This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi All,

I have been googleing for 3 days, still couldn't find correct answer yet for this issue. hopeing someone would help me out here.

I have 2 windows2008R2 servers running in the same subnet, actually they are cable connected to each other directly. Both have firewall disabled. Server A can ping Server B successfully, but when i tried to telnet from Server A to a certain port on Server B, it fails. this port is on listening state, and the port local address is 0.0.0.0:1234 (not bind to 127.0.0.1).

The wireshark captured data on Server B says that the TCP [SYN] packet was received by ServerB, and ServerB responced with a TCP [RST,ACK] packet instade of a [SYN, ACK]. which seems exactly same as the port is not listening.

Appreciate for any comments.

asked 14 Aug '14, 03:42

ckliu's gravatar image

ckliu
1112
accept rate: 0%

edited 14 Aug '14, 03:51


are you also telnetting to port 1234? or are you trying to connect to the standard port 23? you should be able to see what port your client is using in the trace.

permanent link

answered 14 Aug '14, 04:05

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

not port23, it is a certain port used by a certain software. i just assum it is 1234. when i type "netstat -nba" in ServerB , i can see the port is listening.

(14 Aug '14, 04:32) ckliu

I don't know how you run your telnet client, but you need to specify the port you want to connect to if it is not 23. So normally you'd run it like this: "telnet IPADDRESS 1234".

(14 Aug '14, 08:27) Jasper ♦♦

yes, I did telnet IPADDRESS 1234, and in the destination server wireshark dump data, we can see there was a [syn] packet coming in, but the destination server responded with a [rst, ack] packet while it has port 1234 listening.

(15 Aug '14, 03:08) ckliu

The wireshark captured data on Server B says that the TCP [SYN] packet was received by ServerB, and ServerB responced with a TCP [RST,ACK] packet instade of a [SYN, ACK]. which seems exactly same as the port is not listening.

sounds like the socket is not in LISTEN mode, although you say it is.

Please post:

  • the output of netstat -nab on server B (only the lines related to port 1234)
  • the output of ipconfig /all on both servers
  • the capture file that shows the TCP reset (you can publish it on google drive, dropbox, or cloudshark.org and post the link here)

Furthermore:

  • is there any security software installed on server B, like Endpoint Security, AV, IDS/IPS, etc.?
  • what happens if you telnet from server B to its own address (not localhost!)?

Regards
Kurt

permanent link

answered 14 Aug '14, 06:57

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 14 Aug '14, 07:01

Hi Kurt,

yes seems exactly same as the port is not in listen mode,

the output of netstat -nba on server B is TCP 0.0.0.0:1234 0.0.0.0:0 LISTENING

(15 Aug '14, 03:27) ckliu

what about the rest of the information I requested?

(15 Aug '14, 09:01) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×81
×20
×7

question asked: 14 Aug '14, 03:42

question was seen: 6,217 times

last updated: 15 Aug '14, 09:01

p​o​w​e​r​e​d by O​S​Q​A