[FW1] Net Mon 2 breaks NT GUI client

[Ian Campbell <ianc@FW1-NOSPAMbuzzsaw.com>]

Yes it does. I'm running NT 4 Server SP6a on my desktop and the GUI clients
worked great. I was having a filtering problem on my router and wanted to
capture some ftp packets to see what the problem might be. I installed Net
Mon 2 from SMS off the MSDN CD's we have (This version puts your NIC in
promiscuous mode). I didn't run the GUI client until this AM. When I tried,
it just hung after I'd entered the password. Worked on the management server
though, so I knew my machine was hosed.

I knew it had to be that Damn NetMon, but I wanted it. I uninstalled the
client and SP's, then reinstalled. No good. Reservice packed. No good.
Ripped TCP/IP out by the roots and reinstalled off the NT CD, then reservice
packed again. No good. Finally I bit the bullet and uninstalled NetMon 2.
The clients fired right up. @@%^$#^!!!!!

I installed the crippled version of NetMon from the NT CD on my machine that
only allows you to capture your own packets (then reservice packed again,
sigh...) and it seems to peaceably coexist with the clients. Just thought
I'd let you know.

Ian
 
P.S. The routing problem was denying sessions whenever you tried to do an
'ls' or 'dir' on the remote machine: it would just hang. You could still
connect and logon fine. I looked at the packets and found that the request
to open the ftp data channel comes from the server to the client, and is a
SYN packet. Thus it is dropped by:
			access-list 100 permit tcp any any established 
 which only passes ACK packets. To fix this, add:
			accesss-list 100 permit tcp any eq ftp-data host
my.fw.ip.here
Just thought you might like to know that too. ;-)




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================