This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NAT malfunction LAN on WAN

While examining the logs, I noticed a pattern that was quite disturbing; my LAN addresses are being sent to the internet. All packets appear to be ACK FIN. RST ACk packets have also been captured.

Inclosed is a packet capture between the ASG and my modem (which I own).

Can someone please explain this?

Jim

This thread was automatically locked due to age.

0 BarryG over 16 years ago

Is masquerading configured for all your LANs/DMZs?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to BarryG

Yes.

Network = LAN

Interface = WAN

All initially appear to be outbound to remote port 80.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to Jim Tagert

Any chance you have 'Full transparent mode' selected for the HTTP proxy?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to BAlfson

No chance.

If it were only that easy...

Again, initial data indicates to only be ACK FIN and ACK RST packets.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to Jim Tagert

Latest observation:

The ASG packet filter log indicates the packets are [ACK FIN], however the packets captured outside of the ASG show them as [FIN, ACK].
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to Jim Tagert

Additional data:

ASG packet filter log shows [ACK RST] and the packet capture outside of the ASG shows [RST, ACK]
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to Jim Tagert

the long dramatic pause causes tensions to increase...the silence leaves the mind to ponder what might be happening...he patiently awaits the testing...he wonders if his installation is broken, or did he find a bug...
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to Jim Tagert

Hello?

Can anyone confirm my observations?

Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 Jim Tagert over 16 years ago in reply to Jim Tagert

ISO roll-back install of v7.4 did not correct the problem.

Turning off HTTPS Scanning appeared to help or work...still unsure.

After upgrading to v7.401 and immediately after turning HTTPS Scanning back on, IP addresses from my LAN were captured sending [FIN, ACK] or [ACK FIN] whichever place one looks.

I have NOT conducted enough experiments to confirm anything as the cause. Just that it is still happening.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to Jim Tagert

Jim, If you'd like another set of eyes on it, I can look at it for a few minutes. Click on my name beside the avatar and email me if you like.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel