UDP broadcast worked for years, now messages are blocked by WinXP before firewall. Clues? - sockets

I developed (in VB6) a small app that send an UDP broadcast message (address 255.255.255.255) and then listen to the answer from the electronic devices we produce (this is to know the IP address of the devices for further messagging).
This was about 6-7 years ago, and all worked well till 1 month ago.
Now the UDP messages does not exit from my PC. With wireshark i can see the UDP messages sent from other PCs, and the answers from the connected devices, but not the messages i send from my PC.
Also, i use Comodo firewall, and even it can't see the message coming out (i deleted the related rules to let Comodo ask permission for my program, but the request pops out only when it sends TCP messages). Even didabling Comodo did not solve the problem.
WinXP firewall is disabled and untouched from years.
So my guess is that a recent Windows update changed something.... but what should i look?
What's blocking UDP calls BEFORE it reaches Comodo Firewall, or how to discover it?
I have no antivirus, and just in case i disinstalled Windows Live Protection ... so really i don't know what to look. I'm an experieced Windows programmer but my API knowledge is mostly about graphics, and i'm not a network expert either (we work with microprocessor, and use TCP/UDP sockets for basic communication).
Thanks

Well, reinstalled VB6 (sigh) and discovered that, as usual, when the problems are inesplicable the cause is often a trivial mistake.
The UDP socked was using a predefined port, and now that port is already in use. The error trapping was hiding the generated error, so i did'nt know it.
Changed the local port to 0 allows the system to pick one random port, which is fine for my purposes.

Related

What's wrong with my VoIP setup on Edgerouter X (Telekom Germany)

I'm from germany and my provider is Deutsche Telekom. I'm using ubiquiti edgerouter x with an pppoe connection to Telekom. Internet works well but I can't get VoIP working. My Phone is a Siemens Gigaset C430A GO. Only configuration I did there is following the wizard, entering my phone number and selecting predefined Telekom settings. Those settings should be correct according to Telekom support.
On the edgerouter I've whitelisted and forwarded almost every port to my phone (10.1.0.4).
Please have a look on the tcpdump I took while doing a call from my mobile to my configured landline: https://justpaste.it/4i8n9
The issue is that it is ringing, I pick up, but can't hear anything. After 10 seconds the connection gets closed. In the opposite direction I also can't hear anything but the connection stays open. But: When I hang up on one side, the other side get's notified.
I find this very weird. It does not really look like a problem of a closed port or something else with the firewall. Unfortunately I have no experience with SIP so far so from the log I can't really tell if everything is correct there.
I've change the phone numbers in the log.
111122223333 is the landline I was calling.
444455556666 is my mobile number I was calling from.
777788889999 is also in the log which is another configured landline. I have no idea why this is in the log.
100.200.100.200 is my external IP.
10.1.0.4 is my internal IP for the phone.
Does anybody have an idea what could be wrong?
You should check your router's NAT or ALG settings as well as the STUN settings of the phone.
Here is the rationale behind it: the capture you posted shows the remote party expecting media on port 33880 whereas your phone expects it on port 5012. The issue is that while your phone successfully sends out its audio, it is not receiving any in return. Moreover, about a second into the call, your phone is sending a reinvite, this time using its local IP address rather than a publicly routable address:
...
o=- 5012 14 IN IP4 10.1.0.4
s=Mapping
c=IN IP4 10.1.0.4
...
The reinvite is rejected by the other party on the account of the SDP being bogus (rightfully so), and during the course of the capture, this series of events repeats several times.
If your router supports ALG and it is enabled, you should attempt reversing this setting as it effectively tampers with the SIP flow through your router; its purpose has been obsoleted by NAT and these days it does more damage than help;
If your router's NAT settings mandate symmetric NAT, disable it; it's behaviour is consistent with the issue you described (though there can be other reasons for it);
Check your phone's STUN setting (page 106 of the user manual) and enable it; STUN works great behind NAT when it comes down to traversing your local network by informing the remote party on sending its audio to an working port.
Hey thanks for the information. I figured out that the edgerouter indeed has an SIP ALG. I've deactivated that one. Then I've changed the standard SIP and RTP ports to something custom just to make sure nothing is trying to do some SIP magic still. It still didn't work until I tried disabling STUN. Now it works. But why not. I'm forwarding now only the ports that are really needed and my phone don't need to do STUN for no reason. Firewall rules allow packages from the Telekom SIP range to my phone. Everything is fine now.

Message Computer Over IP/Port

I'm having some trouble with this, and have a hard time explaining the problem in words, but I will do the best I can.
I would like to send a simple message to a computer from a different computer. Nothing fancy. I have done some research, and a lot of sources say to create a script that accesses the built-in MSG.EXE function in Windows (I am currently on Windows 10) however, this only seems to work on machines connected to LAN.
From what I have gathered, I would need to create a website that handles the requests: get message from Computer A and send it to Computer B. Could I do this (In Powershell or VBS) without having to make a site specifically for it?
What I want:
I want Computer A to send a plain-text message to Computer B. Preferably, when the message is successfully sent a message box will appear that says "From: (whomever) and the message. Using MSG.EXE did what I wanted it to do, however it only worked with LAN-connected devices. Could I make this work with static IP? If so, how?
Additional Information:
The two computers are not on a LAN, but are connected to the Internet.
Computer A (the sender) and Computer B (the receiver) each have a static IP address, however that can obviously change.
Ports are available in each computer.
I have a Raspberry Pi that could act as a server "middle man" should that be required.
To be very clear: There are a lot of posts that talk about sending messages over LAN. I am NOT trying to send a message over LAN. Any help would be appreciated.
You're being quite vague in why you want it and what you want it to do; the main problem is that home internet connections are built for things to connect out, and nothing to connect in.
Fixes:
Port forwarding where you say "incoming connections go to this or that computer.
Building a service where both sides "connect out", i.e. you have a website hosted somewhere out on the internet. One computer connects out to send the message, the other connects out to check for messages.
Outside that, the next problem is knowing where on the internet to connect to.
Fixes:
Hard code the end points. Static IPs are good for this because the definition of a static IP is that it's an address which doesn't change. Mysteriously, you have static IPs which can change and you consider that 'obvious'. (??)
DNS where you register a domain, and the computers look at a domain name for where to connect. You update DNS with the current IP.
DNS where you use a free DNS service on someone else's name and your service listener updates that as its IP changes.
And after that, most people's computers/laptops/phones are switched off or in low power sleep mode most of the time, and their internet connections are comparatively unreliable, so any random message probably won't be answered.
Fixes:
Use a serious website service
Run an always-on computer to be that service
Deal with it being offline and messages being flakey
Use a store-and-forward system like email, which queues and retries, like e-mail and instant messengers do
get message from Computer A and send it to Computer B. Could I do this (In Powershell or VBS) without having to make a site specifically for it?
Yes. Quick answer: pick a port, configure site B's modem/router to forward the port to computer B. Open the port on computer B's firewall. Write some kind of TCP socket listener on Computer B, and the sender on Computer A, connecting to the public IP address of site B.
Long answer: then enjoy writing your own messaging protocol, error handling, message authentication, etc.
Alternative: do the same but going to your rPi. Have it listening. Not in powershell (sadly) or vbscript (luckily), and have it serve the messages up by HTTP/JSON, both computers invoke-webrequest or invoke-restmethod and post/get them with regular polling.

How does the OS resolve which NIC to send/receive on?

My PC has two gigabit ethernet connections (NICs) - one on the motherboard, and one on a plugin card. I've never used multiple NICs before, and I'm simply not clear on how the OS resolves which NIC to use, and at what stage it occurs. Chance are "you don't have to know" because it happens automatically... but I'd still like to know - does it happen when you call the bind() function, for example, or later during a send or receive? Is it precisely the same process prior to both send and receive? Is it the same for TCP, UDP or any other protocol? Is it different between Windows and UNIX/Linux or Mac systems?
I'm motivated to ask because I have some Winsock2 code that "was working fine", but which stopped working when I reversed the order of the send and receive on a single socket. I discovered that it only received when there was at least one packet sent first.
I'm 99% sure there will be a bug somewhere, but I'd like to be 100% sure in the unlikely case that this is a "feature", or a bug beyond my code... because the symptoms are consistent with the possibility that the receive functionality is working fine, but somehow waiting to receive on the wrong NIC.
It consults the IP routing tables to find the cheapest route, whuch determines the outbound NIC. This happens when you connect(). In UDP if you don't connect, as you usually don't, it happens on send().

UDP packet loss at the OS level: Windows and Linux, but only with many clients running

I've been investigating an issue where we have a single UDP server sending to multiple clients. The server is sending data out on a multicast channel and port. The clients are running on the same machine and each client opens a socket to the same port as every other client.
We stagger the start of the clients. When we reach a certain number of clients, say 10, we start seeing packet drops. We've eliminated the NIC as the issue using various monitoring tools and the socket buffer size is several times larger than the message size. Our sending interval is quite large (five seconds) and the clients do nothing with the data so the rate of consumption is a non-factor. As the title says we've reproduced the issue on both Windows Server 2008 and Linux (not sure about the version).
Our current theory is that the 10th client puts too much load on the OS which is copying all this data to each socket. The thing is we're only sending 500,000 bytes every five seconds, which doesn't seem like much at all.
Mostly I'm posting here in the hopes that someone has seen a similar problem. I was pointed to this hotfix in my search but it did not solve the issue. Any resources for investigating the details of the OS internals which handle network traffic would be appreciated. Unfortunately I lack this kind of domain knowledge and it has been difficult to find good and detailed reading material on the subject.

ARP Requests on iPhone

I'm trying to generate ARP (Address Resolution Protocol) request packets on the iPhone and listen for the associated responses that come back.
Google searches have led me into a dead-end. In order to send logical-layer packets, I'd need something along the lines of a raw socket, but need super-user permissions to create them. I'm trying to avoid jailbreaking my phone.
There's lots of c code out there that can do this, but I can't find anything that can translate to iOS due to the permissions.
I was ready to throw in the towel when I decided to Wireshark a couple network discovery apps I have. Namely "Fing" and "Pinggy" (hats off to Fing and Pinggy btw... awesome apps!)
https://itunes.apple.com/us/app/pinggy/id562201096?mt=8
https://itunes.apple.com/us/app/fing-network-scanner/id430921107?mt=8
Running Wireshark alongside these iPhone apps shows that they do an ARP scan from XXX.XXX.X.0 all the way to XXX.XXX.X.255. I do not see any ICMP packets go out simultaneously with the "ARPs". This leads me to believe that sending and receiving ARP packets are indeed possible on iOS.
I've thought about a ping sweep, assuming that it will generate ARP requests on its own. However, I will still need a raw socket to listen to the responses, correct?
Questions: What's available for sending/receiving packets at the logical layer? Specifically for sending receiving ARP packets? Am I missing anything fundamental?
Thanks in advance!
ARP requests do go out when I attempted to ping the problematic devices. This was seen with a Wireshark session running alongside the ping scanner. I found that I could not reproduce the "missing devices" I was seeing earlier that led me to ask my original question.
So, to answer my own question: ARP requests are sent per IP address when doing a simple ping scan on my subnet. I would see the ARP request go out (using Wireshark) as well as the ping request. If you need to generate an ARP request, simply send out a ping.
Even if the "problematic" device won't respond to ping requests, the ARP table will be notified of its existence.
You can't do what you want to do, and get the app in the AppStore,
since what you are trying to do isn't in the public API.
So one thing you could do, for testing purposes on your own network, or enterprise distributed apps is looking in the private/undocumented APIs.
One such list is maintained at https://github.com/nst/iOS-Runtime-Headers, but I can't vouch for its accuracy.
Good luck!