2

Seems ridiculous to read it back out loud, but I'm at a loss here.

Server 2012 Standard. Runs a daemon for an accounting package on TCP 12502; at some point, the server stopped accepting connections to the daemon, roughly last week, but was working two weeks ago. Server has been rebooted.

netstat confirms it's listening on all interfaces. Windows Firewall is off for all three (Domain, Public, Private)*. Running Wireshark on the server, I can see the SYNs, but no ACKd or SYN-ACKd. SMB, DNS, etc. all are working happily from the workstation to the server.

I stopped the daemon and grabbed netcat and tried for fun to listen on another non-standard/non-MS port, 1250, telnet'ed from the client machine, TCP connection OK.

Dividing my ports top to bottom until I could narrow it down... and I get to TCP port 6000. Telnet success.
TCP port 6001, no dice.
TCP port 6002, no dice.
Rinse and repeat a dozen more times. See every SYN, but no ACK.

Is there something about ports > TCP 6000? Who knows. Google didn't.

I wish I had another 2012 Server to check, but I don't. I went online to research any new security features for 2012 that may be causing this but it was working a few weeks ago, and nothing looked obvious.

Patch Tuesday did come and go, and there's a few there that were installed that I'm sifting through, but nothing yet.

*Only thing I wasn't sure of with Windows Firewall is where it says "Not Connected" by the drop-down for each of Public and Private. They were "Off" but not sure what "Not Connected" means.

Improve this question

2 Answers 2

Reset to default
2

Took at stab at stopping the Base Filtering service. Can connect now. No idea what that service is but required me to stop Routing and Remote Access as well as IPSec/IKE.

Improve this answer
2
  • I've had similar "problems" in the past with Windows Firewall, where "off" doesn't necessarily mean "off." The best thing to do is stop the service at least during troubleshooting, and then poke the necessary holes through when you are finished. I'll put money down that if you 1) start the firewall, 2) create the proper firewall rule(s), 3) turn the firewall "off"... packets will pass (when they aren't now with the firewall "off").
    – brandeded
    Mar 18, 2013 at 21:19
  • Yeah, the only thing I can find about the Base Filtering Engine service is here: msdn.microsoft.com/en-ca/library/windows/desktop/… It does mention user/kernel-mode drivers and there was a KB released last week for 2012 that had to do with that IIRC. Going to dig further.
    – gravyface
    Mar 19, 2013 at 18:23
-1

I have exactly the same issue.

I suspect a Microsoft patch has broken things if it was working for you but isn't now. Have a look at the patches installed around that time.

For me it has never worked but then I fully patches my system before installing the daemon I am having trouble with.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .