Avatar of Kirchtoe
Kirchtoe
 asked on

Terminal Server processing numerous packets from a single external connection

I have a 2012 R2 Terminal Server used for Remote Desktop connections.  We have been experiencing slow connections and cutoffs throughout a given day so I decided to investigate.

When I connect to the server and run, for example, Wireshark to see what is hitting the NIC, I see that in a 10-second capture there are maybe 800 packets coming from my public IP.

No other remote connection shows anywhere near this many packets.  This behavior doesn't seem normal.

I have attached a file showing the packet capture from Wireshark.  72.135.233.88 is my public IP.
Network-capture.docx
Network Analysis

Avatar of undefined
Last Comment
Dirk Kotte

8/22/2022 - Mon
Elango Sathyadev

From what i see it could be DNS.

Is your internet provider Spectrum Internet with organisation name "Time Warner Cable Internet LLC"

Change wireshark to all origin and destination port and post the capture again.

In Wireshark go to Edit -> Preferences -> Columns add the ports
ASKER CERTIFIED SOLUTION
Dirk Kotte

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes