I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, it wasn't my idea). The only port opened on the server and the firewall for remote capture purpose is
tcp:2002. Also firewall blocks any unknown outgoing ports. So the whole picture looks like:
client >> firewall (tcp:2002 opened) >> target server (tcp:2002 opened)
The questions is: does rpcapd use any "data ports" (either tcp or udp) to forward captured traffic to the client? If so, what are these ports? Can I manually set them via some cmd switch?
The only port mentioned in the docs is...
-p <port> It sets the port the daemon has to bind to. Default: it binds to port 2002.
.. but if this is just some kind of "control port" remote capture won't work in my case.