This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, We run an RDP session from LAN PCs to a remote hosted desktop over the internet. All has been fine until one thing changed. The UTM. We have gone from a Netgear UTM 25 to a Cyberoam cr25iNG. Since this has happened an RDP session will 'drop' and then reconnect automatically.

I am new to wireshark and I have a screen shot here which I'd like to use as an example of something odd to an expert eye. They look like keep alives from the remote host, that are actually ACKd. But a second later the same keep alive is sent and again ACKd in a burst. I need to get more data to see if these conincide with drop out but could it be an indication?

Many thanks, Andy.

alt text

asked 09 Feb '17, 11:53

Flattened's gravatar image

Flattened
6113
accept rate: 0%

I have also spotted at a definite cut off time (& at another 2 TCP streams so far what appears to be the PC initiating a 'RST' (see 5309). Any ideas why this would be?

(09 Feb '17, 12:22) Flattened

Hello thankyou for the response.

https://www.cloudshark.org/captures/5e787a7aa5fb

There are RST at frames 2358, 2410 and 4023 in this one.

(10 Feb '17, 02:58) Flattened

I can´t tell you the reason, but at some point the server doesn´t answer anymore. Afterthat 20 sec later, the client sends a RST and opens another session.

(10 Feb '17, 15:49) Christian_R

That's a pity I hoped it could be spotted. Thanks for looking Christian. Andy

(12 Feb '17, 07:15) Flattened
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×22
×8

question asked: 09 Feb '17, 11:53

question was seen: 1,891 times

last updated: 12 Feb '17, 07:15

p​o​w​e​r​e​d by O​S​Q​A