This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

There is an application which is trying to talk to a host on a particular port and I want to see if that port is getting blocked .. I have the wireshark captures but unable to find out which error to look for.

Can you please advice ?

asked 05 Aug '16, 04:52

Gurushant's gravatar image

Gurushant
6112
accept rate: 0%

edited 05 Aug '16, 07:09

Jaap's gravatar image

Jaap ♦
11.7k16101

That totally depends on where these captures were made, on which interfaces it was done.

(05 Aug '16, 07:09) Jaap ♦

These traces were ran on a windows server where we have the config server application hosted which acts as a server and other application which is a client is trying to access the main application through the port. So we ran traces to identify the traffic that is coming into the server and want to identify if the port is getting blocked at any point of time ? Can you let us know how we identify this within the trace results ?

Thank you !

(05 Aug '16, 08:34) Gurushant

Trace from the client and you will be able to see [SYN], [RST] patterns as long as the server itself is rejecting (No App listening etc): If there is a Firewall, you may not see anything except retransmissions going to nowhere. Trace on the server and you probably wont see anything unless there is software blocking the port up the stack somewhere. But you can see that with netstat or tcpview. Not entirely 100% sure if you mean the client software is also running on the server or if it is a separate computer.

(09 Aug '16, 06:15) DarrenWright

Depending on the security appliances on the remote site (firewall, proxy server, switch/router ACL's, etc) you will see one of the following symptoms in the 3-way handshake:

1) TCP SYN packets going out, but no TCP SYN ACK replies

2) TCP SYN packets going out, but with a TCP SYN RST reply

Item 1) above could also be due to an inability to find a return route as well, thus not just symptomatic of a blocked port.

FWIW

permanent link

answered 13 Aug '16, 22:04

wbenton's gravatar image

wbenton
29227
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69
×36
×12

question asked: 05 Aug '16, 04:52

question was seen: 9,955 times

last updated: 13 Aug '16, 22:04

p​o​w​e​r​e​d by O​S​Q​A