<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Reverse telnet sessions are using not TELNET protocol? in Network Security</title>
    <link>https://community.cisco.com/t5/network-security/reverse-telnet-sessions-are-using-not-telnet-protocol/m-p/1969036#M935112</link>
    <description>&lt;P&gt;Hello guys.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;I want to sniff reverse telnet sessions, and see in the logs, if someone tried to break the device.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;That's really interesting what I found today. There is a few captures from wireshark.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;When we are using port 23 for telnet connection, everything is as we want to, we can see the commands in clear-text format:&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;IMG src="https://community.cisco.com/legacyfs/online/legacy/6/8/5/90586-telnet1.jpg" alt="telnet1.jpg" class="jive-image-thumbnail jive-image" width="450" /&gt;&lt;/P&gt;&lt;P&gt;When we try to connect to another device via reverse telnet, ( port 2011 in my example) we can see that we are using just TCP protocol, and we can't see any clear-text data:&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;IMG src="https://community.cisco.com/legacyfs/online/legacy/7/8/5/90587-telnet2.jpg" alt="telnet2.jpg" class="jive-image-thumbnail jive-image" width="450" /&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;So Experts,&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Is there a way to configure and use these ports as basic telnet session? &lt;SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/images/emoticons/happy.gif"&gt;&lt;/SPAN&gt; I need to see some clear-text there&lt;SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/images/emoticons/happy.gif"&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Maybe if I can't sniff these reverse-telnet sessions, there is a method to log somehow, reverse-telnet lines (tty lines) ?&lt;/P&gt;</description>
    <pubDate>Fri, 21 Feb 2020 12:39:52 GMT</pubDate>
    <dc:creator>EvaldasOu</dc:creator>
    <dc:date>2020-02-21T12:39:52Z</dc:date>
    <item>
      <title>Reverse telnet sessions are using not TELNET protocol?</title>
      <link>https://community.cisco.com/t5/network-security/reverse-telnet-sessions-are-using-not-telnet-protocol/m-p/1969036#M935112</link>
      <description>&lt;P&gt;Hello guys.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;I want to sniff reverse telnet sessions, and see in the logs, if someone tried to break the device.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;That's really interesting what I found today. There is a few captures from wireshark.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;When we are using port 23 for telnet connection, everything is as we want to, we can see the commands in clear-text format:&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;IMG src="https://community.cisco.com/legacyfs/online/legacy/6/8/5/90586-telnet1.jpg" alt="telnet1.jpg" class="jive-image-thumbnail jive-image" width="450" /&gt;&lt;/P&gt;&lt;P&gt;When we try to connect to another device via reverse telnet, ( port 2011 in my example) we can see that we are using just TCP protocol, and we can't see any clear-text data:&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;IMG src="https://community.cisco.com/legacyfs/online/legacy/7/8/5/90587-telnet2.jpg" alt="telnet2.jpg" class="jive-image-thumbnail jive-image" width="450" /&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;So Experts,&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Is there a way to configure and use these ports as basic telnet session? &lt;SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/images/emoticons/happy.gif"&gt;&lt;/SPAN&gt; I need to see some clear-text there&lt;SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/images/emoticons/happy.gif"&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Maybe if I can't sniff these reverse-telnet sessions, there is a method to log somehow, reverse-telnet lines (tty lines) ?&lt;/P&gt;</description>
      <pubDate>Fri, 21 Feb 2020 12:39:52 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-security/reverse-telnet-sessions-are-using-not-telnet-protocol/m-p/1969036#M935112</guid>
      <dc:creator>EvaldasOu</dc:creator>
      <dc:date>2020-02-21T12:39:52Z</dc:date>
    </item>
    <item>
      <title>Reverse telnet sessions are using not TELNET protocol?</title>
      <link>https://community.cisco.com/t5/network-security/reverse-telnet-sessions-are-using-not-telnet-protocol/m-p/1969037#M935113</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Nothing to add? &lt;SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/emoticons/happy.gif"&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Sat, 23 Jun 2012 13:07:02 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-security/reverse-telnet-sessions-are-using-not-telnet-protocol/m-p/1969037#M935113</guid>
      <dc:creator>EvaldasOu</dc:creator>
      <dc:date>2012-06-23T13:07:02Z</dc:date>
    </item>
  </channel>
</rss>

