Any Wireshark experts?

[kennysarmy]

We're troubleshooting why our new Pitney Bowes (Franking Machine) network dongle won't connect out through our (SWGfL/RM) firewall.

 

I was wondering if I could use Wireshark to look at what might be dropping the packets in case it was something internal.

 

The device is given an IP address etc using a website where you input the data and then hold the unit up to a box on the monitor which flashes to send data to the unit, it's being given an IP address but is failing to talk back to their servers. There is no screen or interface to check that the other information such as default gateway, proxy, dns etc are being correctly read and stored on the unit

[howartp]

We had problems with ours for a while, though ours has an ethernet NIC on the machine itself so you do configure it in the menu.

 

I gave up in the end and put a firewall rule in from that single static IP to have unrestricted internet access, no firewall blocks, no guardian blocks.

 

I did notice later, months later, that the engineer (who wouldn't let me near the machine, he had to put all the config in himself) had not entered and 'saved' all the static IP/gw/mask/DNS etc that i'd given him. I can't remember what he'd missed but it made complete sense to me once I found it.

 

Peter

[JordanT91]

Have you checked your firewall logs to see if anything to/from that IP address is being blocked?

[TechMonkey]

I think I gave it a fixed IP and set it to bypass all filtering. I also have a vague recollection of the network details being horribly wrong. We have also had numerous occasions when their servers have been down or overloaded. We have reverted to the fax line many a time. An engineer that came out said he was dreading the time when all the new machines were deployed as they no longer were coming with modems.

[Oaktech]

We had one on our SWGFL and gave up - I used to take it and the school credit card home when it ran out of credit.

[Boredguy]

Did you allow pb.com/* in your filtering solution?

[kennysarmy]

Thanks for all the replies.

 

We're bypassing our smoothwall by entering the proxy as schoolname.proxy.gloucs.sch.uk : 8080

 

We can't check the firewall logs as the firewall is maintained by SWGfL / RM

[southhamster]

Have you spoken to SWGfL as they know how to fix this from other schools. They are one of the supposed market leaders after all.

[Boredguy]

Strange as our franking machine works happily via the SWGfL and Safetynet filterings.

The machine picked up a DHCP address, and the engineer recommended that instead of assigning a static IP.

 

Added the exclusion to the filtering for all users (since the machine would use our transparent filter since it does not have a username) and its still working 3 years down the line.

No firewall rules were required as it was just using normal 80 and 443 apparently.

 

If your going via the upstream proxy still, unless the site has been unfiltered there it will give you an error.

If you try and access the site pb.com on a workstation that is configured to bypass smoothwall does it redirect you to the http://www.pitneybowes.com site?

Edited December 6, 2019 by Boredguy

[kennysarmy]

From their website:

 

network off red off amber lights Your light is blinking Off, then Amber, then Off, then Red

What this means

Your SmartLink device cannot connect through your network.

Action required

Have your IT department review the document SmartLink™ Installation Requirements and Connectivity Setup Guide to resolve your issues.

Possible issues include:

Your SmartLink device cannot connect through your network.

The port that SmartLink uses to connect to the internet is blocked by your network firewall. Your Smartlink device connects with port 31314, 993, or 443 using TCP. Verify that your network allows traffic through these ports.

The URL that the SmartLink uses to connect to the internet is blocked by your network firewall. Your SmartLink device connects to the address agent.sl.pb.com.

Proxy address or port incorrect: Your SmartLink device cannot connect through your proxy.

Validate that your proxy settings are correct and the proxy is available.

Proxy Access credentials rejected: Your SmartLink device cannot connect to your proxy.

Verify that you entered correct proxy credentials. Proxy Usernames and Passwords may be case sensitive, depending on your configuration.

[mrcrazy04]

To answer the original question, if you can man in the middle the device, or sit on a mirror port, you could then use Wireshark to see the traffic passing back and forth.

Any unanswered SYN packets would tell you that something upstream was blocking it, but not necessarily where. It should also allow you to see if any TLS handshakes are failing, but you obviously won’t be able to decrypt any TLS traffic.

 

An alternative could be to setup an intercepting proxy, such as Burp Community Edition or Fiddler, and make that the device’s proxy server temporarily, with the original proxy set as an upstream proxy. That might be a bit easier, as you won’t have to wade through lots of network traffic to get a better idea as to what’s going on.

[mavhc]

seems easier to just setup a computer with that ip/proxy settings, test all those ports, and the certificates if required

[kennysarmy]

seems easier to just setup a computer with that ip/proxy settings, test all those ports, and the certificates if required

 

Hi,

 

Would I need a PC external to the network to test the ports?

 

Thanks.

[kennysarmy]

So, update from RM / SWGfL.

 

They decided without consulting me to "tidy up" some of their firewall rules and decided this was one I did n't need!!!

 

And a second update to say they were never put in place as we closed the call before it was implemented, so this may tie up with others on this that no firewall rules were needed to set up this damn franking machine.

 

So now I'm left I guess trying to troubleshoot on the internal network why this device can't get out.

 

I can ping the device, so I know the setup is giving it an IP address, but is there any way if a device is connected to my network that I can check any other details about it's config.

Edited December 9, 2019 by kennysarmy

[JordanT91]

If the dongle is using DHCP, then you shouldn't need to worry about default gateway, dns etc. I think your problems lies with the ports.

 

Make sure that ports 31314 and 993 (TCP) are open on your firewall, and make sure that agent.sl.pb.com or indeed the entire pb.com domain is unfiltered.

 

There is a fairly basic troubleshooting website on the PB website, it describes what the light combinations on the dongle mean so you can diagnose connection issues. What lights are you getting? What is the exact model of franking machine or dongle?

Edited December 9, 2019 by JordanT91

[kennysarmy]

To answer the original question, if you can man in the middle the device, or sit on a mirror port, you could then use Wireshark to see the traffic passing back and forth.

Any unanswered SYN packets would tell you that something upstream was blocking it, but not necessarily where. It should also allow you to see if any TLS handshakes are failing, but you obviously won’t be able to decrypt any TLS traffic.

 

An alternative could be to setup an intercepting proxy, such as Burp Community Edition or Fiddler, and make that the device’s proxy server temporarily, with the original proxy set as an upstream proxy. That might be a bit easier, as you won’t have to wade through lots of network traffic to get a better idea as to what’s going on.

 

I've installed Fiddler, currently trying to work out how to set it up as an intercepting proxy so I can route another PC through mine to see how it works, before moving on to the Pitney Bowes device.

 

OK, sorted that.

 

Now to reset the Pitney Bowes unit to go through my PC as a proxy and see what I can capture!

Edited December 9, 2019 by kennysarmy

[kennysarmy]

OK I seem to be capturing traffic from the device, but it's getting mixed up with traffic from my own PC.

 

Anyone know how to filter the traffic so it only shows from one device or IP?

[JordanT91]

OK I seem to be capturing traffic from the device, but it's getting mixed up with traffic from my own PC.

 

Anyone know how to filter the traffic so it only shows from one device or IP?

 

ip.src == xxx.xxx.xxx.xxx

[MatthewL]

Not but is this any use to you?

[kennysarmy]

?#@*&$ me!

 

We tried setting the unit one last time using a mobile phone to send the pulsing symbol rather than a monitor and it's worked first time!!!!!

[mavhc]

You'd want the test PC to be internal, on the same network as the machine.

 

Was this machine from the 80s? Have they not heard of usb? or a web interface?