Newsgroup: it.comp.os.linux.sys
Titolo: iptables owa

Salve a tutti, ho configurato un semplice firewall iptables che mi pubblica 
il mio server owa,
ma da più parti sto verificando che se l'utente che contatta owa si trova 
dietro un proxy, la richiesta di password e nome utente e infinita, morale 
della favola non si autentica e non puo leggere la posta.
#SVUOTAMENTO DELLE REGOLE IMPOSTATE DAL SISTEMA IN FASE DI AVVIO
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
#CATENA DI DEFAULT PER LE REGOLE CHE NON TROVANO RISCONTRO
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
#ABILITIAMO IL PASSAGGIO DEI PACCHETTI DA UNA SCHEDA DI RETE ALL'ALTRA
echo 1 > /proc/sys/net/ipv4/ip_forward
#webacces
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j 
DNAT --to-destination 
192.168.1.5:80
grazie!

 della favola non si autentica e non puo leggere la posta.
Il firewall non c'entra una banana, a meno che non fa pastrugne davvero
strane, che ad iptables bisogna mettercisi d'impegno per implementare...
Sicuro, ad esempio, che chi ti contatta non stia dietro ad un PIX
("fixup protocol http")?
-- 
Skull & Bones (ER6n Silver)
Neo:  I know Sendmail!
Morpheus:  Show me.

 ("fixup protocol http")?
ciao grazie,
e per quale motivo se l'utente sta dietro un PIX non dovrebbe funzionare?
ti posso assicurare che dietro un proxy non funziona, e poi lo stesso utente 
legge la posta di un'altra aziende sempre su owa.
cosa strana molto molto strana.
ciao

 iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
E questa che c'entra con OWA?
-- 
Words are very unnecessary
They can only do harm

 cosa strana molto molto strana.
Si, anche perchè ho un sacco di gente che legge posta via OWA attraverso
proxy, senza alcuna difficoltà, per quanto ne so.
Se poi sia stato fatto qualcosa di particolare su quegli OWA non saprei,
ma non mi risulta...


 della favola non si autentica e non puo leggere la posta.
Semmai il problema sarà dalla parte dove c'è il proxy che non è 
configurato correttamente, e non passa correttamente ad OWA nome utente 
e password che tu digiti sul browser.
Io ho notato una roba simile utilizzando Internet Explorer + server 
proxy all'interno di un dominio che non ha niente a che vedere con il 
dominio mio in azienda su cui è appoggiato il mio OWA, praticamente 
Explorer tenta di mandare ad OWA remoto le credenziali locali 
dell'utente attualmente loggato nel dominio.
Ho risolto utilizzando Firefox per accedere ad OWA, ovviamente con le 
limitazioni del caso rispetto a explorer


questa particolarità è accaduta di recente in un'altra occasione, 
utilizzando firefox tutto inizio  afunzionare, ed l'utente riusciva a 
leggere la posta via owa.
ma in questo caso pur utilizzando firefox,e prima ancora ie6/ie7, non riesce 
a leggere la posta via owa, il sistema gli chiede continuamente le 
credenziali.
La cosa strana che continuo a ripetere, e che tanti altri utenti riescono ad 
accedere ad owa, e che gli stessi utenti che hanno problemi accedono ad un 
altro server exchange via owa.

 
Può essere che alcuni server OWA sono configurati solo su http, mentre 
altri solo su https?
Allora la faccenda potrebbe cambiare

 altro server exchange via owa.
L'"enigma", probabilmente, si risolverebbe velocemente dando un'occhiata
al traffico scambiato. Vai sul firewall, attiva il fido tcpdump (o altro
a tuo piacimento), cattura e posta risultati ed eventuali commenti e poi 
vediamo, perche' senza informazioni un po' piu' precise e' difficile dir
di piu'.
Fabio

 Allora la faccenda potrebbe cambiare
si vero, il mio owa č configurato in http, forse gi altri in https, ma non 
creo.
comunque non riesco a capire perche la questione potrebbe essere diversa, mi 
illumineresti?
grazie!

 wrote in message 
news:MPG.204e95588fd7dc46989cf8@localhost...

Ciao fabio, a dire il vero non ho mai usato tcpdump, ma ho letto varie 
recenzione è so a cosa serve.
adesso mi leggo qualche doc, in attesa di capire quale comando lanciare, tu 
mipotresti dare qualche info?
ciao

 wrote in message 
news:gvwFh.9996$zG1.1...@twister2.libero.it...

Ciao Fabio, questo il comando che lancero dal mio firewall per monitorare 
tutte le connessioni provenienti dal proxy del mio utente che tenta di 
leggere la posta, sulla porta 80,
tcpdump host "ip sorgente" and port 80 -l | tee sniff.log
grazie!


Questo il log del comando tcpdump host 151.0.0.1 -l | tee traffic.log 
151.0.0.1 ip inventato del richiedente, FwOwa NomeHost Firewall Iptables che 
pubblica Owa.
10:43:47.061831 IP 151.0.0.1.12290 > FwOwa.http: S 749075681:749075681(0) 
win 65535 <mss 1460,nop,nop,sackOK>
10:43:47.062007 IP FwOwa.http > 151.0.0.1.12290: S 360563853:360563853(0) 
ack 749075682 win 16384 <mss 1460,nop,nop,sackOK>
10:43:47.110725 IP 151.0.0.1.12290 > FwOwa.http: . ack 1 win 65535
10:43:47.115860 IP 151.0.0.1.12290 > FwOwa.http: P 1:251(250) ack 1 win 
65535
10:43:47.121046 IP FwOwa.http > 151.0.0.1.12290: P 1:349(348) ack 251 win 
65285
10:43:47.354604 IP 151.0.0.1.12290 > FwOwa.http: . ack 349 win 65187
10:43:53.464191 IP 151.0.0.1.12290 > FwOwa.http: P 251:584(333) ack 349 win 
65187
10:43:53.465255 IP FwOwa.http > 151.0.0.1.12290: P 349:887(538) ack 584 win 
64952
10:43:53.503547 IP 151.0.0.1.12518 > FwOwa.http: S 3099248760:3099248760(0) 
win 65535 <mss 1460,nop,nop,sackOK>
10:43:53.503774 IP FwOwa.http > 151.0.0.1.12518: S 269236662:269236662(0) 
ack 
3099248761
 win 16384 <mss 1460,nop,nop,sackOK>
10:43:53.525480 IP 151.0.0.1.12518 > FwOwa.http: . ack 1 win 65535
10:43:53.533785 IP 151.0.0.1.12518 > FwOwa.http: P 1:518(517) ack 1 win 
65535
10:43:53.536011 IP FwOwa.http > 151.0.0.1.12518: P 1:349(348) ack 518 win 
65018
10:43:53.698427 IP 151.0.0.1.12518 > FwOwa.http: . ack 349 win 65187
10:43:53.699660 IP 151.0.0.1.12290 > FwOwa.http: . ack 887 win 65535
10:44:03.840693 IP 151.0.0.1.12290 > FwOwa.http: P 584:917(333) ack 887 win 
65535
10:44:03.841766 IP FwOwa.http > 151.0.0.1.12290: P 887:1425(538) ack 917 win 
64619
10:44:03.940867 IP 151.0.0.1.12518 > FwOwa.http: P 518:1035(517) ack 349 win 
65187
10:44:03.941902 IP FwOwa.http > 151.0.0.1.12518: P 349:697(348) ack 1035 win 
64501
10:44:04.087775 IP 151.0.0.1.12290 > FwOwa.http: . ack 1425 win 65535
10:44:04.197652 IP 151.0.0.1.12518 > FwOwa.http: . ack 697 win 65535
10:44:04.480284 IP 151.0.0.1.12290 > FwOwa.http: P 917:1250(333) ack 1425 
win 65535
10:44:04.481307 IP FwOwa.http > 151.0.0.1.12290: P 1425:1963(538) ack 1250 
win 64286
10:44:04.584406 IP 151.0.0.1.12518 > FwOwa.http: P 1035:1552(517) ack 697 
win 65535
10:44:04.585469 IP FwOwa.http > 151.0.0.1.12518: P 697:1045(348) ack 1552 
win 65535
10:44:04.746302 IP 151.0.0.1.12290 > FwOwa.http: . ack 1963 win 65535
10:44:04.856677 IP 151.0.0.1.12518 > FwOwa.http: . ack 1045 win 65187
10:44:15.700515 IP 151.0.0.1.12290 > FwOwa.http: P 1250:1661(411) ack 1963 
win 65535
10:44:15.701264 IP FwOwa.http > 151.0.0.1.12290: P 1963:2311(348) ack 1661 
win 65535
10:44:15.744342 IP 151.0.0.1.12518 > FwOwa.http: P 1552:2046(494) ack 1045 
win 65187
10:44:15.745666 IP FwOwa.http > 151.0.0.1.12518: P 1045:1583(538) ack 2046 
win 65041
10:44:15.789746 IP 151.0.0.1.12290 > FwOwa.http: . 1661:2197(536) ack 2311 
win 65187
10:44:15.793203 IP 151.0.0.1.12290 > FwOwa.http: P 2197:2339(142) ack 2311 
win 65187
10:44:15.794311 IP FwOwa.http > 151.0.0.1.12290: . ack 2339 win 64857
10:44:15.795013 IP FwOwa.http > 151.0.0.1.12290: P 2311:2659(348) ack 2339 
win 64857
10:44:15.900145 IP 151.0.0.1.12518 > FwOwa.http: . ack 1583 win 65535
10:44:15.901379 IP 151.0.0.1.12290 > FwOwa.http: . ack 2659 win 65535
10:44:16.349656 IP 151.0.0.1.12518 > FwOwa.http: P 2046:2540(494) ack 1583 
win 65535
10:44:16.350786 IP FwOwa.http > 151.0.0.1.12518: P 1583:2121(538) ack 2540 
win 64547
10:44:16.394136 IP 151.0.0.1.12290 > FwOwa.http: . 2339:2875(536) ack 2659 
win 65535
10:44:16.396924 IP 151.0.0.1.12290 > FwOwa.http: P 2875:3017(142) ack 2659 
win 65535
10:44:16.398366 IP FwOwa.http > 151.0.0.1.12290: . ack 3017 win 64179
10:44:16.399119 IP FwOwa.http > 151.0.0.1.12290: P 2659:3007(348) ack 3017 
win 64179
10:44:16.555714 IP 151.0.0.1.12518 > FwOwa.http: . ack 2121 win 65535
10:44:16.557190 IP 151.0.0.1.12290 > FwOwa.http: . ack 3007 win 65187
10:44:16.845592 IP 151.0.0.1.12518 > FwOwa.http: P 2540:3034(494) ack 2121 
win 65535
10:44:16.847495 IP FwOwa.http > 151.0.0.1.12518: P 2121:2659(538) ack 3034 
win 65535
10:44:16.894250 IP 151.0.0.1.12290 > FwOwa.http: . 3017:3553(536) ack 3007 
win 65187
10:44:16.897041 IP 151.0.0.1.12290 > FwOwa.http: P 3553:3695(142) ack 3007 
win 65187
10:44:16.898027 IP FwOwa.http > 151.0.0.1.12290: . ack 3695 win 65535
10:44:16.902108 IP FwOwa.http > 151.0.0.1.12290: P 3007:3355(348) ack 3695 
win 65535
10:44:16.993107 IP 151.0.0.1.12518 > FwOwa.http: . ack 2659 win 65535
10:44:17.103231 IP 151.0.0.1.12290 > FwOwa.http: . ack 3355 win 65535
10:44:17.326240 IP 151.0.0.1.12518 > FwOwa.http: P 3034:3528(494) ack 2659 
win 65535
10:44:17.328943 IP FwOwa.http > 151.0.0.1.12518: P 2659:3197(538) ack 3528 
win 65041
10:44:17.372348 IP 151.0.0.1.12290 > FwOwa.http: . 3695:4231(536) ack 3355 
win 65535
10:44:17.375479 IP 151.0.0.1.12290 > FwOwa.http: P 4231:4373(142) ack 3355 
win 65535
10:44:17.375725 IP FwOwa.http > 151.0.0.1.12290: . ack 4373 win 64857
10:44:17.376492 IP FwOwa.http > 151.0.0.1.12290: P 3355:3703(348) ack 4373 
win 64857
10:44:17.447384 IP 151.0.0.1.12518 > FwOwa.http: P 3528:3939(411) ack 3197 
win 65535
10:44:17.448359 IP FwOwa.http > 151.0.0.1.12518: P 3197:3545(348) ack 3939 
win 64630
10:44:17.491057 IP 151.0.0.1.12290 > FwOwa.http: P 4373:4867(494) ack 3703 
win 65187
10:44:17.492032 IP FwOwa.http > 151.0.0.1.12290: P 3703:4241(538) ack 4867 
win 64363
10:44:17.534700 IP 151.0.0.1.12518 > FwOwa.http: . 3939:4475(536) ack 3545 
win 65187
10:44:17.537830 IP 151.0.0.1.12518 > FwOwa.http: P 4475:4617(142) ack 3545 
win 65187
10:44:17.539507 IP FwOwa.http > 151.0.0.1.12518: . ack 4617 win 65535
10:44:17.540256 IP FwOwa.http > 151.0.0.1.12518: P 3545:3893(348) ack 4617 
win 65535
10:44:17.649073 IP 151.0.0.1.12290 > FwOwa.http: . ack 4241 win 65535
10:44:17.758211 IP 151.0.0.1.12518 > FwOwa.http: . ack 3893 win 65535
10:44:17.985024 IP 151.0.0.1.12290 > FwOwa.http: P 4867:5361(494) ack 4241 
win 65535
10:44:17.986227 IP FwOwa.http > 151.0.0.1.12290: P 4241:4779(538) ack 5361 
win 65535
10:44:18.029642 IP 151.0.0.1.12518 > FwOwa.http: . 4617:5153(536) ack 3893 
win 65535
10:44:18.033266 IP 151.0.0.1.12518 > FwOwa.http: P 5153:5295(142) ack 3893 
win 65535
10:44:18.033485 IP FwOwa.http > 151.0.0.1.12518: . ack 5295 win 64857
10:44:18.034218 IP FwOwa.http > 151.0.0.1.12518: P 3893:4241(348) ack 5295 
win 64857
10:44:18.066168 IP 151.0.0.1.12518 > FwOwa.http: F 5295:5295(0) ack 4241 win 
65187
10:44:18.066331 IP FwOwa.http > 151.0.0.1.12518: . ack 5296 win 64857
10:44:18.066363 IP FwOwa.http > 151.0.0.1.12518: F 4241:4241(0) ack 5296 win 
64857
10:44:18.073397 IP 151.0.0.1.12290 > FwOwa.http: P 5361:5772(411) ack 4779 
win 65535
10:44:18.074119 IP FwOwa.http > 151.0.0.1.12290: P 4779:5127(348) ack 5772 
win 65124
10:44:18.091581 IP 151.0.0.1.12518 > FwOwa.http: . ack 4242 win 65187
10:44:18.117070 IP 151.0.0.1.12290 > FwOwa.http: P 5772:6266(494) ack 5127 
win 65187
10:44:18.117966 IP FwOwa.http > 151.0.0.1.12290: P 5127:5665(538) ack 6266 
win 64630
10:44:18.167373 IP 151.0.0.1.12290 > FwOwa.http: . 6266:6802(536) ack 5665 
win 65535
10:44:18.170246 IP 151.0.0.1.12290 > FwOwa.http: P 6802:6944(142) ack 5665 
win 65535
10:44:18.170538 IP FwOwa.http > 151.0.0.1.12290: . ack 6944 win 65535
10:44:18.270444 IP FwOwa.http > 151.0.0.1.12290: P 5665:6030(365) ack 6944 
win 65535
10:44:18.309203 IP 151.0.0.1.12290 > FwOwa.http: P 6944:7356(412) ack 6030 
win 65170
10:44:18.310045 IP FwOwa.http > 151.0.0.1.12290: P 6030:6378(348) ack 7356 
win 65123
10:44:18.355551 IP 151.0.0.1.12290 > FwOwa.http: P 7356:7851(495) ack 6378 
win 65535
10:44:18.356428 IP FwOwa.http > 151.0.0.1.12290: P 6378:6916(538) ack 7851 
win 64628
10:44:18.437127 IP 151.0.0.1.12290 > FwOwa.http: . 7851:8387(536) ack 6916 
win 65535
10:44:18.440014 IP 151.0.0.1.12290 > FwOwa.http: P 8387:8530(143) ack 6916 
win 65535
10:44:18.440370 IP FwOwa.http > 151.0.0.1.12290: . ack 8530 win 65535
10:44:18.592914 IP FwOwa.http > 151.0.0.1.12290: P 6916:7202(286) ack 8530 
win 65535
10:44:18.593142 IP FwOwa.http > 151.0.0.1.12290: P 7202:8403(1201) ack 8530 
win 65535
10:44:18.668521 IP 151.0.0.1.12290 > FwOwa.http: . ack 8403 win 65535
10:44:18.710134 IP 151.0.0.1.12290 > FwOwa.http: . 8530:9066(536) ack 8403 
win 65535
10:44:18.711641 IP 151.0.0.1.12290 > FwOwa.http: P 9066:9070(4) ack 8403 win 
65535
10:44:18.712163 IP FwOwa.http > 151.0.0.1.12290: . ack 9070 win 64995
10:44:18.713313 IP FwOwa.http > 151.0.0.1.12290: P 8403:8751(348) ack 9070 
win 64995
10:44:18.757154 IP 151.0.0.1.12290 > FwOwa.http: . 9070:9606(536) ack 8751 
win 65187
10:44:18.758761 IP 151.0.0.1.12290 > FwOwa.http: P 9606:9693(87) ack 8751 
win 65187
10:44:18.758940 IP FwOwa.http > 151.0.0.1.12290: . ack 9693 win 64372
10:44:18.759616 IP FwOwa.http > 151.0.0.1.12290: P 8751:9289(538) ack 9693 
win 64372
10:44:18.760208 IP 151.0.0.1.13384 > FwOwa.http: S 1899777786:1899777786(0) 
win 65535 <mss 1460,nop,nop,sackOK>
10:44:18.760391 IP FwOwa.http > 151.0.0.1.13384: S 3834386346:3834386346(0) 
ack 1899777787 win 16384 <mss 1460,nop,nop,sackOK>
10:44:18.794947 IP 151.0.0.1.13384 > FwOwa.http: . ack 1 win 65535
10:44:18.804950 IP 151.0.0.1.13384 > FwOwa.http: . 1:537(536) ack 1 win 
65535
10:44:18.805754 IP 151.0.0.1.13384 > FwOwa.http: P 537:549(12) ack 1 win 
65535
10:44:18.806182 IP FwOwa.http > 151.0.0.1.13384: . ack 549 win 64987
10:44:18.806656 IP FwOwa.http > 151.0.0.1.13384: P 1:349(348) ack 549 win 
64987
10:44:18.814560 IP 151.0.0.1.12290 > FwOwa.http: . 9693:10229(536) ack 9289 
win 65535
10:44:18.819270 IP 151.0.0.1.12290 > FwOwa.http: P 10229:10500(271) ack 9289 
win 65535
10:44:18.819488 IP FwOwa.http > 151.0.0.1.12290: . ack 10500 win 65535
10:44:18.842452 IP FwOwa.http > 151.0.0.1.12290: P 9289:9493(204) ack 10500 
win 65535
10:44:18.842859 IP FwOwa.http > 151.0.0.1.12290: . 9493:10953(1460) ack 
10500 win 65535
10:44:18.842972 IP FwOwa.http > 151.0.0.1.12290: . 10953:12413(1460) ack 
10500 win 65535
10:44:18.843099 IP FwOwa.http > 151.0.0.1.12290: . 12413:13873(1460) ack 
10500 win 65535
10:44:18.843240 IP FwOwa.http > 151.0.0.1.12290: . 13873:15333(1460) ack 
10500 win 65535
10:44:18.843344 IP FwOwa.http > 151.0.0.1.12290: . 15333:16793(1460) ack 
10500 win 65535
10:44:18.843465 IP FwOwa.http > 151.0.0.1.12290: . 16793:18253(1460) ack 
10500 win 65535
10:44:18.843595 IP FwOwa.http > 151.0.0.1.12290: . 18253:19713(1460) ack 
10500 win 65535
10:44:18.843723 IP FwOwa.http > 151.0.0.1.12290: . 19713:21173(1460) ack 
10500 win 65535
10:44:18.843841 IP FwOwa.http > 151.0.0.1.12290: . 21173:22633(1460) ack 
10500 win 65535
10:44:18.843957 IP FwOwa.http > 151.0.0.1.12290: . 22633:24093(1460) ack 
10500 win 65535
10:44:18.844089 IP FwOwa.http > 151.0.0.1.12290: . 24093:25553(1460) ack 
10500 win 65535
10:44:18.844210 IP FwOwa.http > 151.0.0.1.12290: . 25553:27013(1460) ack 
10500 win 65535
10:44:18.844336 IP FwOwa.http > 151.0.0.1.12290: . 27013:28473(1460) ack 
10500 win 65535
10:44:18.844416 IP FwOwa.http > 151.0.0.1.12290: P 28473:29459(986) ack 
10500 win 65535
10:44:18.876891 IP 151.0.0.1.13384 > FwOwa.http: . 549:1085(536) ack 349 win 
65187
10:44:18.879275 IP 151.0.0.1.13384 > FwOwa.http: P 1085:1180(95) ack 349 win 
65187
10:44:18.879525 IP FwOwa.http > 151.0.0.1.13384: . ack 1180 win 64356
10:44:18.881813 IP FwOwa.http > 151.0.0.1.13384: P 349:887(538) ack 1180 win 
64356
10:44:18.887292 IP 151.0.0.1.12290 > FwOwa.http: . ack 10953 win 65535
10:44:18.929428 IP 151.0.0.1.12290 > FwOwa.http: . ack 13873 win 65535
10:44:18.972823 IP 151.0.0.1.12290 > FwOwa.http: . ack 16793 win 65535
10:44:19.015649 IP 151.0.0.1.12290 > FwOwa.http: . ack 19713 win 65535
10:44:19.060768 IP 151.0.0.1.12290 > FwOwa.http: . ack 22633 win 65535
10:44:19.101634 IP 151.0.0.1.12290 > FwOwa.http: . ack 25553 win 65535
10:44:19.142318 IP 151.0.0.1.12290 > FwOwa.http: . ack 28473 win 65535
10:44:19.181640 IP 151.0.0.1.12290 > FwOwa.http: . 10500:11036(536) ack 
29459 win 65535
10:44:19.186111 IP 151.0.0.1.12290 > FwOwa.http: P 11036:11315(279) ack 
29459 win 65535
10:44:19.187871 IP FwOwa.http > 151.0.0.1.12290: . ack 11315 win 64720
10:44:19.195498 IP FwOwa.http > 151.0.0.1.12290: P 29459:29807(348) ack 
11315 win 64720
10:44:19.337632 IP 151.0.0.1.13384 > FwOwa.http: . ack 887 win 65535
10:44:19.480025 IP 151.0.0.1.12290 > FwOwa.http: . ack 29807 win 65187
10:44:41.974989 IP 151.0.0.1.13384 > FwOwa.http: P 1180:1430(250) ack 887 
win 65535
10:44:41.976171 IP FwOwa.http > 151.0.0.1.13384: P 887:1235(348) ack 1430 
win 64106
10:44:42.016698 IP 151.0.0.1.12290 > FwOwa.http: P 11315:11648(333) ack 
29807 win 65187
10:44:42.017630 IP FwOwa.http > 151.0.0.1.12290: P 29807:30345(538) ack 
11648 win 64387
10:44:42.065134 IP 151.0.0.1.13384 > FwOwa.http: P 1430:1947(517) ack 1235 
win 65187
10:44:42.066116 IP FwOwa.http > 151.0.0.1.13384: P 1235:1583(348) ack 1947 
win 65535
10:44:42.256979 IP 151.0.0.1.13384 > FwOwa.http: . ack 1583 win 65535
10:44:42.258117 IP 151.0.0.1.12290 > FwOwa.http: . ack 30345 win 65535
10:44:42.970615 IP 151.0.0.1.12290 > FwOwa.http: P 11648:11981(333) ack 
30345 win 65535
10:44:42.973161 IP FwOwa.http > 151.0.0.1.12290: P 30345:30883(538) ack 
11981 win 65535
10:44:43.017824 IP 151.0.0.1.13384 > FwOwa.http: P 1947:2464(517) ack 1583 
win 65535
10:44:43.018832 IP FwOwa.http > 151.0.0.1.13384: P 1583:1931(348) ack 2464 
win 65018
10:44:43.131965 IP 151.0.0.1.12290 > FwOwa.http: . ack 30883 win 65535
10:44:43.241455 IP 151.0.0.1.13384 > FwOwa.http: . ack 1931 win 65187
10:44:43.497838 IP 151.0.0.1.12290 > FwOwa.http: P 11981:12314(333) ack 
30883 win 65535
10:44:43.498956 IP FwOwa.http > 151.0.0.1.12290: P 30883:31421(538) ack 
12314 win 65202
10:44:43.544552 IP 151.0.0.1.13384 > FwOwa.http: P 2464:2981(517) ack 1931 
win 65187
10:44:43.546456 IP FwOwa.http > 151.0.0.1.13384: P 1931:2279(348) ack 2981 
win 64501
10:44:43.679141 IP 151.0.0.1.12290 > FwOwa.http: . ack 31421 win 65535
10:44:43.788526 IP 151.0.0.1.13384 > FwOwa.http: . ack 2279 win 65535
10:44:44.091796 IP 151.0.0.1.12290 > FwOwa.http: P 12314:12647(333) ack 
31421 win 65535
10:44:44.092913 IP FwOwa.http > 151.0.0.1.12290: P 31421:31959(538) ack 
12647 win 64869
10:44:44.136809 IP 151.0.0.1.13384 > FwOwa.http: P 2981:3498(517) ack 2279 
win 65535
10:44:44.137915 IP FwOwa.http > 151.0.0.1.13384: P 2279:2627(348) ack 3498 
win 65535
10:44:44.335946 IP 151.0.0.1.12290 > FwOwa.http: . ack 31959 win 65535
10:44:44.337181 IP 151.0.0.1.13384 > FwOwa.http: . ack 2627 win 65187
10:44:51.057961 IP 151.0.0.1.12290 > FwOwa.http: P 12647:12897(250) ack 
31959 win 65535
10:44:51.058775 IP FwOwa.http > 151.0.0.1.12290: P 31959:32307(348) ack 
12897 win 64619
10:44:51.118387 IP 151.0.0.1.13384 > FwOwa.http: P 3498:3831(333) ack 2627 
win 65187
10:44:51.120254 IP FwOwa.http > 151.0.0.1.13384: P 2627:3165(538) ack 3831 
win 65202
10:44:51.165347 IP 151.0.0.1.12290 > FwOwa.http: P 12897:13414(517) ack 
32307 win 65187
10:44:51.167004 IP FwOwa.http > 151.0.0.1.12290: P 32307:32655(348) ack 
13414 win 64102
10:44:51.334671 IP 151.0.0.1.12290 > FwOwa.http: . ack 32655 win 65535
10:44:51.335908 IP 151.0.0.1.13384 > FwOwa.http: . ack 3165 win 65535
10:44:55.342805 IP 151.0.0.1.13384 > FwOwa.http: P 3831:4164(333) ack 3165 
win 65535
10:44:55.343906 IP FwOwa.http > 151.0.0.1.13384: P 3165:3703(538) ack 4164 
win 64869
10:44:55.399863 IP 151.0.0.1.12290 > FwOwa.http: P 13414:13931(517) ack 
32655 win 65535
10:44:55.400908 IP FwOwa.http > 151.0.0.1.12290: P 32655:33003(348) ack 
13931 win 65535
10:44:55.490357 IP 151.0.0.1.13384 > FwOwa.http: . ack 3703 win 65535
10:44:55.600236 IP 151.0.0.1.12290 > FwOwa.http: . ack 33003 win 65187
10:44:55.816597 IP 151.0.0.1.13384 > FwOwa.http: P 4164:4497(333) ack 3703 
win 65535
10:44:55.817597 IP FwOwa.http > 151.0.0.1.13384: P 3703:4241(538) ack 4497 
win 64536
10:44:55.863274 IP 151.0.0.1.12290 > FwOwa.http: P 13931:14448(517) ack 
33003 win 65187
10:44:55.864358 IP FwOwa.http > 151.0.0.1.12290: P 33003:33351(348) ack 
14448 win 65018
10:44:56.036830 IP 151.0.0.1.13384 > FwOwa.http: . ack 4241 win 65535
10:44:56.038771 IP 151.0.0.1.12290 > FwOwa.http: . ack 33351 win 65535
10:44:56.243324 IP 151.0.0.1.13384 > FwOwa.http: P 4497:4830(333) ack 4241 
win 65535
10:44:56.244375 IP FwOwa.http > 151.0.0.1.13384: P 4241:4779(538) ack 4830 
win 64203
10:44:56.288995 IP 151.0.0.1.12290 > FwOwa.http: P 14448:14965(517) ack 
33351 win 65535
10:44:56.290744 IP FwOwa.http > 151.0.0.1.12290: P 33351:33699(348) ack 
14965 win 64501
10:44:56.474889 IP 151.0.0.1.13384 > FwOwa.http: . ack 4779 win 65535
10:44:56.476067 IP 151.0.0.1.12290 > FwOwa.http: . ack 33699 win 65187
10:45:07.370168 IP 151.0.0.1.13384 > FwOwa.http: P 4830:5241(411) ack 4779 
win 65535
10:45:07.370996 IP FwOwa.http > 151.0.0.1.13384: P 4779:5127(348) ack 5241 
win 65535
10:45:07.476945 IP 151.0.0.1.12290 > FwOwa.http: P 14965:15459(494) ack 
33699 win 65187
10:45:07.481063 IP FwOwa.http > 151.0.0.1.12290: P 33699:34237(538) ack 
15459 win 65535
10:45:07.523999 IP 151.0.0.1.13384 > FwOwa.http: . 5241:5777(536) ack 5127 
win 65187
10:45:07.526886 IP 151.0.0.1.13384 > FwOwa.http: P 5777:5919(142) ack 5127 
win 65187
10:45:07.528601 IP FwOwa.http > 151.0.0.1.13384: . ack 5919 win 64857
10:45:07.529327 IP FwOwa.http > 151.0.0.1.13384: P 5127:5475(348) ack 5919 
win 64857
10:45:07.653160 IP 151.0.0.1.12290 > FwOwa.http: . ack 34237 win 65535
10:45:07.807629 IP 151.0.0.1.13384 > FwOwa.http: . ack 5475 win 65535
10:45:08.006104 IP 151.0.0.1.12290 > FwOwa.http: P 15459:15953(494) ack 
34237 win 65535
10:45:08.007229 IP FwOwa.http > 151.0.0.1.12290: P 34237:34775(538) ack 
15953 win 65041
10:45:08.049304 IP 151.0.0.1.13384 > FwOwa.http: . 5919:6455(536) ack 5475 
win 65535
10:45:08.052380 IP 151.0.0.1.13384 > FwOwa.http: P 6455:6597(142) ack 5475 
win 65535
10:45:08.052593 IP FwOwa.http > 151.0.0.1.13384: . ack 6597 win 64179
10:45:08.053221 IP FwOwa.http > 151.0.0.1.13384: P 5475:5823(348) ack 6597 
win 64179
10:45:08.177213 IP 151.0.0.1.12290 > FwOwa.http: . ack 34775 win 65535
10:45:08.286840 IP 151.0.0.1.13384 > FwOwa.http: . ack 5823 win 65187
10:45:08.461883 IP 151.0.0.1.12290 > FwOwa.http: P 15953:16447(494) ack 
34775 win 65535
10:45:08.463249 IP FwOwa.http > 151.0.0.1.12290: P 34775:35313(538) ack 
16447 win 64547
10:45:08.509065 IP 151.0.0.1.13384 > FwOwa.http: . 6597:7133(536) ack 5823 
win 65187
10:45:08.512101 IP 151.0.0.1.13384 > FwOwa.http: P 7133:7275(142) ack 5823 
win 65187
10:45:08.512318 IP FwOwa.http > 151.0.0.1.13384: . ack 7275 win 65535
10:45:08.512994 IP FwOwa.http > 151.0.0.1.13384: P 5823:6171(348) ack 7275 
win 65535
10:45:08.614533 IP 151.0.0.1.12290 > FwOwa.http: . ack 35313 win 65535
10:45:08.724355 IP 151.0.0.1.13384 > FwOwa.http: . ack 6171 win 65535
10:45:08.945497 IP 151.0.0.1.12290 > FwOwa.http: P 16447:16941(494) ack 
35313 win 65535
10:45:08.946630 IP FwOwa.http > 151.0.0.1.12290: P 35313:35851(538) ack 
16941 win 65535
10:45:08.991849 IP 151.0.0.1.13384 > FwOwa.http: . 7275:7811(536) ack 6171 
win 65535
10:45:08.994734 IP 151.0.0.1.13384 > FwOwa.http: P 7811:7953(142) ack 6171 
win 65535
10:45:08.994999 IP FwOwa.http > 151.0.0.1.13384: . ack 7953 win 64857
10:45:08.995748 IP FwOwa.http > 151.0.0.1.13384: P 6171:6519(348) ack 7953 
win 64857
10:45:09.161655 IP 151.0.0.1.13384 > FwOwa.http: . ack 6519 win 65187
10:45:09.163131 IP 151.0.0.1.12290 > FwOwa.http: . ack 35851 win 65535
10:45:09.420419 IP 151.0.0.1.12290 > FwOwa.http: P 16941:17352(411) ack 
35851 win 65535
10:45:09.421277 IP FwOwa.http > 151.0.0.1.12290: P 35851:36199(348) ack 
17352 win 65124
10:45:09.460402 IP 151.0.0.1.13384 > FwOwa.http: P 7953:8447(494) ack 6519 
win 65187
10:45:09.461799 IP FwOwa.http > 151.0.0.1.13384: P 6519:7057(538) ack 8447 
win 64363
10:45:09.506101 IP 151.0.0.1.12290 > FwOwa.http: . 17352:17888(536) ack 
36199 win 65187
10:45:09.508898 IP 151.0.0.1.12290 > FwOwa.http: P 17888:18030(142) ack 
36199 win 65187
10:45:09.512545 IP FwOwa.http > 151.0.0.1.12290: . ack 18030 win 64446
10:45:09.513296 IP FwOwa.http > 151.0.0.1.12290: P 36199:36547(348) ack 
18030 win 64446
10:45:09.599727 IP 151.0.0.1.13384 > FwOwa.http: . ack 7057 win 65535
10:45:09.600928 IP 151.0.0.1.12290 > FwOwa.http: . ack 36547 win 65535
10:45:10.082971 IP 151.0.0.1.13384 > FwOwa.http: P 8447:8941(494) ack 7057 
win 65535
10:45:10.084080 IP FwOwa.http > 151.0.0.1.13384: P 7057:7595(538) ack 8941 
win 65535
10:45:10.128176 IP 151.0.0.1.12290 > FwOwa.http: . 18030:18566(536) ack 
36547 win 65535
10:45:10.130970 IP 151.0.0.1.12290 > FwOwa.http: P 18566:18708(142) ack 
36547 win 65535
10:45:10.131187 IP FwOwa.http > 151.0.0.1.12290: . ack 18708 win 65535
10:45:10.131834 IP FwOwa.http > 151.0.0.1.12290: P 36547:36895(348) ack 
18708 win 65535
10:45:10.254877 IP 151.0.0.1.13384 > FwOwa.http: . ack 7595 win 65535
10:45:10.365397 IP 151.0.0.1.12290 > FwOwa.http: . ack 36895 win 65187
10:45:10.443155 IP 151.0.0.1.13384 > FwOwa.http: P 8941:9435(494) ack 7595 
win 65535
10:45:10.444271 IP FwOwa.http > 151.0.0.1.13384: P 7595:8133(538) ack 9435 
win 65041
10:45:10.488519 IP 151.0.0.1.12290 > FwOwa.http: . 18708:19244(536) ack 
36895 win 65187
10:45:10.491401 IP 151.0.0.1.12290 > FwOwa.http: P 19244:19386(142) ack 
36895 win 65187
10:45:10.491663 IP FwOwa.http > 151.0.0.1.12290: . ack 19386 win 64857
10:45:10.492391 IP FwOwa.http > 151.0.0.1.12290: P 36895:37243(348) ack 
19386 win 64857
10:45:10.583431 IP 151.0.0.1.13384 > FwOwa.http: . ack 8133 win 65535
10:45:10.692574 IP 151.0.0.1.12290 > FwOwa.http: . ack 37243 win 65535
10:45:10.810335 IP 151.0.0.1.13384 > FwOwa.http: P 9435:9929(494) ack 8133 
win 65535
10:45:10.811469 IP FwOwa.http > 151.0.0.1.13384: P 8133:8671(538) ack 9929 
win 64547
10:45:10.857573 IP 151.0.0.1.12290 > FwOwa.http: . 19386:19922(536) ack 
37243 win 65535
10:45:10.860458 IP 151.0.0.1.12290 > FwOwa.http: P 19922:20064(142) ack 
37243 win 65535
10:45:10.860667 IP FwOwa.http > 151.0.0.1.12290: . ack 20064 win 64179
10:45:10.861410 IP FwOwa.http > 151.0.0.1.12290: P 37243:37591(348) ack 
20064 win 64179
10:45:11.021310 IP 151.0.0.1.12290 > FwOwa.http: . ack 37591 win 65187
10:45:11.022469 IP 151.0.0.1.13384 > FwOwa.http: . ack 8671 win 65535
10:45:11.232990 IP 151.0.0.1.13384 > FwOwa.http: P 9929:10340(411) ack 8671 
win 65535
10:45:11.234304 IP FwOwa.http > 151.0.0.1.13384: P 8671:9019(348) ack 10340 
win 64136
10:45:11.288712 IP 151.0.0.1.12290 > FwOwa.http: P 20064:20558(494) ack 
37591 win 65187
10:45:11.291570 IP FwOwa.http > 151.0.0.1.12290: P 37591:38129(538) ack 
20558 win 65535
10:45:11.359419 IP 151.0.0.1.13384 > FwOwa.http: . 10340:10876(536) ack 9019 
win 65187
10:45:11.362547 IP 151.0.0.1.13384 > FwOwa.http: P 10876:11018(142) ack 9019 
win 65187
10:45:11.362795 IP FwOwa.http > 151.0.0.1.13384: . ack 11018 win 65535
10:45:11.363431 IP FwOwa.http > 151.0.0.1.13384: P 9019:9367(348) ack 11018 
win 65535
10:45:11.458522 IP 151.0.0.1.12290 > FwOwa.http: . ack 38129 win 65535
10:45:11.567908 IP 151.0.0.1.13384 > FwOwa.http: . ack 9367 win 65535
________________________________________________________________
occorre altro per darmi qualche dritta?
grazie! 

 wrote in message 
news:rKxFh.10209$J11.2...@twister1.libero.it...


 65535
Questi sono i client che accedono tramite il proxy? Se si', dovresti fare
un'altro giro anche con un client che accede direttamente senza proxy. Ti
conviene utilizzare -Xs0 -w <nomefile.pcap>, cosi' da registrare tutto il 
traffico, compreso il payload dei pacchetti, nel file nomefile.pcap [1]. 
Dovresti creare i due file owa_noproxy_ok.pcap e owa_conproxy_ko.pcap (il
cui nome dovrebbe chiarire i contenuti) e poi analizzarli con wireshark o
un'altro analizzatore di protocollo per vedere cosa succede, a livello di
applicazione, nel momento in cui il client tenta di autenticarsi.
Non stai utilizzando un transparent proxy, vero?
Fabio
[1] il comando completo potrebbe essere  qualcosa tipo:
 
    $ tcpdump -Xs0 -w file.pcap host 151.0.0.1