You would like to confirm If you can connect to 172.16.20.30:22 from 10.0.1.15, and vice-versa?
ANS: We can use IP spoofing technique to identify that.
Is this doable if I can't log in to either server and try opening a connection directly?
ANS: Yes this is doable if you have ASA firewall in between these two servers but if meets below condition
ASA should be running with IOS 9.X
Packets between these severs should only go through this firewall and servers should not communicate directly.If above conditions are met, we can use ping tcp command to confirm this, the actual command would be,
ping tcp 172.16.20.30 22 source 10.0.1.15 5678
ping tcp 10.0.1.15 22 source 172.16.20.30 7885
You will get "!" If port 22 is open between these two IP's
Can it be done indirectly from my workstation?
Yes, there is one old logic of IP spoofing to identify this but not sure about its success percentage.. This technique is doable only if there shouldn't be any traffic to these servers from any other IP's apart from your workstation..
This could be identified by obseving IP Identification field in IP header..
(Identification(16 bits): This field is used for uniquely identifying the IP datagrams. This value is incremented every-time an IP datagram is sent from source to the destination. This field comes in handy while reassembly of fragmented IP data grams.)
Here is how,
You have to send TCP SYN packet to 172.16.20.30(host A) in port 22 with spoofed source IP as 10.0.1.15(host B) from your workstation. Of course as you know, the reply from B will be to A but not to your workstation.
IPID is the the unique identification number of IP packet and that will get increment to each packet.
The reply from A to your SYN packet would be as below,
- A reply SYN/ACK to SYN if tcp 22 port is open, reply RST/ACK if tcp 22 port is closed. This packet will reach B if routes are present as you mentioned
- You can know the number of packets that hosts are sending using IP ID in header field.
- B reply RST to SYN|ACK, reply nothing to RST/ACK.
Flow will be as below
You send SYN packet to Host B in port 22 with your original workstation IP as source. You will get SYN/ACK from B with IP ID as 1(for example)
You send SYN packet to host A with spoofed Host B IP as source in port 22 from your workstation.
If port 22 is open at Host A for Host B, A replies with SYN/ACK to B.
Then B replies to A with RST and IP ID as 2, since B didn't sent TCP SYN originally to have TCP session (originally you sent it from your workstation which both parties dont know about it).
After few sec you send one more SYN to B then you will get SYN/ACK from B with IP ID as 3. (So there is one more addional increment comparing the previous reply from B)
This confirm that you can connect to A from B in port 22.
If port 22 is closed at A for B, then the flow will be as below
You send SYN packet to Host B in port 22 with your original workstation IP as source. You will get SYN/ACK from B with IP ID as 1(for example)
You send SYN packet to host A with spoofed Host B IP as source in port 22 from your workstation.
If port 22 is closed at Host A for Host B, A replies with RST/ACK to B.
Then B discards the RST from A, wont send any reply to A.
After few sec you send one more SYN to B then you will get SYN/ACK from B with IP ID as 2.
This confirms that you cannot connect to Host A from Host B in port 22.