topic Re: Wireshark Traces in Network Security

Wireshark Traces

kamrannaseem1 — Fri, 21 Feb 2020 16:31:25 GMT

Hello,

I would like to know at which end the issue lies, In the attached wireshark traces, the ip address 10.92.55.255 sends SYN to 92.60.106.204 and the ip 92.60.106.204 replies with SYN ACK but then we don't see any ACK from 10.92.55.255.

Can we say the issue is at 10.92.55.255 end as its not replying back to the SYN ACk ? or is there anyway to check if 10.92.55.255 has received the SYN ACK from 92.60.106.204 so that it can respond 92.60.106.204 with an ACK ?

Any help will be much appreciated.

Thanks,

Re: Wireshark Traces

Daniele Giordano — Thu, 29 Nov 2018 14:39:32 GMT

Hi, yes the issue seems related to server with IP 10.92.55.255.

The ACK is missing.

Can you install wireshark directly on the server?

If it's a linux, can you execute a tcpdump to check if the server receive the SYN ACK?

Regards.

Re: Wireshark Traces

kamrannaseem1 — Fri, 30 Nov 2018 11:44:44 GMT

Thanks Daniele for the reply.

The 10.92.55.255 device is a 3G device and the customer can't run any debugs on it.

Is there any other way we can check to see if the SYN ACK is being received by this device ?

Thanks.

Re: Wireshark Traces

Daniele Giordano — Fri, 30 Nov 2018 12:54:55 GMT

Is this device connected to a ethernet switch?

If yes, you can configure a span port (port mirror) to this switch in order to capture the traffic destinated and originated to the 3G device.

Regards.

Re: Wireshark Traces

Marvin Rhoads — Fri, 30 Nov 2018 13:09:26 GMT

3G is a wireless radio connection type. So it would not be connected to a wired switch.

The best the OP would be able to do is monitor from the point at which it leaves the network and goes to the wireless gateway. You may be able to see the SYN ACK outbound there; but the only way to see if for sure on the endpoint is to have an on-device tool that captures endpoint traffic.