1

Example situation: a user connected to a server through RDP, port 3389, and works in the server for 4 hours. She does not disconnect and from her point of view, the connection is uninterrupted for the whole duration of 4 hours.

My question: Will this connection be represented by 1 firewall event source port, user's IP, destination port [3389], destination IP [the server] in the firewall logs? Or is the connection being periodically renewed but it is transparent to the user, hence several connection events would be observed in the FW logs?

Is this decided by the way RDP protocol works or does it depend on implementation and thus both outcomes can be true depending on the implementation?

2

Under normal circumstances, this would be represented by a single flow entry, provided your firewall only logs an entry at the start of a flow and doesn't log periodic updates on the same flow.

Now - if the user was idle for 4 hours eg: no traffic passed over the RDP session for that long, then most firewalls would age the session out, and would require the user to reconnect, thus creating a second flow entry.

Similarly, RDP is a fairly resilient protocol and in some implementations may re-establish a failed connection.

This is an RDP implementation though, and nothing to do with the firewall

  • Do logs of periodic updates look the same as the original event? Or is there a way to tell the difference, whether it was periodic updates or multiple disconnections and reconnections just from firewall logs? – skooog Apr 4 '18 at 13:09
  • without knowing your firewall model it's hard to say, but usually if there was periodic updates, they'd include a bytes in/out counter that was incrementing up. If you see a different source port each time, then it would be fair to say that the connection is being reset. – Benjamin Dale Apr 4 '18 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.