Блокирование порта RDP из другой подсети.

[AlekseyEV]

Доброго времени суток. Есть сервер AD на нем еще роль терминального сервера (назовем его 241) и сервер терминалов на базе 2008 р2 (назовем его 246), а так же две подсети ходящие через туннель, подсеть 192.168.0.0 и 192.168.2.0 и 192.168.9.0 Сами сервера виртуальные, имеют обшее железо и находятся в подсети 0.0 , пользователи которой спокойно используют сервисы этих серверов. А пользователи подсети 2.0 почему то не могут подключится 241 серверу по RDP, а сервисы 246 используют без проблем, даже пользователи подсети 192.168.9.0 работают на 241.
Инфа с 246:
C:\Users\1>netstat -an | findstr 3389
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
TCP 192.168.0.241:3389 192.168.0.39:52559 ESTABLISHED
TCP 192.168.0.241:3389 192.168.0.41:49232 ESTABLISHED
TCP 192.168.0.241:3389 192.168.0.44:2233 ESTABLISHED
TCP 192.168.0.241:3389 192.168.0.177:49248 ESTABLISHED
TCP 192.168.0.241:3389 192.168.9.1:49356 ESTABLISHED
TCP [::]:3389 [::]:0 LISTENING

C:\Users\1>ipconfig

Настройка протокола IP для Windows


Ethernet adapter Подключение по локальной сети:

DNS-суффикс подключения . . . . . :
IPv4-адрес. . . . . . . . . . . . : 192.168.0.241
Маска подсети . . . . . . . . . . : 255.255.255.0
Основной шлюз. . . . . . . . . : 192.168.0.254

Туннельный адаптер isatap.{F8678EB1-E70A-4DE0-8AC6-472EC00C3985}:

Состояние среды. . . . . . . . : Среда передачи недоступна.
DNS-суффикс подключения . . . . . :

Туннельный адаптер Teredo Tunneling Pseudo-Interface:

Состояние среды. . . . . . . . : Среда передачи недоступна.
DNS-суффикс подключения . . . . . :
Один сетевой адаптер на 241 сервере. Брэндмауэр отключен для всех типов сетей. Странно, что даже со второй подсети по телнету не достучатся к порту 3389, НО на порт служебной программы с подсети 2.0 по телнету связь есть, что отсекает проблему тунеля и шлюза. Итого: на 241 перекрыт для подсети 2.0 порт 3389. В чем причина сей проблемы?

[AlekseyEV]

Еще один странный момент: Пытаюсь пинговать 241 сервер из подсети 2.0 пинга нет, делаю попытку соединения по рдп - пинг появляется. Напонятно :(
Далее ошибки при попытке подключится чередуются от недоступности до "Из-за ошибки безопасности клиент не смог подключится к серверу терминалов."
Конфигурация сервера узла сеансов RDP - Разрешить все подключения.

[User001]

Журнал на наличие ошибок проверяли?
Попробуйте посмотреть сниффером (например, Microsoft Network Monitor (http://www.microsoft.com/en-us/download/details.aspx?id=4865)), что проходит, а что нет.

[AlekseyEV]

Здравствуйте. Журнал ошибок пуст. Что касается сниффера, то я его установил, но не хватает квалификации для расшифровки его логов, непонятно что там к чему. Сейчас пытаюсь расшифровать. Вот что выдал снифер при поппытки соединится по РДП с сервером 241
IPv4 (192.168.2.210 - 192.168.0.241) ConvID = 54
271 12:01:40 07.02.2014 5.7900970 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=......S., SrcPort=3089, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=718134080, Ack=0, Win=65535 ( ) = 65535 {TCP:55, IPv4:54}
272 12:01:40 07.02.2014 5.7902025 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A..S., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=0, Seq=3282680714, Ack=718134081, Win=8192 ( Scale factor not supported ) = 8192 {TCP:55, IPv4:54}
275 12:01:40 07.02.2014 5.8744443 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3089, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=718134081, Ack=3282680715, Win=65535 (scale factor 0x0) = 65535 {TCP:55, IPv4:54}
276 12:01:40 07.02.2014 5.8771672 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local X224 X224:Connection Request {ISOTS:56, TCP:55, IPv4:54}
277 12:01:40 07.02.2014 5.8772441 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=0, Seq=3282680715, Ack=718134117, Win=64240 (scale factor 0x0) = 64240 {TCP:55, IPv4:54}
278 12:01:40 07.02.2014 5.8772874 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 X224 X224:Connection Confirm {ISOTS:56, TCP:55, IPv4:54}
280 12:01:40 07.02.2014 5.9700453 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:MCSConnect Initial {T125:57, ISOTS:56, TCP:55, IPv4:54}
281 12:01:40 07.02.2014 5.9708196 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:MCSConnect Response {T125:57, ISOTS:56, TCP:55, IPv4:54}
283 12:01:40 07.02.2014 5.9715236 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:[ReTransmit #281]Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=1440, Seq=3282680726 - 3282682166, Ack=718134529, Win=63828 (scale factor 0x0) = 63828 {TCP:55, IPv4:54}
287 12:01:41 07.02.2014 6.2233120 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3089, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=718134529, Ack=3282682166, Win=64084 (scale factor 0x0) = 64084 {TCP:55, IPv4:54}
288 12:01:41 07.02.2014 6.2233424 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=2880, Seq=3282682166 - 3282685046, Ack=718134529, Win=63828 (scale factor 0x0) = 63828 {TCP:55, IPv4:54}
289 12:01:41 07.02.2014 6.3162619 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3089, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=718134529, Ack=3282685046, Win=65535 (scale factor 0x0) = 65535 {TCP:55, IPv4:54}
290 12:01:41 07.02.2014 6.3162968 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=647, Seq=3282685046 - 3282685693, Ack=718134529, Win=63828 (scale factor 0x0) = 63828 {TCP:55, IPv4:54}
294 12:01:41 07.02.2014 6.4073639 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Erect Domain Request, SubHeight = 0, SubInterval = 0 {T125:57, ISOTS:56, TCP:55, IPv4:54}
295 12:01:41 07.02.2014 6.4085350 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Attach User Request {T125:57, ISOTS:56, TCP:55, IPv4:54}
296 12:01:41 07.02.2014 6.4085549 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=0, Seq=3282685693, Ack=718134549, Win=63808 (scale factor 0x0) = 63808 {TCP:55, IPv4:54}
297 12:01:41 07.02.2014 6.4085901 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Attach User Confirm, Result = rt-successful, Indicator = 0x3ef {T125:57, ISOTS:56, TCP:55, IPv4:54}
299 12:01:41 07.02.2014 6.4930516 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ef {T125:57, ISOTS:56, TCP:55, IPv4:54}
300 12:01:41 07.02.2014 6.4932146 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1007, Result = rt-successful {T125:57, ISOTS:56, TCP:55, IPv4:54}
305 12:01:41 07.02.2014 6.5774458 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3eb {T125:57, ISOTS:56, TCP:55, IPv4:54}
306 12:01:41 07.02.2014 6.5775083 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1003, Result = rt-successful {T125:57, ISOTS:56, TCP:55, IPv4:54}
307 12:01:41 07.02.2014 6.6635179 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ec {T125:57, ISOTS:56, TCP:55, IPv4:54}
308 12:01:41 07.02.2014 6.6635872 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1004, Result = rt-successful {T125:57, ISOTS:56, TCP:55, IPv4:54}
309 12:01:41 07.02.2014 6.7481491 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ed {T125:57, ISOTS:56, TCP:55, IPv4:54}
310 12:01:41 07.02.2014 6.7482387 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1005, Result = rt-successful {T125:57, ISOTS:56, TCP:55, IPv4:54}
313 12:01:41 07.02.2014 6.8333249 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ee {T125:57, ISOTS:56, TCP:55, IPv4:54}
314 12:01:41 07.02.2014 6.8333974 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1006, Result = rt-successful {T125:57, ISOTS:56, TCP:55, IPv4:54}
320 12:01:41 07.02.2014 6.9246243 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Disconnect Provider Ultimatum, rn-user-requested {T125:57, ISOTS:56, TCP:55, IPv4:54}
321 12:01:41 07.02.2014 6.9262103 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...F, SrcPort=3089, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=718134618, Ack=3282685779, Win=64802 (scale factor 0x0) = 64802 {TCP:55, IPv4:54}
322 12:01:41 07.02.2014 6.9262392 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=0, Seq=3282685779, Ack=718134619, Win=63739 (scale factor 0x0) = 63739 {TCP:55, IPv4:54}
323 12:01:41 07.02.2014 6.9262697 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A.R.., SrcPort=MS WBT Server(3389), DstPort=3089, PayloadLen=0, Seq=3282685779, Ack=718134619, Win=0 (scale factor 0x0) = 0 {TCP:55, IPv4:54}
418 12:01:45 07.02.2014 10.2688252 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=......S., SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179366, Ack=0, Win=65535 ( ) = 65535 {TCP:89, IPv4:54}
419 12:01:45 07.02.2014 10.2688901 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A..S., SrcPort=MS WBT Server(3389), DstPort=3091, PayloadLen=0, Seq=2627713606, Ack=2161179367, Win=8192 ( Scale factor not supported ) = 8192 {TCP:89, IPv4:54}
420 12:01:45 07.02.2014 10.3633983 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179367, Ack=2627713607, Win=65535 (scale factor 0x0) = 65535 {TCP:89, IPv4:54}
421 12:01:45 07.02.2014 10.3653072 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local X224 X224:Connection Request {ISOTS:90, TCP:89, IPv4:54}
422 12:01:45 07.02.2014 10.3653660 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 X224 X224:Connection Confirm {ISOTS:90, TCP:89, IPv4:54}
427 12:01:45 07.02.2014 10.4563214 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:MCSConnect Initial {T125:91, ISOTS:90, TCP:89, IPv4:54}
428 12:01:45 07.02.2014 10.4571708 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:MCSConnect Response {T125:91, ISOTS:90, TCP:89, IPv4:54}
430 12:01:45 07.02.2014 10.5478252 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179815, Ack=2627716498, Win=65535 (scale factor 0x0) = 65535 {TCP:89, IPv4:54}
431 12:01:45 07.02.2014 10.5478496 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:[Continuation to #428]Flags=...AP..., SrcPort=MS WBT Server(3389), DstPort=3091, PayloadLen=2087, Seq=2627716498 - 2627718585, Ack=2161179815, Win=64388 (scale factor 0x0) = 64388 {TCP:89, IPv4:54}
432 12:01:45 07.02.2014 10.6346796 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:[Dup Ack #430]Flags=...A...., SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179815, Ack=2627716498, Win=65535 (scale factor 0x0) = 65535 {TCP:89, IPv4:54}
433 12:01:45 07.02.2014 10.6360830 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179815, Ack=2627718585, Win=65535 (scale factor 0x0) = 65535 {TCP:89, IPv4:54}
435 12:01:45 07.02.2014 10.6377248 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Erect Domain Request, SubHeight = 0, SubInterval = 0 {T125:91, ISOTS:90, TCP:89, IPv4:54}
436 12:01:45 07.02.2014 10.6391956 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Attach User Request {T125:91, ISOTS:90, TCP:89, IPv4:54}
437 12:01:45 07.02.2014 10.6392205 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3091, PayloadLen=0, Seq=2627718585, Ack=2161179835, Win=64368 (scale factor 0x0) = 64368 {TCP:89, IPv4:54}
438 12:01:45 07.02.2014 10.6394789 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Attach User Confirm, Result = rt-successful, Indicator = 0x3ef {T125:91, ISOTS:90, TCP:89, IPv4:54}
439 12:01:45 07.02.2014 10.7248234 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ef {T125:91, ISOTS:90, TCP:89, IPv4:54}
440 12:01:45 07.02.2014 10.7248902 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1007, Result = rt-successful {T125:91, ISOTS:90, TCP:89, IPv4:54}
494 12:01:45 07.02.2014 10.8080983 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3eb {T125:91, ISOTS:90, TCP:89, IPv4:54}
495 12:01:45 07.02.2014 10.8081501 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1003, Result = rt-successful {T125:91, ISOTS:90, TCP:89, IPv4:54}
502 12:01:45 07.02.2014 10.9004815 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ec {T125:91, ISOTS:90, TCP:89, IPv4:54}
503 12:01:45 07.02.2014 10.9005553 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1004, Result = rt-successful {T125:91, ISOTS:90, TCP:89, IPv4:54}
505 12:01:45 07.02.2014 10.9896061 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ed {T125:91, ISOTS:90, TCP:89, IPv4:54}
506 12:01:45 07.02.2014 10.9896760 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1005, Result = rt-successful {T125:91, ISOTS:90, TCP:89, IPv4:54}
508 12:01:45 07.02.2014 11.0739957 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ee {T125:91, ISOTS:90, TCP:89, IPv4:54}
509 12:01:45 07.02.2014 11.0740591 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1006, Result = rt-successful {T125:91, ISOTS:90, TCP:89, IPv4:54}
510 12:01:46 07.02.2014 11.1598282 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Disconnect Provider Ultimatum, rn-user-requested {T125:91, ISOTS:90, TCP:89, IPv4:54}
511 12:01:46 07.02.2014 11.1616098 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...F, SrcPort=3091, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2161179904, Ack=2627718671, Win=65449 (scale factor 0x0) = 65449 {TCP:89, IPv4:54}
512 12:01:46 07.02.2014 11.1616299 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3091, PayloadLen=0, Seq=2627718671, Ack=2161179905, Win=64299 (scale factor 0x0) = 64299 {TCP:89, IPv4:54}
513 12:01:46 07.02.2014 11.1616748 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A.R.., SrcPort=MS WBT Server(3389), DstPort=3091, PayloadLen=0, Seq=2627718671, Ack=2161179905, Win=0 (scale factor 0x0) = 0 {TCP:89, IPv4:54}
541 12:01:48 07.02.2014 13.6502629 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=......S., SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726099966, Ack=0, Win=65535 ( ) = 65535 {TCP:92, IPv4:54}
542 12:01:48 07.02.2014 13.6503258 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A..S., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=0, Seq=3558313830, Ack=2726099967, Win=8192 ( Scale factor not supported ) = 8192 {TCP:92, IPv4:54}
544 12:01:48 07.02.2014 13.7327986 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726099967, Ack=3558313831, Win=65535 (scale factor 0x0) = 65535 {TCP:92, IPv4:54}
545 12:01:48 07.02.2014 13.7348858 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local X224 X224:Connection Request {ISOTS:93, TCP:92, IPv4:54}
546 12:01:48 07.02.2014 13.7356564 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=0, Seq=3558313831, Ack=2726100003, Win=64800 (scale factor 0x0) = 64800 {TCP:92, IPv4:54}
547 12:01:48 07.02.2014 13.7356884 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 X224 X224:Connection Confirm {ISOTS:93, TCP:92, IPv4:54}
549 12:01:48 07.02.2014 13.8294886 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:MCSConnect Initial {T125:94, ISOTS:93, TCP:92, IPv4:54}
550 12:01:48 07.02.2014 13.8300242 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:MCSConnect Response {T125:94, ISOTS:93, TCP:92, IPv4:54}
551 12:01:48 07.02.2014 13.9189291 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726100415, Ack=3558316722, Win=65535 (scale factor 0x0) = 65535 {TCP:92, IPv4:54}
552 12:01:48 07.02.2014 13.9189590 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:[Continuation to #550]Flags=...AP..., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=2087, Seq=3558316722 - 3558318809, Ack=2726100415, Win=64388 (scale factor 0x0) = 64388 {TCP:92, IPv4:54}
554 12:01:48 07.02.2014 14.0082588 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:[Dup Ack #551]Flags=...A...., SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726100415, Ack=3558316722, Win=65535 (scale factor 0x0) = 65535 {TCP:92, IPv4:54}
555 12:01:48 07.02.2014 14.0090432 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...., SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726100415, Ack=3558318809, Win=65535 (scale factor 0x0) = 65535 {TCP:92, IPv4:54}
556 12:01:48 07.02.2014 14.0113082 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Erect Domain Request, SubHeight = 0, SubInterval = 0 {T125:94, ISOTS:93, TCP:92, IPv4:54}
557 12:01:48 07.02.2014 14.0127702 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Attach User Request {T125:94, ISOTS:93, TCP:92, IPv4:54}
558 12:01:48 07.02.2014 14.0127973 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=0, Seq=3558318809, Ack=2726100435, Win=64368 (scale factor 0x0) = 64368 {TCP:92, IPv4:54}
559 12:01:48 07.02.2014 14.0128529 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Attach User Confirm, Result = rt-successful, Indicator = 0x3ef {T125:94, ISOTS:93, TCP:92, IPv4:54}
561 12:01:48 07.02.2014 14.1026981 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ef {T125:94, ISOTS:93, TCP:92, IPv4:54}
562 12:01:48 07.02.2014 14.1027544 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1007, Result = rt-successful {T125:94, ISOTS:93, TCP:92, IPv4:54}
563 12:01:49 07.02.2014 14.1878404 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3eb {T125:94, ISOTS:93, TCP:92, IPv4:54}
564 12:01:49 07.02.2014 14.1879134 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1003, Result = rt-successful {T125:94, ISOTS:93, TCP:92, IPv4:54}
566 12:01:49 07.02.2014 14.2725782 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ec {T125:94, ISOTS:93, TCP:92, IPv4:54}
567 12:01:49 07.02.2014 14.2726388 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1004, Result = rt-successful {T125:94, ISOTS:93, TCP:92, IPv4:54}
568 12:01:49 07.02.2014 14.3576375 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ed {T125:94, ISOTS:93, TCP:92, IPv4:54}
569 12:01:49 07.02.2014 14.3577135 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1005, Result = rt-successful {T125:94, ISOTS:93, TCP:92, IPv4:54}
576 12:01:49 07.02.2014 14.4416455 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Channel Join Request, UserID = 0x3ef,ChannelId = 0x3ee {T125:94, ISOTS:93, TCP:92, IPv4:54}
577 12:01:49 07.02.2014 14.4417102 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 T125 T125:Channel Join Confirm, ChannelId = 1006, Result = rt-successful {T125:94, ISOTS:93, TCP:92, IPv4:54}
580 12:01:49 07.02.2014 14.5274338 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local T125 T125:Disconnect Provider Ultimatum, rn-user-requested {T125:94, ISOTS:93, TCP:92, IPv4:54}
581 12:01:49 07.02.2014 14.5287851 svchost.exe 192.168.2.210 dts27srv101.altair-dv.local TCP TCP:Flags=...A...F, SrcPort=3093, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=2726100504, Ack=3558318895, Win=65449 (scale factor 0x0) = 65449 {TCP:92, IPv4:54}
582 12:01:49 07.02.2014 14.5288110 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A...., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=0, Seq=3558318895, Ack=2726100505, Win=64299 (scale factor 0x0) = 64299 {TCP:92, IPv4:54}
583 12:01:49 07.02.2014 14.5288706 svchost.exe dts27srv101.altair-dv.local 192.168.2.210 TCP TCP:Flags=...A.R.., SrcPort=MS WBT Server(3389), DstPort=3093, PayloadLen=0, Seq=3558318895, Ack=2726100505, Win=0 (scale factor 0x0) = 0 {TCP:92, IPv4:54}