NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FW-1] VPN + Netmeeting problem



Good morning all,

  Basically i have a problem with Netmeeting being hosted by someone that
has established a VPN connection to the firewall via SecuRemote and then
having someone on the internal network connect to that remote user via
Netmeeting.

  Here is what happens, once the VPN has been established and Netmeeting
started set to host a session, someone from our internal network attempts to
connect to the external machine via Netmeeting.  The netmeeting request is
received by the external machine and is accepted.  On the external machine
both netmeeting users appear in the member list and it indicates that it is
in a call.  However, the internal machine never receives the netmeeting
session acceptance and continues to wait for the external user to accept the
call until it times out.

  i did some tcpdumps (which i have attached) from the external location.
It seems to show that although the requests come from A.B.C.6, Netmeeting is
trying to respond on A.B.C.61.

  A.B.C.6 is the firewall's external IP address and A.B.C.61 is the NAT
address for the internal network.

  Further, A.B.C.61 is not assigned to any machine.  If someone could
explain this to me i would truely appreciate it.  i would have expected that
the NAT address would have had to be assigned to the firewall's external
interface or at least one of the router's interfaces.

  As far as i see it right now, my only option is to change the NAT address
of the internal network to A.B.C.6.  This decreases the security of our
network though so i would like to find another solution.

  Could someone please review the attached and tell me if my logic is sound
and provide some alternative solutions?

thanks in advance,
dean

below is a conversation i have been having.  The conversation starts at the
bottom.

-----Original Message-----
From: Dean Bishop
Subject: RE: netmeeting problem identified.


Ok, so A.B.C.6 and A.B.C.61 are not both on the firewall.  A.B.C.6 obviously
is the IP address of the external interface of the firewall.  If i ping
A.B.C.61 i get resolution to wkstn0009.us.com, although no response.  If you
look at the physical labels, wkstn0009 is my linux box located outside the
firewall at A.B.C.100.  i guess i don't understand NATing as well as i might
hope.

How does traffic from inside our office ever work?  Internet requests are
NATed to an address that resolves to a machine that doesn't exist.

i would have expected that in order for the requests directed to the
Internet to ever make it back to the internal machine making the requests
would be for the traffic to head back to the gateway.  Guess not. <shrug>

Currently the only resolution i have for the Netmeeting issue is still to
change the NAT address for the internal network to A.B.C.6.  Please any
other ideas would be appreciated.

signed,
NATless,
dean
-----Original Message-----
From: Dean Bishop
Subject: RE: netmeeting problem identified.


but A.B.C.61 and A.B.C.6 are the same interface.  what protection does it
provide.  Wouldn't the hackers be hacking our firewall at both addresses?
Where is the difference?  Is A.B.C.61 protected differently than A.B.C.6?


-----Original Message-----
Subject: RE: netmeeting problem identified.


Usually, it's good practice to have the NAT address different from the
firewall's address so that the firewall's address is less obvious to
potential hackers.

</Ken>
-----Original Message-----
From: Dean Bishop
Subject: RE: netmeeting problem identified.
Importance: High


Ok, so this is the fix.  change the NATing address from A.B.C.61 to A.B.C.6.
i have tested this on one internal machine and netmeeting works properly
even with SecuRemote enabled and authenticated.

The question is:

What is the impact of changing the NAT address?




-----Original Message-----
Subject: RE: netmeeting problem identified.


Hi Dean,

I haven't looked at the DOC files yet but here are the answers to your
questions:

1. Can we change the NAT address to match the firewall's external IP address
of A.B.C.6?  What are the implications of this?

I don't think this would solve the problem if we could do this (and I don't
know whether we could or couldn't) because once the packet arrives at the
firewall, it wouldn't know who to forward it to.

2. Could we set up a firewall/VPN server at Vello's house?  By doing this
the tunnel would exist between the firewalls and we would be able to give
Vello's PC's 192.168.0.x IP addresses, right?  Once this is done then
netmeeting sessions could be established using the intenal IP address of
Vello's PC couldn't it?

I think this can work but it also raises a couple of other questions:  Is
Vello willing to pay for this solution?  Will Vello only be doing NetMeeting
from one machine?  If not, I don't think external callers would be able to
connect to his machine.

Ray
-----Original Message-----
From: Dean Bishop
Sent: May 17, 2002 10:54 AM
Subject: netmeeting problem identified.


Ok, so i finally understand the problem. well some of it anyway.  Take a
look at the dumps that i have attached.  dump.doc was taken before a tunnel
was set up and dump-vpn.doc was after.  Notice the IP addresses.  During the
non-vpn conversation all traffic flows to/from A.B.C.61 and A.B.C.3 (a test
machine with SecuRemote on it).  Once the tunnel has been established though
traffic comes from A.B.C.6 to A.B.C.3 and A.B.C.3 sends the traffic back to
A.B.C.61

A.B.C.6 is the firewall
A.B.C.61 is the NAT address

So then, why is is sent back to A.B.C.61 instead of A.B.C.6?

H.323 devices must negotiate call setup parameters before two users can
communicate. During the call setup phase of an H.323 call the endpoints
exchange information that define the end point IP addresses and port numbers
to use for video packets, audio packets and well as data sharing packets.
This information exchange necessitates the need to embed IP address and port
information in the data portion of the packet

Aha!  So then how does it ever work you might wonder.

H.323 aware routers perform NAT operations on the IP address and port
information in the data portion of the packet as well as the header portion
of the packet. H.323 aware firewalls open ports based on traffic inspection
of packets that traverse the firewall during the call setup phase. When the
call is torn down, or activity timers have expired, the router as well as
the firewall will release the IP mappings and ports that were modified to
accept the call between the two end points
This is all well and good but what IP address is being inserted into the
H.323 data packets?  i suggest that it is the firewall's NAT address
A.B.C.61.

Now then.  What are the solutions?

Can we change the NAT address to match the firewall's external IP address of
A.B.C.6?  What are the implications of this?

Could we set up a firewall/VPN server at Vello's house?  By doing this the
tunnel would exist between the firewalls and we would be able to give
Vello's PC's 192.168.0.x IP addresses, right?  Once this is done then
netmeeting sessions could be established using the intenal IP address of
Vello's PC couldn't it?

Any other suggestions?

0x0000   4500 0030 3c5b 4000 8006 7efe cd96 d203        E..0<[@...~.....
0x0010   cd96 d23d 06b8 879e 6995 4a9a d380 a065        ...=....i.J....e
0x0020   7012 4470 48c4 0000 0204 05b4 0101 0402        p.DpH...........
10:20:49.737038 A.C.B.61.34718 > A.C.B.3.h323hostcall: . ack 1 win 0
0x0000   4500 0028 0000 0000 3b06 4062 cd96 d23d        E..(....;.@b...=
0x0010   cd96 d203 879e 06b8 d380 a065 6995 4a9b        ...........ei.J.
0x0020   5010 0000 b9f8 0000 5555 5555 5555             P.......UUUUUU
10:20:49.747038 A.C.B.6 > A.C.B.3:  ip-proto-94 25
0x0000   4500 002d 9625 0000 7f5e 6616 cd96 d206        E..-.%...^f.....
0x0010   cd96 d203 879e 06b8 d380 a065 6995 4a9b        ...........ei.J.
0x0020   5010 4470 7588 0000 f9b7 ca6d d155             P.Dpu......m.U
10:20:49.747038 A.C.B.6 > A.C.B.3:  ip-proto-94 29
0x0000   4500 0031 9626 0000 7f5e 6611 cd96 d206        E..1.&...^f.....
0x0010   cd96 d203 879e 06b8 d380 a065 6995 4a9b        ...........ei.J.
0x0020   5018 4470 71a8 0000 0300 00d4 3b6c 89bc        P.Dpq.......;l..
0x0030   3e                                             >
10:20:49.847038 A.C.B.3.h323hostcall > A.C.B.61.34718: . ack 5 win 17516 (DF)
0x0000   4500 0028 3c5c 4000 8006 7f05 cd96 d203        E..(<\@.........
0x0010   cd96 d23d 06b8 879e 6995 4a9b d380 a069        ...=....i.J....i
0x0020   5010 446c 7588 0000 0000 0000 0000             P.Dlu.........
10:20:49.847038 A.C.B.6 > A.C.B.3:  ip-proto-94 233
0x0000   4500 00fd 9627 0000 7f5e 6544 cd96 d206        E....'...^eD....
0x0010   cd96 d203 879e 06b8 d380 a069 6995 4a9b        ...........ii.J.
0x0020   5018 4470 1830 0000 0802 0bd0 0504 0388        P.Dp.0..........
0x0030   c0a5 2808 626f 6220 626f 6200 7e00 b905        ..(.bob.bob.~...
0x0040   10a8 0600 0891 4a00 0201 4006 0062 006f        [email protected]
0x0050   0062                                           .b
10:20:49.907038 A.C.B.3.h323hostcall > A.C.B.61.34718: P 1:5(4) ack 213 win 17308 (DF)
0x0000   4500 002c 3c5d 4000 8006 7f00 cd96 d203        E..,<]@.........
0x0010   cd96 d23d 06b8 879e 6995 4a9b d380 a139        ...=....i.J....9
0x0020   5018 439c 7251 0000 0300 002b 002b             P.C.rQ.....+.+
10:20:50.017038 A.C.B.6 > A.C.B.3:  ip-proto-94 25
0x0000   4500 002d 9628 0000 7f5e 6613 cd96 d206        E..-.(...^f.....
0x0010   cd96 d203 879e 06b8 d380 a139 6995 4a9f        ...........9i.J.
0x0020   5010 446c 74b4 0000 9939 10fc f455             P.Dlt....9...U
10:20:50.017038 A.C.B.3.h323hostcall > A.C.B.61.34718: P 5:44(39) ack 213 win 17308 (DF)
0x0000   4500 004f 3c5e 4000 8006 7edc cd96 d203        E..O<^@...~.....
0x0010   cd96 d23d 06b8 879e 6995 4a9f d380 a139        ...=....i.J....9
0x0020   5018 439c 0d0a 0000 0802 8bd0 017e 001f        P.C..........~..
0x0030   0503 8006 0008 914a 0002 0201 2011 0007        .......J........
0x0040   87cb ab41 7874 4cac 095b fd0d 0acd 91          ...AxtL..[.....
10:20:50.217038 A.C.B.6 > A.C.B.3:  ip-proto-94 25
0x0000   4500 002d 9629 0000 7f5e 6612 cd96 d206        E..-.)...^f.....
0x0010   cd96 d203 879e 06b8 d380 a139 6995 4ac6        ...........9i.J.
0x0020   5010 4445 74b4 0000 6038 4c1a b555             P.DEt...`8L..U
10:20:55.677038 A.C.B.3.h323hostcall > A.C.B.61.34718: P 44:48(4) ack 213 win 17308 (DF)
0x0000   4500 002c 3c5f 4000 8006 7efe cd96 d203        E..,<_@...~.....
0x0010   cd96 d23d 06b8 879e 6995 4ac6 d380 a139        ...=....i.J....9
0x0020   5018 439c 71dc 0000 0300 0075 0075             P.C.q......u.u
10:20:55.827038 A.C.B.6 > A.C.B.3:  ip-proto-94 25
0x0000   4500 002d 962a 0000 7f5e 6611 cd96 d206        E..-.*...^f.....
0x0010   cd96 d203 879e 06b8 d380 a139 6995 4aca        ...........9i.J.
0x0020   5010 4441 74b4 0000 156f e614 4555             P.DAt....o..EU
10:20:55.827038 A.C.B.3.h323hostcall > A.C.B.61.34718: P 48:161(113) ack 213 win 17308 (DF)
0x0000   4500 0099 3c60 4000 8006 7e90 cd96 d203        E...<`@...~.....
0x0010   cd96 d23d 06b8 879e 6995 4aca d380 a139        ...=....i.J....9
0x0020   5018 439c 6570 0000 0802 8bd0 0704 0388        P.C.ep..........
0x0030   c0a5 2809 6861 6e6b 2068 616e 6b7e 0059        ..(.hank.hank~.Y
0x0040   0502 c006 0008 914a 0002 00cd 96d2 0307        .......J........
0x0050   8e22                                           ."
10:20:55.837038 A.C.B.6 > A.C.B.3:  ip-proto-94 33
0x0000   4500 0035 962b 0000 7f5e 6608 cd96 d206        E..5.+...^f.....
0x0010   cd96 d203 879f 078e d398 b4c1 0000 0000        ................
0x0020   7002 4000 ec28 0000 0204 05b4 0101 0402        p.@..(..........
0x0030   85ce 5e21 38                                   ..^!8
10:20:55.837038 A.C.B.3.1934 > A.C.B.61.34719: S:(0) ackwin 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000   4500 0030 3c61 4000 8006 7ef8 cd96 d203        E..0<a@...~.....
0x0010   cd96 d23d 078e 879f 69ad 3ab5 d398 b4c2        ...=....i.:.....
0x0020   7012 4470 4345 0000 0204 05b4 0101 0402        p.DpCE..........
10:20:55.837038 A.C.B.61.34719 > A.C.B.3.1934: . ack 1 win 0
0x0000   4500 0028 0000 0000 3b06 4062 cd96 d23d        E..(....;.@b...=
0x0010   cd96 d203 879f 078e d398 b4c2 69ad 3ab6        ............i.:.
0x0020   5010 0000 b479 0000 5555 5555 5555             P....y..UUUUUU
10:20:55.837038 A.C.B.6 > A.C.B.3:  ip-proto-94 25
0x0000   4500 002d 962c 0000 7f5e 660f cd96 d206        E..-.,...^f.....
0x0010   cd96 d203 879f 078e d398 b4c2 69ad 3ab6        ............i.:.
0x0020   5010 4470 7009 0000 24ed 1f34 4e55             P.Dpp...$..4NU
10:20:55.837038 A.C.B.6 > A.C.B.3:  ip-proto-94 29
0x0000   4500 0031 962d 0000 7f5e 660a cd96 d206        E..1.-...^f.....
0x0010   cd96 d203 879f 078e d398 b4c2 69ad 3ab6        ............i.:.
0x0020   5018 4470 6af3 0000 0300 020a 6a0f 2710        P.Dpj.......j.'.
0x0030   dd                                             .

10:05:44.737038 A.B.C.61.34637 > A.B.C.3.h323hostcall: P:(4) ackwin 17360 (DF)
0x0000   4500 002c 9405 4000 7f06 2858 cd96 d23d        E..,..@...(X...=
0x0010   cd96 d203 874d 06b8 bb9f 11ff 51bd b492        .....M......Q...
0x0020   5018 43d0 c766 0000 0300 002f 5555             P.C..f...../UU
10:05:44.737038 A.B.C.61.34637 > A.B.C.3.h323hostcall: FP 4:47(43) ack 1 win 17360 (DF)
0x0000   4500 0053 9406 4000 7f06 2830 cd96 d23d        E..S..@...(0...=
0x0010   cd96 d203 874d 06b8 bb9f 1203 51bd b492        .....M......Q...
0x0020   5019 43d0 7873 0000 0802 0bc9 5a08 0300        P.C.xs......Z...
0x0030   0090 7e00 1e05 05c0 0600 0891 4a00 0258        ..~.........J..X
0x0040   0811 0011 cfe6 4ee7 935b 43a1 6e90 52f9        ......N..[C.n.R.
0x0050   7b6c                                           {l
10:05:44.737038 A.B.C.3.h323hostcall > A.B.C.61.34637: R:(0) win 0
0x0000   4500 0028 3a64 0000 8006 c0fd cd96 d203        E..(:d..........
0x0010   cd96 d23d 06b8 874d 51bd b492 51bd b492        ...=...MQ...Q...
0x0020   5004 0000 d5cc 0000 0000 0000 0000             P.............
10:05:44.737038 A.B.C.3.h323hostcall > A.B.C.61.34637: R:(0) win 0
0x0000   4500 0028 3a65 0000 8006 c0fc cd96 d203        E..(:e..........
0x0010   cd96 d23d 06b8 874d 51bd b492 51bd b492        ...=...MQ...Q...
0x0020   5004 0000 d5cc 0000 0000 0000 0000             P.............
10:05:45.717038 A.B.C.61.34638 > A.B.C.3.h323hostcall: S:(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
0x0000   4500 0030 940d 4000 7f06 284c cd96 d23d        E..0..@...(L...=
0x0010   cd96 d203 874e 06b8 c5fa d62f 0000 0000        .....N...../....
0x0020   7002 4000 d97f 0000 0204 05b4 0101 0402        p.@.............
10:05:45.717038 A.B.C.3.h323hostcall > A.B.C.61.34638: S:(0) ackwin 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000   4500 0030 3a66 4000 8006 80f3 cd96 d203        E..0:f@.........
0x0010   cd96 d23d 06b8 874e 5c17 b009 c5fa d630        ...=...N\......0
0x0020   7012 4470 c8dd 0000 0204 05b4 0101 0402        p.Dp............
10:05:45.717038 A.B.C.61.34638 > A.B.C.3.h323hostcall: . ack 1 win 0
0x0000   4500 0028 0000 0000 3b06 4062 cd96 d23d        E..(....;.@b...=
0x0010   cd96 d203 874e 06b8 c5fa d630 5c17 b00a        .....N.....0\...
0x0020   5010 0000 3a12 0000 5555 5555 5555             P...:...UUUUUU
10:05:45.717038 A.B.C.61.34638 > A.B.C.3.h323hostcall: . ack 1 win 17520 (DF)
0x0000   4500 0028 940e 4000 7f06 2853 cd96 d23d        E..(..@...(S...=
0x0010   cd96 d203 874e 06b8 c5fa d630 5c17 b00a        .....N.....0\...
0x0020   5010 4470 f5a1 0000 5555 5555 5555             P.Dp....UUUUUU
10:05:45.727038 A.B.C.61.34638 > A.B.C.3.h323hostcall: P 1:5(4) ack 1 win 17520 (DF)
0x0000   4500 002c 940f 4000 7f06 284e cd96 d23d        E..,..@...(N...=
0x0010   cd96 d203 874e 06b8 c5fa d630 5c17 b00a        .....N.....0\...
0x0020   5018 4470 f1c1 0000 0300 00d4 5555             P.Dp........UU
10:05:45.887038 A.B.C.3.h323hostcall > A.B.C.61.34638: . ack 5 win 17516 (DF)
0x0000   4500 0028 3a67 4000 8006 80fa cd96 d203        E..(:g@.........
0x0010   cd96 d23d 06b8 874e 5c17 b00a c5fa d634        ...=...N\......4
0x0020   5010 446c f5a1 0000 0000 0000 0000             P.Dl..........
10:05:45.887038 A.B.C.61.34638 > A.B.C.3.h323hostcall: P 5:213(208) ack 1 win 17520 (DF)
0x0000   4500 00f8 9410 4000 7f06 2781 cd96 d23d        E.....@...'....=
0x0010   cd96 d203 874e 06b8 c5fa d634 5c17 b00a        .....N.....4\...
0x0020   5018 4470 088e 0000 0802 0bca 0504 0388        P.Dp............
0x0030   c0a5 2808 626f 6220 626f 6200 7e00 b905        ..(.bob.bob.~...
0x0040   10a8 0600 0891 4a00 0201 4006 0062 006f        [email protected]
0x0050   0062                                           .b
10:05:45.937038 A.B.C.3.h323hostcall > A.B.C.61.34638: P 1:5(4) ack 213 win 17308 (DF)
0x0000   4500 002c 3a68 4000 8006 80f5 cd96 d203        E..,:h@.........
0x0010   cd96 d23d 06b8 874e 5c17 b00a c5fa d704        ...=...N\.......
0x0020   5018 439c f26a 0000 0300 002b 002b             P.C..j.....+.+
10:05:46.097038 A.B.C.61.34638 > A.B.C.3.h323hostcall: . ack 5 win 17516 (DF)
0x0000   4500 0028 9411 4000 7f06 2850 cd96 d23d        E..(..@...(P...=
0x0010   cd96 d203 874e 06b8 c5fa d704 5c17 b00e        .....N......\...
0x0020   5010 446c f4cd 0000 5555 5555 5555             P.Dl....UUUUUU
10:05:46.097038 A.B.C.3.h323hostcall > A.B.C.61.34638: P 5:44(39) ack 213 win 17308 (DF)
0x0000   4500 004f 3a69 4000 8006 80d1 cd96 d203        E..O:i@.........
0x0010   cd96 d23d 06b8 874e 5c17 b00e c5fa d704        ...=...N\.......
0x0020   5018 439c dc0d 0000 0802 8bca 017e 001f        P.C..........~..
0x0030   0503 8006 0008 914a 0002 0201 2011 0034        .......J.......4
0x0040   94bf 2315 64d7 4b99 ee1d 10ef 8700 5d          ..#.d.K.......]
10:05:46.297038 A.B.C.61.34638 > A.B.C.3.h323hostcall: . ack 44 win 17477 (DF)
0x0000   4500 0028 9412 4000 7f06 284f cd96 d23d        E..(..@...(O...=
0x0010   cd96 d203 874e 06b8 c5fa d704 5c17 b035        .....N......\..5
0x0020   5010 4445 f4cd 0000 5555 5555 5555             P.DE....UUUUUU
10:05:49.787038 A.B.C.3.h323hostcall > A.B.C.61.34638: P 44:48(4) ack 213 win 17308 (DF)
0x0000   4500 002c 3a6a 4000 8006 80f3 cd96 d203        E..,:j@.........
0x0010   cd96 d23d 06b8 874e 5c17 b035 c5fa d704        ...=...N\..5....
0x0020   5018 439c f1f5 0000 0300 0075 0075             P.C........u.u
10:05:49.897038 A.B.C.61.34638 > A.B.C.3.h323hostcall: . ack 48 win 17473 (DF)
0x0000   4500 0028 9414 4000 7f06 284d cd96 d23d        E..(..@...(M...=
0x0010   cd96 d203 874e 06b8 c5fa d704 5c17 b039        .....N......\..9
0x0020   5010 4441 f4cd 0000 5555 5555 5555             P.DA....UUUUUU
10:05:49.897038 A.B.C.3.h323hostcall > A.B.C.61.34638: P 48:161(113) ack 213 win 17308 (DF)
0x0000   4500 0099 3a6b 4000 8006 8085 cd96 d203        E...:k@.........
0x0010   cd96 d23d 06b8 874e 5c17 b039 c5fa d704        ...=...N\..9....
0x0020   5018 439c c513 0000 0802 8bca 0704 0388        P.C.............
0x0030   c0a5 2809 6861 6e6b 2068 616e 6b7e 0059        ..(.hank.hank~.Y
0x0040   0502 c006 0008 914a 0002 00cd 96d2 0307        .......J........
0x0050   8922                                           ."
10:05:49.907038 A.B.C.61.34639 > A.B.C.3.1929: S:(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
0x0000   4500 0030 9415 4000 7f06 2844 cd96 d23d        E..0..@...(D...=
0x0010   cd96 d203 874f 0789 c60b d124 0000 0000        .....O.....$....
0x0020   7002 4000 dda7 0000 0204 05b4 0101 0402        p.@.............
10:05:49.907038 A.B.C.3.1929 > A.B.C.61.34639: S:(0) ackwin 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000   4500 0030 3a6c 4000 8006 80ed cd96 d203        E..0:l@.........
0x0010   cd96 d23d 0789 874f 5c28 50d7 c60b d125        ...=...O\(P....%
0x0020   7012 4470 2c27 0000 0204 05b4 0101 0402        p.Dp,'..........
10:05:49.907038 A.B.C.61.34639 > A.B.C.3.1929: . ack 1 win 0
0x0000   4500 0028 0000 0000 3b06 4062 cd96 d23d        E..(....;.@b...=
0x0010   cd96 d203 874f 0789 c60b d125 5c28 50d8        .....O.....%\(P.
0x0020   5010 0000 9d5b 0000 5555 5555 5555             P....[..UUUUUU
10:05:49.907038 A.B.C.61.34639 > A.B.C.3.1929: . ack 1 win 17520 (DF)
0x0000   4500 0028 9416 4000 7f06 284b cd96 d23d        E..(..@...(K...=
0x0010   cd96 d203 874f 0789 c60b d125 5c28 50d8        .....O.....%\(P.
0x0020   5010 4470 58eb 0000 5555 5555 5555             P.DpX...UUUUUU
10:05:49.907038 A.B.C.61.34639 > A.B.C.3.1929: P 1:5(4) ack 1 win 17520 (DF)
0x0000   4500 002c 9417 4000 7f06 2846 cd96 d23d        E..,..@...(F...=
0x0010   cd96 d203 874f 0789 c60b d125 5c28 50d8        .....O.....%\(P.
0x0020   5018 4470 53d5 0000 0300 020a 5555             P.DpS.......UU
10:05:49.907038 A.B.C.3.1929 > A.B.C.61.34639: P 1:5(4) ack 5 win 17516 (DF)
0x0000   4500 002c 3a6d 4000 8006 80f0 cd96 d203        E..,:m@.........
0x0010   cd96 d23d 0789 874f 5c28 50d8 c60b d129        ...=...O\(P....)
0x0020   5018 446c 53d5 0000 0300 020a 020a             P.DlS.........
10:05:49.907038 A.B.C.61.34639 > A.B.C.3.1929: P 5:534(529) ack 5 win 17516 (DF)
0x0000   4500 0239 9418 4000 7f06 2638 cd96 d23d        E..9..@...&8...=
0x0010   cd96 d203 874f 0789 c60b d129 5c28 50dc        .....O.....)\(P.
0x0020   5018 446c 2ecb 0000 0270 0106 0008 8175        P.Dl.....p.....u
0x0030   0003 800d 0000 3c00 0100 0001 0000 0100        ......<.........
0x0040   000e 807f ff04 b542 8080 0101 8000 0e48        .......B.......H
0x0050   3060                                           0`



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.