Locating a Specific PC Making Calls to the Internet

Last Updated : Sep 15, 2020 |
Enable the following trace option settings:

Tab

Trace Options

ISDN

Layer3 Tx and Layer3 Rx.

Interface

Interface Queue

Call

Line Send, Line Receive, Targeting and Call Logging

System

Error, Print and Resource Status Prints.

If Network address translation (NAT) is not being used on the connection this produces:
Interface Queue: v=UKIP WAN 1 1
IP Dst=194.217.94.100 Src=212.46.130.32 len=48 id=043e ttl=127 off=4000 pcol=6 sum=017c
TCP Dst=80 (0050) Src=4105 (1009) Seq=338648156 Ack=0 Code=02 (SYN )
Off=112 Window=8192 Sum=6aae Urg=0
0000 02 04 05 b4 01 01 04 02
  • The source (Src) of this packet is 212.46.130.32.

  • The destination (IP Dst) is 194.217.94.100,

  • The protocol is TCP (pcol is 6)

  • The destination socket is 80 (80 is World Wide Web HTTP is, a PC is trying to access a web page)

  • The source socket is 4105 (unassigned means it is free to be used by any program)

  • The packet is a TCP SYN.

You need to locate the PC with address 212.46.130.32. To locate, type the IP Dst in the address bar of the web browser and it takes the specific page.

If NAT is being used, you can trace by observing in System Monitor traces, example:
PRN: ~NATranslator d40190dc 00000000
PRN: ~UDPNATSession in=c0a84d01 out=d40190dc rem=d401809c in_port=0035 out_port=1000 rem_port=0035
PRN: ~TCPNATSession in=c0a84d02 out=d40190dc rem=c2ed6d49 in_port=0423 out_port=1005 rem_port=0050
The Interface Queue trace is preceded by the following System Monitor output :
PRN: TCPNATSession in=c0a84d02 out=d40190dc rem=c2ed6d49 in_port=0423 out_port=1005 rem_port=0050
Where:

in

Is the IP address (in hex format) of the device on the LAN that is initiating the request.

out

Is the IP address of the PBX (i.e. the local IP address of the link) as allocated by the ISP/Remote Routing device.

rem

Is the requested destination IP address.

in_port

Is the port (socket) number used by the initiating device on the LAN

out_port

Is the outgoing port we use on the link (due to the NAT)

rem_port

Is the requested destination port (socket) number.