Never mind. I figured it out. Just had to write the problem out in an email
to get my mind working.
When I was capturing data the SYN/ACK source port would change from 1-6.
That made me thank about how overloading works. The interface was configured
as an outside interface. The overload IP was the IP of the interface I was
attempting to telnet to. That's why layer 3 looked okay. But layer 4 threw
me off. When my reply packets got subjected to the NAT translation process
the router would change the source port according to the number of entires
it had. That is why it would change from 1-6. Sorry for sending this in. I
should of thought about it a little bit more :-(
-----Original Message-----
From: Newell Ryan D SrA 18 CS/SCBT
Sent: Thursday, January 23, 2003 7:51 PM
To: '[EMAIL PROTECTED]'
Subject: Telnet SYN/ACK pkt reply on TCP source port 3-6!!??
I tried to telnet to a distant end 3660 router. Connection
would timeout. I was able to ping the router from my PC. The router
could telnet to the router that was between my PC and
itself. Ran capture and the data yielded this....
IP Source 10.0.0.1 Destination 10.0.1.2 TCP SYN destination
port 23 source port 2407
IP Source 10.0.1.2 Destination 10.0.0.1 TCP SYN/ACK
destination port 2407 source port 6
IP Source 10.0.0.1 Destination 10.0.1.2 TCP RST destination
port 6 source port 2407
10.0.0.1 is my PC and 10.0.1.2 is the distant end router. I
believe the RST bit is set on the last packet because my PC is not listening
to that port. So it closes this connections with the RST bit.
We got it working. But the funny thing is.....
The user's 3660 had two interfaces. One on his LAN and one
on my LAN. He was using NAT. He had ip nat outside on both interfaces. The
inside interface was suppose to face my LAN. Once we removed NAT from the
interface facing my LAN, I could telnet to that interface. The NAT string
told the router to overload the interface facing my LAN.
I understand that removing the misconfiguration fixed my
first problem but why?
-
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=61661&t=61661
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
