1

Example situation: a user connected to a server through RDP, port 3389, and works in the server for 4 hours. She does not disconnect and from her point of view, the connection is uninterrupted for the whole duration of 4 hours.

My question: Will this connection be represented by 1 firewall event source port, user's IP, destination port [3389], destination IP [the server] in the firewall logs? Or is the connection being periodically renewed but it is transparent to the user, hence several connection events would be observed in the FW logs?

Is this decided by the way RDP protocol works or does it depend on implementation and thus both outcomes can be true depending on the implementation?

Improve this question

1 Answer 1

Reset to default
2

Under normal circumstances, this would be represented by a single flow entry, provided your firewall only logs an entry at the start of a flow and doesn't log periodic updates on the same flow.

Now - if the user was idle for 4 hours eg: no traffic passed over the RDP session for that long, then most firewalls would age the session out, and would require the user to reconnect, thus creating a second flow entry.

Similarly, RDP is a fairly resilient protocol and in some implementations may re-establish a failed connection.

This is an RDP implementation though, and nothing to do with the firewall

Improve this answer
2
  • Do logs of periodic updates look the same as the original event? Or is there a way to tell the difference, whether it was periodic updates or multiple disconnections and reconnections just from firewall logs?
    – skooog
    Apr 4, 2018 at 13:09
  • without knowing your firewall model it's hard to say, but usually if there was periodic updates, they'd include a bytes in/out counter that was incrementing up. If you see a different source port each time, then it would be fair to say that the connection is being reset.
    – Benjamin Dale
    Apr 4, 2018 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.