Hi guys, I have a host 192.168.10.10 subnet, polling for mail from 192.168.10.105, which also has another network card, 10.0.0.3 I am running tcpdump on 10.0.0.2 [the firewall] and all I see from 'host 192.168.10.100' are UDP packets and acks. Nothing TCP. So I log in to my windows PC, 192.168.10.44 and start wireshark, and using the expression 'ip.src eq 192.168.10.10' and all I see are UDP packets again. Looking at the mail server logs, I can tell that the mail client 192.168.10.10 is running as he is polling the mail server for messages. This user uses AVG antivirus which is not what is installed on the other PCs and I am just wondering how it is possible for TCP packets/segments not to be detected by a packet sniffer in the same subnet. Anyone who can unravel this mind boggling mystery for me??? Me.
Wireshark is Wireshark. Check your filters and ensure you are in the interception path. EoE On 12/17/10, Simon Mbuthia <simon.mbuthia@gmail.com> wrote:
Hi guys,
I have a host 192.168.10.10 subnet, polling for mail from 192.168.10.105, which also has another network card, 10.0.0.3
I am running tcpdump on 10.0.0.2 [the firewall] and all I see from 'host 192.168.10.100' are UDP packets and acks. Nothing TCP. So I log in to my windows PC, 192.168.10.44 and start wireshark, and using the expression 'ip.src eq 192.168.10.10' and all I see are UDP packets again. Looking at the mail server logs, I can tell that the mail client 192.168.10.10 is running as he is polling the mail server for messages. This user uses AVG antivirus which is not what is installed on the other PCs and I am just wondering how it is possible for TCP packets/segments not to be detected by a packet sniffer in the same subnet.
Anyone who can unravel this mind boggling mystery for me???
Me.
-- Sent from my mobile device
Hi, acks are TCP, returned after a syn is sent to 'acknowlege' receipt ... can you dump the text of one of the UDP packets? On 12/17/10, Casper Odicoh <codicoh@gmail.com> wrote:
Wireshark is Wireshark.
Check your filters and ensure you are in the interception path.
EoE
On 12/17/10, Simon Mbuthia <simon.mbuthia@gmail.com> wrote:
Hi guys,
I have a host 192.168.10.10 subnet, polling for mail from 192.168.10.105, which also has another network card, 10.0.0.3
I am running tcpdump on 10.0.0.2 [the firewall] and all I see from 'host 192.168.10.100' are UDP packets and acks. Nothing TCP. So I log in to my windows PC, 192.168.10.44 and start wireshark, and using the expression 'ip.src eq 192.168.10.10' and all I see are UDP packets again. Looking at the mail server logs, I can tell that the mail client 192.168.10.10 is running as he is polling the mail server for messages. This user uses AVG antivirus which is not what is installed on the other PCs and I am just wondering how it is possible for TCP packets/segments not to be detected by a packet sniffer in the same subnet.
Anyone who can unravel this mind boggling mystery for me???
Me.
-- Sent from my mobile device _______________________________________________ Skunkworks mailing list Skunkworks@lists.my.co.ke http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------ Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Sent from my mobile device
Hey Simon, Use the command "netstat -a" from command line of the 192.168.10.10 machine. This will display all the ip sessions and you can get confirmation of the tcp sessions. Seems the AVG has some bad fix or patch that could be causing the tcp stack to malfunction . Disable the AVG, run a telnet session from the host to your mail server and then check the trace. HTHs. On Fri, Dec 17, 2010 at 4:50 PM, Simon Mbuthia <simon.mbuthia@gmail.com>wrote:
Hi guys,
I have a host 192.168.10.10 subnet, polling for mail from 192.168.10.105, which also has another network card, 10.0.0.3
I am running tcpdump on 10.0.0.2 [the firewall] and all I see from 'host 192.168.10.100' are UDP packets and acks. Nothing TCP. So I log in to my windows PC, 192.168.10.44 and start wireshark, and using the expression 'ip.src eq 192.168.10.10' and all I see are UDP packets again. Looking at the mail server logs, I can tell that the mail client 192.168.10.10 is running as he is polling the mail server for messages. This user uses AVG antivirus which is not what is installed on the other PCs and I am just wondering how it is possible for TCP packets/segments not to be detected by a packet sniffer in the same subnet.
Anyone who can unravel this mind boggling mystery for me???
Me.
participants (4)
-
aki -
Casper Odicoh -
Makobu -
Simon Mbuthia