Hi,
With Wireshark running on a PC with a firewall running (Comodo), will Wireshark capture packets of information before or after the firewall has had an effect?
Something very odd is happening on a machine intended to be use for H323 video conferences. I have run a trace using a in line network tap and found the following to be true.
Something strange is going on here. It not that the packets are blocked (I think), it's that the information in the call admission requests packet is different. With Comodo set to "Allow ALL", the PC will send an H225 request to the gatekeeper. Some data within the packet is regarding the destination of the call and one item set is called "dialedDigits" with its payload being the number dialled, e.g. "111". The gatekeeper then responds with a Accept admission and returns the ip address of the dialled number. A call can then be placed.
However, when Comodo set in custom mode, the request is still made but the this time the item set is "h323-ID" with the same payload, e.g. "111". However, this time the gatekeeper doesn't understand the request and rejects it. The calling PC then goes on to query DNS, that responds with some IP so a second request is made using the returned IP from DNS, which has no relevance to anything. The gatekeeper understands what an IP address is though and so says OK, and the call is then attempted to be set up with this random IP! Of course, it does not happen.
With me so far? I'm not sure if I am! I captured this information via sniffing the traffic both from the PC and the return using an inline tap. I will also run a Wireshark trace on the PC that has Comodo installed.
This is very repeatable, but I don't know what or why it is happening.
Chris
