62 lines
1.5 KiB
Markdown
62 lines
1.5 KiB
Markdown
# UDP会话中客户端和服务端识别错误
|
||
|
||
| ID | Creation Date | Assignee | Status |
|
||
|----|----------------|----------|--------|
|
||
| OMPUB-1477 | 2024-09-20T14:15:02.000+0800 | 郑超 | 开放 |
|
||
|
||
|
||
---
|
||
|
||
UDP会话中客户端和服务端识别错误
|
||
|
||
1、在提取QuarkVPN特征时候发现，VPN使用UDP协议的时候，服务器常用口端口为59001/59002/60000，数值比客户端随机分配的端口大
|
||
|
||
2、测试系统：工程部测试环境
|
||
|
||
CM：192.168.44.228
|
||
|
||
OLAP：192.168.44.229
|
||
|
||
TSG-OS：192.168.40.84
|
||
|
||
客户端IP地址：192.168.54.220
|
||
|
||
3、三个session均为连接VPN节点后，下载了一个2MB左右的文件，然后断开连接，保存的数据包
|
||
|
||
4、Session_Record、数据包见附件
|
||
|
||
!image-2024-09-20-14-17-27-026.png|width=1082,height=485!
|
||
|
||
# Attachments
|
||
|
||
Attachment: image-2024-09-20-14-17-27-026.png
|
||
|
||
|
||
|
||
|
||
|
||
Attachment: session_record.csv
|
||
|
||
[session_record.csv](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/63193/session_record.csv)
|
||
|
||
|
||
|
||
Attachment: udp01.pcap
|
||
|
||
[udp01.pcap](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/63192/udp01.pcap)
|
||
|
||
|
||
|
||
Attachment: udp02.pcap
|
||
|
||
[udp02.pcap](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/63191/udp02.pcap)
|
||
|
||
|
||
|
||
Attachment: udp03.pcap
|
||
|
||
[udp03.pcap](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/63190/udp03.pcap)
|
||
|
||
|
||
|