eth0 is the DMZ zone ------------------------------- Astaro:/root # tcpdump tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 23:56:50.339436 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:50.538330 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:51.089119 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:51.288129 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:51.428288 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: S 2432623824:2432623824(0) win 16384 23:56:51.429179 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: S 2573890254:2573890254(0) ack 2432623825 win 8192 23:56:51.430171 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: . ack 1 win 17520 23:56:51.431430 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1:20(19) ack 1 win 17520 23:56:51.432275 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: . ack 20 win 64240 23:56:51.437352 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1:20(19) ack 20 win 64240 23:56:51.440976 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 20:90(70) ack 20 win 17501 23:56:51.442411 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 20:847(827) ack 90 win 64170 23:56:51.445129 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 90:404(314) ack 847 win 16674 23:56:51.464615 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 847:894(47) ack 404 win 63856 23:56:51.640968 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: . ack 894 win 16627 23:56:51.720469 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 404:857(453) ack 894 win 16627 23:56:51.721722 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 894:1027(133) ack 857 win 63403 23:56:51.722626 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 857:894(37) ack 1027 win 16494 23:56:51.723030 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 894:927(33) ack 1027 win 16494 23:56:51.724099 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: . ack 927 win 63333 23:56:51.724139 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1027:1063(36) ack 927 win 63333 23:56:51.725099 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 927:964(37) ack 1063 win 16458 23:56:51.726179 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1063:1103(40) ack 964 win 63296 23:56:51.729565 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 964:1001(37) ack 1103 win 16418 23:56:51.730115 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1103:1143(40) ack 1001 win 63259 23:56:51.731061 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1001:1038(37) ack 1143 win 16378 23:56:51.732129 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1143:1183(40) ack 1038 win 63222 23:56:51.732984 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1038:1075(37) ack 1183 win 16338 23:56:51.734128 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1183:1223(40) ack 1075 win 63185 23:56:51.735053 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1075:1112(37) ack 1223 win 16298 23:56:51.736165 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1223:1263(40) ack 1112 win 63148 23:56:51.737084 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1112:1149(37) ack 1263 win 16258 23:56:51.738134 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1263:1303(40) ack 1149 win 63111 23:56:51.790358 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: P 1149:1525(376) ack 1303 win 16218 23:56:51.792285 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1303:1953(650) ack 1525 win 64240 23:56:51.792308 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: P 1953:1987(34) ack 1525 win 64240 23:56:51.793449 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: . ack 1987 win 17520 23:56:51.793658 IP 192.168.2.31.15473 > 172.16.1.2.ms-wbt-server: F 1525:1525(0) ack 1987 win 17520 23:56:51.794117 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: . ack 1526 win 64240 23:56:51.794137 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15473: R 1987:1987(0) ack 1526 win 0 23:56:51.844248 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:52.038169 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:52.788759 IP 172.16.1.2.53596 > 224.0.0.252.5355: UDP, length 26 23:56:52.888329 IP 172.16.1.2.53596 > 224.0.0.252.5355: UDP, length 26 23:56:53.088488 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 23:56:53.838277 IP 172.16.1.2.netbios-ns > 172.16.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST eth1 is zone 1 interface ------------------------------------- Astaro:/root # tcpdump -i eth1 tcp port 3389 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 23:59:07.060637 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: S 1775892671:1775892671(0) win 16384 23:59:07.062067 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: S 1445576331:1445576331(0) ack 1775892672 win 8192 23:59:07.062732 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: . ack 1 win 17520 23:59:07.063466 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1:20(19) ack 1 win 17520 23:59:07.065777 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: . ack 20 win 64240 23:59:07.071794 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1:20(19) ack 20 win 64240 23:59:07.075338 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 20:90(70) ack 20 win 17501 23:59:07.077272 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 20:847(827) ack 90 win 64170 23:59:07.080049 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 90:404(314) ack 847 win 16674 23:59:07.099428 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 847:894(47) ack 404 win 63856 23:59:07.238839 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: . ack 894 win 16627 23:59:07.346712 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 404:857(453) ack 894 win 16627 23:59:07.348412 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 894:1027(133) ack 857 win 63403 23:59:07.349206 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 857:894(37) ack 1027 win 16494 23:59:07.349430 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 894:927(33) ack 1027 win 16494 23:59:07.349860 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: . ack 927 win 63333 23:59:07.349920 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1027:1063(36) ack 927 win 63333 23:59:07.350863 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 927:964(37) ack 1063 win 16458 23:59:07.351911 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1063:1103(40) ack 964 win 63296 23:59:07.352649 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 964:1001(37) ack 1103 win 16418 23:59:07.353934 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1103:1143(40) ack 1001 win 63259 23:59:07.354901 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1001:1038(37) ack 1143 win 16378 23:59:07.355910 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1143:1183(40) ack 1038 win 63222 23:59:07.356573 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1038:1075(37) ack 1183 win 16338 23:59:07.357904 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1183:1223(40) ack 1075 win 63185 23:59:07.358871 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1075:1112(37) ack 1223 win 16298 23:59:07.359893 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1223:1263(40) ack 1112 win 63148 23:59:07.360636 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1112:1149(37) ack 1263 win 16258 23:59:07.361902 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1263:1303(40) ack 1149 win 63111 23:59:07.415538 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: P 1149:1525(376) ack 1303 win 16218 23:59:07.418268 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1303:1953(650) ack 1525 win 64240 23:59:07.418322 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: P 1953:1987(34) ack 1525 win 64240 23:59:07.419275 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: . ack 1987 win 17520 23:59:07.419636 IP 192.168.2.31.15490 > 172.16.1.2.ms-wbt-server: F 1525:1525(0) ack 1987 win 17520 23:59:07.420858 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: . ack 1526 win 64240 23:59:07.420908 IP 172.16.1.2.ms-wbt-server > 192.168.2.31.15490: R 1987:1987(0) ack 1526 win 0