TCP session established even if the server isn't listening on particular port

Question

I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "connected to..." message. The thing is that the destination server isn't listening on TCP port 5060 and I shoudn't get this message.

According to the Wireshark results, destination server doesn't reply to 'TCP SYN' packet with 'TCP SYN, ACK' but it rather sends TCP retransmission.

But when I check Wireshark results on the Citrix host (source of the traffic), I can see that session is established anyway, please see it below.

Another thing is that when I get "connected to" message on Citrix host it isn't possible to send anything through it. I mean If I try to hit enter or any other key the session is imidiately closed. You can also see it in the picture above.

This isn't currently affecting our network, but I'm simply wondering why it's happening. I have never seen it before. Bug, feature or Malware?

Drawing for a better understanding:

Many thanks for any hits on that.

Daniel

Answer 1

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means that you are connecting to the SIP ALG on the Fortinet Firewall. And, since this is an application level gateway and not only some packet filter rules it will first accept the TCP connection before it tries to forward the connection to the original target system. Therefore you get a full TCP handshake between your system and the Firewall even though the final target does not listen to port 5060.

I mean If I try to hit enter or any other key the session is imidiately closed.

That's probably because you did not send a proper SIP request.