0

I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "connected to..." message. The thing is that the destination server isn't listening on TCP port 5060 and I shoudn't get this message.

According to the Wireshark results, destination server doesn't reply to 'TCP SYN' packet with 'TCP SYN, ACK' but it rather sends TCP retransmission.

enter image description here

But when I check Wireshark results on the Citrix host (source of the traffic), I can see that session is established anyway, please see it below.

enter image description here

Another thing is that when I get "connected to" message on Citrix host it isn't possible to send anything through it. I mean If I try to hit enter or any other key the session is imidiately closed. You can also see it in the picture above.

This isn't currently affecting our network, but I'm simply wondering why it's happening. I have never seen it before. Bug, feature or Malware?

Drawing for a better understanding:

enter image description here

Many thanks for any hits on that.

Daniel

5

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means that you are connecting to the SIP ALG on the Fortinet Firewall. And, since this is an application level gateway and not only some packet filter rules it will first accept the TCP connection before it tries to forward the connection to the original target system. Therefore you get a full TCP handshake between your system and the Firewall even though the final target does not listen to port 5060.

I mean If I try to hit enter or any other key the session is imidiately closed.

That's probably because you did not send a proper SIP request.

  • I'll try to find out more information about it, but basically it makes sense. Many thanks for pointing me to right direction and also absolutely instant reply from you. :-) – Daniel Blazek Jun 12 '17 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.