Tag Archives: wireshark

Packet Capture on Both Sides of a Conversation

Greetings everyone!! Yes, it’s been a while…sorry about that. Been busy with life…I’ll just leave it at that.

So at work, for the last couple of days, the Citrix admin has been having an issue with users at one of our larger remote sites…seems they are intermittently unable to connect to a Citrix server after being redirected by the Citrix license server. He brought me into the problem this morning once he realized the problem was only occurring at this one site. Very interesting!

First step was to capture some of the traffic and see what’s going on. I have a Linux server at the Data Center running Snort, watching most all of the traffic into and out of the Data Center, so this comes in very handy when I need to capture some traffic.┬áI started a TCPDUMP on the server, specifying the interface in question that has the traffic from the remote site, and dumped it into a file…the command was…

tcpdump -vv -nn -s 0 -i eth3 -w /root/pcapfiles/citrix_issue.pcap host

The Citrix admin was remoted onto a PC at the site, and he attempted to connect into Citrix. After I captured the data, I moved the file to my laptop and opened it up with Wireshark…I saw the 3 way handshake (SYN – SYN/ACK – ACK), and then some data going back and forth, but the session never started up and it timed out. Weird.

I also captured a Wireshark session from my own laptop so I could see how it was supposed to work. I still could not see what the issue was…very strange.

I then decided that I needed to see packet captures from both sides of the conversation. So I remoted into the PC and installed Wireshark on it…I then started up Wireshark on the PC and TCPDUMP on my Linux server, and then tried the Citrix client again. After it timed out, I opened up both PCAP files in Wireshark and examined them side by side, packet by packet. On the PC, I saw this…(PC =, and Citrix server =…

Packet capture on PC side showing initial SYN packet

Packet capture on PC side showing initial SYN packet

I found the matching packet on the capture from the Data Center…

Packet capture from Citrix server side showing full handshake

Packet capture from Citrix server side showing full handshake

Say what????? I see a completed 3-way handshake…including the SYN/ACK from the server back to the PC (which was not in the PC capture), and another packet from the PC to the server completing the handshake…also not in the PC capture. VERY bizarre!!!

Then it hit me…Riverbed!! The only way a handshake could be completed in this manner was from another device sitting in-between…and we do have that. We have Riverbed devices sitting at the Data Center and at most large remotes sites handling WAN optimization. Since no other sites were┬áreporting any issues, then the Riverbed at this remote site must be “kinked”. So we restarted the Citrix application optimization process on the Riverbed, and that fixed everything!

VERY cool…and very interesting. This took some time to figure out, but once I got visibility at both ends of the conversation, the answer was easy. Remember…Wireshark is your friend.

New Versions of NMAP and Wireshark

If you have not already heard, new versions of NMAP and Wireshark have been released recently. These are my favorite open source programs, and to be honest, pretty much my favorite programs period. They are both maintained and managed by a dedicated team of people, and the quality of the software shows. Plus, the main authors (Gerald Combs for Wireshark, and Fyodor for NMAP) are both class acts…

NMAP is THE tool for running forensics on your network…to find the weaknesses before the bad guys do. It has MANY parts, which all work together in a very seamless manner, and should be in every network engineers tool kit. If you are not using it, stop what you are doing and get it now!! (Enough said!!) New version is 7.00.

Same thing about Wireshark. I’ve said it before and I’ll say it again…if you don’t have a network analyzer, then you’re not really a full and complete network engineer. Get it and learn it. There are plenty of resources on the Internet, for free, to help you get started (Google is your friend), and if you want to pay a little bit of money, Laura Chappell has a great website devoted to Wireshark training.

I just downloaded the updated Wireshark today (version 2.0.0), and I have to say the default screen is spartan, to say the least. Not sure if this is temporary in this initial v2 build, but either way, it does not look like it’s predessor. Note how clean (and empty) the startup screen is…

Initial Wireshark startup screen

Initial Wireshark startup screen

Here is some info from Gerald about this new version. I’m looking forward to learning what it has to offer!