Posts

TCP Handshake Process with Wireshark Packet Capture

Image
  The TCP (Transmission Control Protocol- connection oriented) handshake is a three-step process used to establish a connection between a client and a server in a TCP/IP network. Three- Way Handshake Process: SYN (Synchronize): The client initiates the connection with the server by sending SYN Packet SYN-ACK (Synchronize-Acknowledge):  The server responds with a ACK packet and sends it's own SYN packet to client ACK (Acknowledge): The client responds with ACK packet to server, resulting the connection is established Fig: TCP 3-way Handshake Process  Here I opened the browser and searched www.google.com, the respective TCP connection is highlighted here SYN Packet Analysis: Packet from Client to Server. Covering major fields to be checked here. Note: All the fields here related to Client Machine Fig: SYN packet analysis Destination port: Client requesting https (443) services from the server TCP Segment Length: Payload of the packet. In the all 3 -way handshake proces...

Unable to access the PaloAlto VM image via HTTPS

Image
Recently, I encountered an Issue of "Unable to access the PaloAlto VM image via HTTPS". Here's how I applied troubleshooting steps to resolve it: Configuration Changes done before: Configured static management IP & default gateway and rebooted the PA VM, then faced the issue. Observed: Unable to access the PaloAlto VM image via HTTPS. Unable to ping to the default Gateway from the PA and viceversa. Error- getting Destination Host Unreachable in both cases. Analyzed: + Checked the Management IP address and netmask, both are same as bridged network (physical) + Checked the default route "show routing route" - no route configured + While pinging from the base machine to PA and vice versa getting error as "Destination is Unreachable". Hypothesized: + As per the Error message, primarily issue is Network related, that the PA VM is unable to reach physical NIC IP. Tested: + Tried with changing the management IP address within the same subnet (as physic...

Download issue encountered on a particular website

  Today, I have successfully remedied the "Download issue encountered on a particular website." Observed: User can able to access the website without any issues, unable to download the file from the website. Multiple users in different locations are facing the same issue. Analysed: + As per the basic troubleshooting cleared the cache, close the browser then again tried to download the file, but still issue persists. + Checked the logs in Firewall and Web (Zscaler) side as well. No logs in firewall, Zscaler logs are allowed for the particular URL. + From the website owner everything is working fine with the same credentials and also can able to download while using outside of the organization network. Hypothesized: + As per the all analysis and effect on the multiple users, confirmed the issue might be resides in Proxy/Firewall or from the web server due to lack of proper permissions to access the file from organization network. Tested: + Checked the Test-NetConnection from th...

DHCP Troubleshooting Process

Image
DHCP Process DORA D- Discover --> A device sends broadcast message to find DHCP servers O- Offer --> DHCP server responds and offer IP addresses and further details to the device R- Request --> device selects IP address and send request to accept the offer A- Acknowledge --> The DHCP server acknowledges the IP address lease   Reconnaissance: Need to assess the issue facing according to the Network Topology & configuration, whether the issue facing by any Individual/Everyone/specific group pf People (People related to same VLAN/department)   Troubleshooting: If the issue is facing by all set of users + the issue is mostly resides in the DHCP server scope, start by checking the server up status and reachability and DHCP configuration. + check/confirm Relay-agent configuration that the correct IP address (server) configured on the correct interface as helper-address.     Lab Eg: (R1) ip helper-add...