SMB - Windows share over vlans
-
I am using packet capture in pfsense and then opening it with wireshark. Is there a good way to filter within packet capture so I can get rid of all the other traffic?
-
In order to get real time capture, you could use tcpdump directly in pfsense cli.
tcpdump -i INTERFACE tcp and port 445 and host HOST_IPWhere, interface is the interface name you want to sniff, ifconfig lists all the interfaces.
HOST_IP would be the client IP, if you filter by the server IP, you would get a lot of stuff too.The filter "tcp and port 445 and host HOST_IP" could be modified as you wish, you can use OR instead of AND too.
Second method is to wireshark directly to the pfsense, but that would require ssh keys.
In case you want this method, just let me know and I will paste here a procedure for you. -
@mcury said in SMB - Windows share over vlans:
tcpdump -i INTERFACE tcp and port 445 and host HOST_IP
I did a capture capture from the 10.0.0.0/24 network where the Win system resides. Here are my findings. First attempted to connect to the Windows machine and then did a ping to show I am able to reach it.
Followed with another attempt to connect to the share.
-
Good, as we can see, your server never replied the SYN request from the client.
Can you set the capture now in the interface that has the IP 10.0.0.1 ?
Let's confirm if your pfsense is sending this SYN to the server. -
The capture was from the em1_vlan10 interface where the 10.0.0.1 exists. Are you talking about running a capture on the 10.0.0.51 interface/ Windows machine?
-
Yes, run in the server, or in pfsense interface connected to the server.
I presume those 10 networks are /27, /28 /29 right?A /26 or less would give you routing issues due to network overlap.
-
No, they are all /24. 10.0.0.0/24..... Where the Windows host lives and 10.0.3.0/24, is where my Android is.
The images above are taken from a capture on the 10.0.0.1 interface
-
Well then your server never answered at all, he didn't send a RST he just ignored your connection attempt that pfsense sent.. Not a pfsense problem..
BTW - good idea to send the pings inbetween!! That is very helpful in showing you can talk to the IP... But as you can see from the sniff, the sync is sent - just no answer.
-
@johnpoz said in SMB - Windows share over vlans:
Well then your server never answered at all, he didn't send a RST he just ignored your connection attempt that pfsense sent.. Not a pfsense problem..
BTW - good idea to send the pings inbetween!! That is very helpful in showing you can talk to the IP... But as you can see from the sniff, the sync is sent - just no answer.
So if the firewall is off, as well as other services, Defender and whatnot...Any idea why the machine would ignore the connection attempt? It works fine if both devices are in the same subnet
-
Your firewall or security software is not off like you think is the answer..
The only other logical step here to prove that to yourself, is sniff on .51 - does it see that smb syn? But just not answer.. Then something on the server 100% positive!!
Normally windows would send back RST if not listening.. So that you just don't get anything back points to firewall/security software for sure.
-
I just double checked the firewall on the Win box... Firewall was back on again...Not sure how it turned itself on... But I had double checked earlier. Once I disabled it, I was able to connect. Just need to set a rule that allows SMB-in from private network.
thanks for the help
-
No problem... glad you got it sorted... But from a sniff its real quick to figure out where the problem is.
-
@mcury said in SMB - Windows share over vlans:
Yes, run in the server, or in pfsense interface connected to the server.
I presume those 10 networks are /27, /28 /29 right?A /26 or less would give you routing issues due to network overlap.
Just realized that the networks are different, my mistake, disregard the quoted info.
Nice, good that is now working.
Even better, now you have more tools to troubleshoot problems in the future.
