will note that there are actually two TCP connections between the client and server. The other connection (i.e. not the problematic connection I described above) works just fine. The problematic connection has listening port 5004; the good connection has listening port 1234.
I have placed both .txt and .pcap versions of the client and server Wireshark captures at this link: https://skydrive.live.com/redir.aspx?cid=c5beaf58ac752bb0&resid=C5BEAF58AC752BB0!105&parid=root
As far as the physical network setup goes, there is one switch in between the client and server in the case that works, and there are two switches in between the client and server in the case that doesn't work. All ping tests are successful. There are no wireless connections involved; everything is wired.
All firewalls are off.
Does anybody have any thoughts on either what the problem is or what further data I could gather to solve the problem?
Well, it appears this is not a network or network programming problem at all. I've figured out by trial and error that the third-party software that connects to me wants the machine it runs on to have a smaller IP address than the machine my software runs on. This seems completely arbitrary to me, but empirically, this very strongly appears to be the case. Arghhhh............
Thanks to any and all who may have spent time poring over the Wiresharks dumps I provided...

how does teamviewer find my computer even if my comp. behind of the firewall and firewall isn't configured?

Did you use teamviewer? (comic question i know... Who doesn't use it?)
Do you have any idea how does teamviewer make connection even if i am behind the router, firewall, switch and my local firewall..?
I'm trying to imagine a connection that is between remote machinge and my computer. Remote machine is sending the packets (and its header (for instance, destination IP, message body)) to me but it only knows my id number(which is given by my local teamviewer application).
And this packets are reaching to my computer even if there is a juniper firewall (and also my windows firewall).
What kind a message body is recieving by computer? (of course it is not like xml, text, html, excel :)
Do you have any idea?
PS. Please share your knowledge like you are explaining to beginner level user.
The software is communicating with a central server, and has made an outbound connection. When you start TeamViewer, it will try to make a direct connection, but if both directions fail that (ie. firewall or NATting at both places), then it will fall back on communicating through a server.
This is basically the same approach most online games use. Changes at one end is sent to a central server, and is then relayed back to other connected computers.

Resources