iChain® 2.3
troubleshooting tools and tips

Neil Cashell

iChain WWS engineer

Novell, Inc.

ncashell@novell.com

Jim Short

iChain WWS engineer

Novell, Inc.

General iChain® 2.3 troubleshooting tools New iChain components (proxy authentication, Citrix SSO, Rewriter, WebDAV)

Specific troubleshooting tools

Common issues

Presentation Outline

Generic iChain Troubleshooting Tools

Generic iChain Troubleshooting Tools

LSEARCH.NLM from NDK

Bind done for all requests

http://developer.novell.com/ndk/cldap.htm

LDAP browser

http://www.iit.edu/~gawojar/ldap/

Export configuration to file

Confirm LDAP search strings

iChain Proxy GUI

Home->Health status for details of services running

Monitor TAB gives services and stats information

Services running (rewriter display)

Disk space info, CPU utilization, cache hit ratio

Access ACLCHECK, SSO and Proxy logs via MONITOR TAB

Can ping remote applications

Generic iChain Troubleshooting Tools
(cont.)

iChain Proxy Console and Logger Screens

Communication error messages printed here

Debug options modified to write here (SB, SSO, NPKIT)

Activation Related Debugging Info (Display ISO Object Info)

Very useful in knowing what activation information (including evaluation period ending) the Proxy has read from the ISO.

If it cannot read the ISO object then it would give TreeName=Not Resolved and/or Tree GUID=Invalid (problem with filtered replica, DirXML®, referrals)

Generic iChain Troubleshooting Tools
(cont.)

TCPCON

Connectivity specific tool (ICMP, TCP issues)

Active TCP listeners LDAP profile errors

_TCP/_IP console command tools

Logs from authentication servers

DSTRACE.NLM for LDAP (view DS trace traffic for object/attribute resolution - +LDAP/+TIME/FILE=ON)

‘Radius debug ON’ trace from Radius server

Generic iChain Troubleshooting Tools
(cont.)

Browser tools

ieHTTPHeaders - http://www.blunck.info/ieHTTPHeaders.html

Mozilla “Live HTTP Headers” plug-in

Generic iChain Troubleshooting Tools
(cont.)

Network layout information

Firewalls/L4 may pose Connectivity/State problems

LAN analyzer (Sniffer, Ethereal, tcpdump, pktscan)

Trace traffic between proxy and auth server

Trace traffic between browser and proxy server

Trace traffic between proxy and origin server

Generic iChain Troubleshooting Tools
(cont.)

“Proxy Authentication”

iChain Components

Proxy Troubleshooting Tools

Proxy Troubleshooting Tools

Internet browser

Useful for importing and viewing certificate attribs

Mozilla/IE ‘Live HTTP Headers’ plug in

Proxy load line switches

-ri (remove IP address check on cookie)

-cc (clear cache at startup)

-cs (enable secure cookies)

-cv (cookie mode – 24 or 40 bit)

-gzip (compressed data to browser – default 1)

-PTP (removed Public header)

Proxy Troubleshooting Tools

Proxy Console -> iAgent console

Proxy Troubleshooting Tools

Ethereal (free, decodes SSL headers, filters TCP stream)

Initialization problems

SSL Handshake Problems

Authentication server problems

Proxy Troubleshooting Steps

LDAP

Failed to get ISO information over LDAP

Get authentication <prof_name> returns valid parameters

Ping <ldap_srvr_addr:port> from iChain command line interface

Check interpacket delay times between LDAP request/responses

LDAP Server overloaded and may require addition of threads

Check is LDAP over SSL setup – may be a cert issue

Add delay to appstart.ncf before Proxy loads (iChain 2.2 SP2)

Proxy Initialization Problems

iChain 2.3 Authentication Flow

BROWSER

iCHAIN

PROXY

SERVER

SSL Handshake – Cert Exchange

GET http://www.novell.com/

Cookie=IPCXQX01f20cc05=00003073462q88a7b6fba12

Redirect to http://www.novell.com/

GET https://www.novell.com/ICSiBroker/?”http://www.novell.com?-T

Cookie=IPCXQX01f20cc05=00003073462q88a78b6fba12

Redirect to https://www.novell.com/ICSiBroker/?”http://www.novell.com”-T

Set-Cookie: IPCXQX01f20cc05=00003073462q88a78b6fba12

path=/; domain=.novell.com

POST https://www.novell.com/ICSLogin/auth-up

Context=default&username=neil&password=nov&

URL=http://www.novell.com/&proxypath=reverse&button=login

200 OK

GET https://www.novell.com/ICSLogin/po.gif

GET https://www.novell.com/ICSLogin/logo.gif

GET https://www.novell.com/ICSLogin/style.css

200 OK

GET https://www.novell.com/ICSLogin/?”http://www.novell.com”

302 Redirect to https://www.novell.com/ICSLogin/?”http://www.novell.com”

GET http://www.novell.com

Login page not displayed

Failure at this level most often indicates an SSL/PKI issue

Verify is authentication over HTTP is alright

If not check Cert timestamps, CRL information

Make sure that the iChain server timezone and time is set correctly

Look closely at the SSL diagnostic screens on the iChain Proxy server and try and check for SSL handshake errors

Trace client to proxy connection and verify, after the first redirect,

That you see cert chains being transferred

That the iChain Proxy doesn’t have time set in the future (Non US!)

Proxy SSL Handshake Problems

Certificate issues

SSLDUMP decodes cert info correctly (ssldump -A -N -i eth0

Server certificate abiding by RFC 2459

Imported trusted roots (including intermediates)

Verify Certificate still valid and active

Verify Certificate Maintenance updates to iChain 2.3 SP2 docs

Importing 3rd party certificates signed by intermediates

Renewing certificates

Proxy SSL Handshake Problems (cont)

Proxy SSL Handshake Problems
(certificate timing issue)

Login page displayed but authentication fails

Verify that login page hasn’t been customized

400 Bad Request error message

Missing required login parameters (e.g. context, proxypath)

Verify that no intermediate device stripping cookies

Verify browser is sending the correct credentials when POSTing information to the iChain Proxy server

Browser tools to view HTTP headers

Check authentication server logs (DSTRACE, Radius) to see if user being validated

Proxy Authentication Problems (cont)

Login page displayed but authentication fails

403 “Browser does not support cookies”

Verify if transparent proxy in path

403 “Organizational Policies Prohibit Access...”

Verify protected resource defined with *

Session Broker enabled

Mixed iChain 2.2 and 2.3 environment (cookie sizes)

Same authentication profile names

Proxy Authentication Problems (cont)

Proxy Authentication Problems (cont)

LDAP problems

LDAP profile has valid BIND username/password

Must have Read (not just browse!) rights to DS

LDAP server

Responds to requests (DSTRACE +LDAP switch)

Slow interpacket delay time (LAN TRACE, DSTRACE +TIME)

Indexing required when setting up complex searches

Radius problems

'Radius debug on' commands show no errors

Changes between 2.2 and 2.3

ldaprad profile replaces SET commands

LAN trace shows successful RADIUS response

Timeout issues

Proxy Authentication Problems (cont)

Mutual Authentication problems

Trusted root container includes client cert CA and intermediate certificates

Certificate error checkbox enabled to return more detailed information

ldapcert LDAP profile required when certificate mapping used

Debug NPKIT.NLM (shipped as NPKIT.DBG)

Cert 1 -- Step 3 -- Revocation checking

Cert num 1 Starting revocation check

ERROR: Cert num 1 No CRL DP's so invalid

Cert 2 -- Step 2 -- General certificate checks

Basic Constraints: Cert num 2 is a CA

Cert num 2 This is the Root Certificate.

Cert 2 -- Step 3 -- Revocation checking

Cert num 2 Starting revocation check

Cert num 2 number of CRL DP's is 1

1 Distribution Point: ldap://151.155.164.163:389/cn%3DCA%2C o%3DNovell

--- Entering checkForValidCRL -- ldap://151.155.164.163:389/cn%3DCA%2C o%3DNovell

node type NPKIx509CRL_crlType

node type NPKIx509CRL_OnlyCACertsType

Current time:402A1175 Wed Feb 11 11:26:45 2004

nextUpdateTime:402924FA Tue Feb 10 18:37:46 2004 ERROR: CRL has expired.

--- Exiting checkForValidCRL with ccode = -1258

Proxy Authentication Problems (cont)

Mutual Authentication problems

check CDP attributes on client and intermediate certificate (points to an LDAP or HTTP CRL server)

View and check CRL attributes from browser

Check if certs (Equifax) have the option without any LDAP or HTTP server specified

enable the mapx500crltoldap set command

check if client certs have an AIA attribute

don’t need to enable ocspconfiguredsource/URL

Check OCSP server log files

check if disablerevocationchecks disabled

Proxy Authentication Problems (cont)

Back end application problems

Authentication header invalid

OLAC not passing correct credentials

Check Protected resource

iChain servlets can check OLAC/Auth headers

iChain Components
“Citrix SSO”/FormFill

Citrix SSO Troubleshooting Tools

Citrix SSO Troubleshooting Tools

Proxy Console -> Display services screen

Check what links are being rewritten

Citrix SSO Troubleshooting Tools

SSO Debug screen

Check formfill status

Citrix SSO Troubleshooting Tools

Rewritten ICA file

Save the ICA file to confirm entries rewritten

7

Citrix SSO Authentication Flow

Production MetaFrame Farm

DMZ

Web

Browser

6

XML

Service

Nfuse

Portal

Secure Web

Server

2

3

1

4

5

ICA

Client

Firewall 1

Firewall 2

Production MetaFrame Farm

XML

Service

Web

Browser

Nfuse

Portal

Secure Web

Server

Citrix SSO Authentication Flow

Firewall 1

Firewall 2

iChain 2.3

1

2

5

9

7

6

4

3

8

ICA

Client

Citrix SSO Troubleshooting Tools

LAN traces

iChain to LDAP if SSO to Citrix server

iChain to browser communication

Verify rewrite of ICA page

Verify the CONNECT sent to Metaframe Proxy

Verify the 407 Proxy author. required sent back

Realm is “iChain-ICA”

Verify Connection established

iChain to Web server

Application info sent back correctly

Cookies exist

No Errors from back end servers

FormFill Troubleshooting Tools

BuildFormFillScript.jsp

http://www.novell.com/coolsolutions/icmag/features/tips

LDAP Browser/ConsoleOne

Confirm ISO and user “iChainFormFillCrib” attributes

Browser ‘View->Source’ with <debugPost/>

View info submitted by browser and login page details

LAN traces

iChain to LDAP and browser communication

Updated Documentation

iChain 2.3 SP2 case study

Common Citrix SSO Problems and tips

tunnelauthforica = Yes for Citrix/MF server

SSO to login fails - profile URL doesn't match

Client connecting thru forward proxy fails

ICA client ignore browser proxy settings

Java based ICA clients will not work

No spaces in between 'address=' in script (SP2)

Citrix with NDS integration – TID # 10093238

Load balanced servers -> specified twice!

Disable 'keep-alive' for VIP ports 80/443

Remove POST/ from FormFill profile to only fill (no submit)

Check for Javascript TAGs/methods in login page

Simplify profile to one variable if possible

Use test profile written to confirm

Verify if multiple <form> tags exist

Load SSO /X

Verify iChainFormFillCrib or LDAP attribute sent/received

Verify DSTRACE +LDAP settings show valid response

verify LAN trace for LDAP communication

Verify schema extensions (secret store - tid 10090219)

Load SSO.NLM /d /l and view debug/logger screen info

Common FormFill Problems and tips

Miscellaneous Issues

Miscellaneous Issues

Rewriter

Rewriter.sam file

Proxy Console->Display services

Multiple accelerators cannot have same althostname/port!

[Exclude] option to turn off rewriting for links

<!--NOVELL_REWRITER_OFF/{ON}--> tag to turn off/on rewriting of portions of HTML data

[Javascript Variables] can be used to overwrite Javascript variables containing URL references

[Alias Host Names] extended to rewrite non DNS hostnames, schemes, ports and links

Can be used to add additional paths to pbmh setup

Miscellaneous Issues

WebDAV

Tunnel WebDAV methods through but must note rewriter requirements

Cannot delete mails when SSLizer enabled and OWA server running over HTTP

OWA/Outlook in PBMH setup requires rewriter changes

Different paths, Javascript variables

OWA requires alt hostname to be same as DNS name

Outlook 2003 does not!

Miscellaneous Issues

Caching and Encoding

'Allow caching at browser' option enabled for SSL data with IE

Enable cache bypass in PIN list for dynamic content

Based at directory level

Force HTTP 1.0 to origin server

set accelerator <name> forcehttp10toorigin = yes

Troubleshooting

iChain access

control issues -

10080500

Troubleshooting
iChain formfill
issues - 10080226

Troubleshooting
iChain authentication
issues - 10080271

Troubleshooting
iChain OLAC issues - 10080620

Troubleshooting iChain installation issues - 10068257

Configuring formfill to SSO to other Novell products - 10078054

Miscellaneous iChain Issues

Summary

iChain troubleshooting tools

More than enough!

iChain troubleshooting steps

Follow flow and identify broken interface

(TUT248)

1. A user launches a Web browser and connects to a NFuse on either port 80 (HTTP) or port 443 (HTTPS). The NFuse portal server requires the user to login using valid user credentials.

2. The NFuse server reads the user’s information and uses the its Java objects to forward that information to a Citrix XML Services, on port 80, running on another designated Citrix server in the server farm. This designated Citrix server, who is also a MetaFrame server, acts as a broker between the NFuse server and the Citrix server farm.

3. The Citrix XML service on the designated server retrieves a list of applications that the user is authorized to access. And forward this information to NFuse running on the Web server.

4. The Web server uses the NFuse Java objects to generate an HTML page containing links to the applications. Each hyperlink in the HTML page points to the template.ica file sotre on the NFuse Web server. This file serve as a template that NFuse uses to dynamically generate customized ICA files. ICA files are text files containing parameters that configure ICA sessions properties such as the application to run in the session, the address of the server that executes the application, and properties of the window in which to display the application. ICA files are written in .ini file format and have a .ica extension.

5. When the user clicks on a published application link, The Web browser sends a request to the Web server to request an ICA file for the selected application. The Web server passes his request to the NFuse Java objects, which retrieve the template ICA file. The template file contains substitution tags. The NFuse Java objects replace the substitution tags in the template ICA file with the specific to the user and desired application. The NFuse Java objects then send the customized ICA file to the Web browser.

6. Base on the file type, the browser launches the plug-in and brings up the ICA Client to process this ICA file.

7. The ICA Client uses the information in the ICA file to launch an ICA connection to a MetaFreame server.

1. A user launches a Web browser and connects to a NFuse on either port 80 (HTTP) or port 443 (HTTPS). The NFuse portal server requires the user to login using valid user credentials.

2. The NFuse server reads the user’s information and uses the its Java objects to forward that information to a Citrix XML Services, on port 80, running on another designated Citrix server in the server farm. This designated Citrix server, who is also a MetaFrame server, acts as a broker between the NFuse server and the Citrix server farm.

3. The Citrix XML service on the designated server retrieves a list of applications that the user is authorized to access. And forward this information to NFuse running on the Web server.

4. The Web server uses the NFuse Java objects to generate an HTML page containing links to the applications. Each hyperlink in the HTML page points to the template.ica file sotre on the NFuse Web server. This file serve as a template that NFuse uses to dynamically generate customized ICA files. ICA files are text files containing parameters that configure ICA sessions properties such as the application to run in the session, the address of the server that executes the application, and properties of the window in which to display the application. ICA files are written in .ini file format and have a .ica extension.

5. When the user clicks on a published application link, The Web browser sends a request to the Web server to request an ICA file for the selected application. The Web server passes his request to the NFuse Java objects, which retrieve the template ICA file. The template file contains substitution tags. The NFuse Java objects replace the substitution tags in the template ICA file with the specific to the user and desired application. The NFuse Java objects then send the customized ICA file to the Web browser.

6. Base on the file type, the browser launches the plug-in and brings up the ICA Client to process this ICA file.

7. The ICA Client uses the information in the ICA file to launch an ICA connection to a MetaFreame server.

Browser 137.65.159.179

iChain:137.65.159.178

Citrix: 151.155.164.200

Accelerators:

Citrix-> nfuse

citrix2-> tunnel

FormFill Policy:

<!-start of secure tunnel to MetaFrame through NFuse -->

<urlPolicy>

<name>NFuseTest</name>

<url>citrix.provo.novell.com/Citrix/NFuse17/launch.asp*</url>

<actions>

<icaFill>

<icaOriginal>

[WFClient]

</icaOriginal>

<icaReplace>

[WFClient]

ProxyHost=citrix2.provo.novell.com:80

ICHAIN-TOKEN

</icaReplace>

<icaMetaPrivateAddress>

Address=151.155.164.202

Address=151.155.164.200

</icaMetaPrivateAddress>

<icaMetaPublicAddress>

Address=citrix2.provo.novell.com

</icaMetaPublicAddress>

</icaFill>

</actions>

</urlPolicy>

<!- end of secure tunnel to MetaFrame through NFuse -->

load -d -l sso

Loading module SSO.NLM

iChain Single Sign-On Formfill (rstilmar) [DEBUG BUILD]

Version 2.10 January 14, 2004

Copyright (C) 2001-2002 Novell, Inc. All Rights Reserved

SSO.NLM will run on processor 0 only

Uni-Processor NLM

Module SSO.NLM load status OK

4FILT01: This filter prints info from the request.

Nsure Audit Platform Agent: Failing primary connection for application iChain\.

ssoread: Port No = 389

ssoread: Servername=137.65.159.177

ssoread: Username=cn=admin,o=shadow

ssoread: Password=secret

ICA RWList 0A440344 for rule NFuseTest

4FILT01: Rules(length = 1332) have been refreshed!

4FILT01: Using SecretStore!

4FILT01: Must use LDAP over SSL for Novell SecretStore Disabling SecretStore

4FILT01: Ready for Request

1AFILT01: main: This filter prints info from the server request.

3bfilt06: In main()

pMyState->url: citrix.provo.novell.com/Citrix/NFuse17/launch.asp?NFuse_Applicati

on=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad

ICA formfill

Cannot match one-time token.

pMyState->url: citrix.provo.novell.com/Citrix/NFuse17/launch.asp?NFuse_Applicati

on=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad

ICA formfill

Cannot match one-time token.

pMyState->url: citrix.provo.novell.com/Citrix/NFuse17/launch.asp?NFuse_UID=35536

&NFuse_Application=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&NFuse_MIMEExt

ension=.ica

ICA formfill

cookie = 173508c8c6e5b3e2a66a68a990ee9c548fa3d85b5461fc3f943dbce3ee5b8d55

cookie = [WFClient]

ProxyHost=citrix2.provo.novell.com:80

ProxyType=Secure

ProxyUsername=173508c8c6e5b3e2a66a68a9

ProxyPassword=90ee9c548fa3d85b5461fc3f943dbce3ee5b8d55

Before getReplacePair

Replace token [WFClient] with [WFClient]

ProxyHost=citrix2.provo.novell.com:80

ProxyType=Secure

ProxyUsername=173508c8c6e5b3e2a66a68a9

ProxyPassword=90ee9c548fa3d85b5461fc3f943dbce3ee5b8d55

Replace Address=151.155.164.200 with Address=citrix2.provo.novell.com

*** ICA file =

[Encoding]

InputEncoding=ISO8859_1

[WFClient]

ProxyHost=citrix2.provo.novell.com:80

ProxyType=Secure

ProxyUsername=173508c8c6e5b3e2a66a68a9

ProxyPassword=90ee9c548fa3d85b5461fc3f943dbce3ee5b8d55

Version=2

ClientName=ichai-administ-mxjln

RemoveICAFile=yes

[ApplicationServers]

Wordpad=

[Wordpad]

Address=citrix2.provo.novell.com:1494

InitialProgram=#Wordpad

LongCommandLine=""

DesiredColor=2

TransportDriver=TCP/IP

WinStationDriver=ICA 3.0

AutologonAllowed=ON

Username=administrator

Domain=\FE4D43842F2DC07C

ClearPassword=0DE905D5448F5C

ClientAudio=On

DesiredHRES=640

DesiredVRES=480

TWIMode=On

SessionsharingKey=2-basic-basic-ichainfarm-administrator-iChainFarm

[EncRC5-0]

DriverNameWin16=pdc0w.dll

DriverNameWin32=pdc0n.dll

[EncRC5-40]

DriverNameWin16=pdc40w.dll

DriverNameWin32=pdc40n.dll

[EncRC5-56]

DriverNameWin16=pdc56w.dll

DriverNameWin32=pdc56n.dll

[EncRC5-128]

DriverNameWin16=pdc128w.dll

DriverNameWin32=pdc128n.dll

[Compress]

DriverNameWin16=pdcompw.dll

DriverNameWin32=pdcompn.dll

***

--------------------------------------------------------------------------------

- - - - - - - - - - - - - - - - - - - - Frame 1 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" M "," 1","0.000.000 ","[137.65.159.178] ","[137.65.159.179] "," 964 ","HTTP"," C Port=1842 GET /Citrix/NFuse17/launch.asp?NFuse_Application=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad HTTP/1.1"

DLC: Ethertype=0800, size=964 bytes

IP: D=[137.65.159.178] S=[137.65.159.179] LEN=930 ID=60810

TCP: D=80 S=1842 ACK=2644409152 SEQ=1601757634 LEN=910 WIN=64512

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: GET /Citrix/NFuse17/launch.asp?NFuse_Application=Wordpad&NFu

HTTP: se_AppFriendlyNameURLEncoded=Wordpad HTTP/1.1

HTTP: Line 2: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,

HTTP: application/vnd.ms-powerpoint, application/vnd.ms-excel, ap

HTTP: plication/msword, application/x-shockwave-flash, */*

HTTP: Line 3: Referer: http://citrix.provo.novell.com/Citrix/NFuse17/appli

HTTP: st.asp?NFuse_currentFolder=

HTTP: Line 4: Accept-Language: en-us

HTTP: Line 5: Accept-Encoding: gzip, deflate

HTTP: Line 6: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.

HTTP: 0)

HTTP: Line 7: Host: citrix.provo.novell.com

HTTP: Line 8: Connection: Keep-Alive

HTTP: Line 9: Cookie: icaClientCode=1; icaObjectCode=1; icaBrowserCode=1;

HTTP: icaScreenResolution=1280x1024; NFuseMode=NFuse%5FCurrentFold

HTTP: er=&NFuse%5FWindowType=seamless; NFuseUseSavedFolder=On; NFu

HTTP: seLogin=NFuse%5FLogonMode=Explicit; novell_language=en-us; i

HTTP: sFScommandSup=1; IPCZQX02f7d8ed19=54ddf24d0ce6c75faa33dd1c00

HTTP: 188103fdf175f8; ASPSESSIONIDSSSRSAAB=GLOHJPPBJNJHNGNGOGBJOPA

HTTP: F

HTTP: Line 10:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 2 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 2","0.001.539 ","[151.155.164.200] ","[137.65.159.181] "," 997 ","HTTP"," C Port=2315 GET /Citrix/NFuse17/launch.asp?NFuse_Application=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad HTTP/1.1"

DLC: Ethertype=0800, size=997 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=963 ID=57428

TCP: D=80 S=2315 ACK=376883539 SEQ=4200104649 LEN=943 WIN=64511

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: GET /Citrix/NFuse17/launch.asp?NFuse_Application=Wordpad&NFu

HTTP: se_AppFriendlyNameURLEncoded=Wordpad HTTP/1.1

HTTP: Line 2: Connection: keep-alive, TE

HTTP: Line 3: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,

HTTP: application/vnd.ms-powerpoint, application/vnd.ms-excel, ap

HTTP: plication/msword, application/x-shockwave-flash, */*

HTTP: Line 4: Referer: http://citrix.provo.novell.com/Citrix/NFuse17/appli

HTTP: st.asp?NFuse_currentFolder=

HTTP: Line 5: Accept-Language: en-us

HTTP: Line 6: Accept-Encoding: gzip, deflate

HTTP: Line 7: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.

HTTP: 0)

HTTP: Line 8: Host: citrix.provo.novell.com

HTTP: Line 9: Cookie: icaClientCode=1; icaObjectCode=1; icaBrowserCode=1;

HTTP: icaScreenResolution=1280x1024; NFuseMode=NFuse%5FCurrentFold

HTTP: er=&NFuse%5FWindowType=seamless; NFuseUseSavedFolder=On; NFu

HTTP: seLogin=NFuse%5FLogonMode=Explicit; novell_language=en-us; i

HTTP: sFScommandSup=1; ASPSESSIONIDSSSRSAAB=GLOHJPPBJNJHNGNGOGBJOP

HTTP: AF

HTTP: Line 10: TE: chunked, identity, deflate

HTTP: Line 11: Via: 1.1 ics_server.provo.novell.com (iChain 2.2.214d)

HTTP: Line 12:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 3 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 3","0.004.768 ","[137.65.159.181] ","[151.155.164.200] "," 506 ","HTTP"," R Port=2315 HTML Data"

DLC: Ethertype=0800, size=506 bytes

IP: D=[137.65.159.181] S=[151.155.164.200] LEN=472 ID=45206

TCP: D=2315 S=80 ACK=4200105592 SEQ=376883539 LEN=452 WIN=63569

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.1 302 Object moved

HTTP: Line 2: Server: Microsoft-IIS/5.0

HTTP: Line 3: Date: Wed, 21 Jan 2004 22:49:23 GMT

HTTP: Line 4: X-Powered-By: ASP.NET

HTTP: Line 5: Location: /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_A

HTTP: pplication=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&N

HTTP: Fuse_MIMEExtension=.ica

HTTP: Line 6: Content-Length: 121

HTTP: Line 7: Content-Type: text/html

HTTP: Line 8: Cache-control: private

HTTP: Line 9:

HTTP: Line 10: <head><title>Object moved</title></head>

HTTP: Line 11: <body><h1>Object Moved</h1>This object may be found <a HREF=

HTTP: "">here</a>.</body>

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 4 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 4","0.001.629 ","[137.65.159.179] ","[137.65.159.178] "," 630 ","HTTP"," R Port=1842 HTML Data"

DLC: Ethertype=0800, size=630 bytes

IP: D=[137.65.159.179] S=[137.65.159.178] LEN=596 ID=57940

TCP: D=1842 S=80 ACK=1601758544 SEQ=2644409152 LEN=576 WIN=11064

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.1 302 Object moved

HTTP: Line 2: Server: Microsoft-IIS/5.0

HTTP: Line 3: Date: Wed, 21 Jan 2004 22:49:23 GMT

HTTP: Line 4: X-Powered-By: ASP.NET

HTTP: Line 5: Location: /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_A

HTTP: pplication=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&N

HTTP: Fuse_MIMEExtension=.ica

HTTP: Line 6: Cache-Control: private

HTTP: Line 7: Content-Type: text/html

HTTP: Line 8: Content-Length: 121

HTTP: Line 9: Cache-Control: no-store

HTTP: Line 10: Cache-Control: no-cache

HTTP: Line 11: Pragma: no-cache

HTTP: Line 12: Via: 1.1 ics_server.provo.novell.com (iChain 2.2.214d)

HTTP: Line 13:

HTTP: Line 14: <head><title>Object moved</title></head>

HTTP: Line 15: <body><h1>Object Moved</h1>This object may be found <a HREF=

HTTP: "">here</a>.</body>

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 5 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 5","0.002.396 ","[137.65.159.178] ","[137.65.159.179] "," 1005 ","HTTP"," C Port=1843 GET /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_Application=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&NFuse_MIMEExtension=.ic..."

DLC: Ethertype=0800, size=1005 bytes

IP: D=[137.65.159.178] S=[137.65.159.179] LEN=971 ID=60812

TCP: D=80 S=1843 ACK=543276904 SEQ=1601827466 LEN=951 WIN=64512

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: GET /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_Applica

HTTP: tion=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&NFuse_M

HTTP: IMEExtension=.ica HTTP/1.1

HTTP: Line 2: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,

HTTP: application/vnd.ms-powerpoint, application/vnd.ms-excel, ap

HTTP: plication/msword, application/x-shockwave-flash, */*

HTTP: Line 3: Referer: http://citrix.provo.novell.com/Citrix/NFuse17/appli

HTTP: st.asp?NFuse_currentFolder=

HTTP: Line 4: Accept-Language: en-us

HTTP: Line 5: Accept-Encoding: gzip, deflate

HTTP: Line 6: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.

HTTP: 0)

HTTP: Line 7: Host: citrix.provo.novell.com

HTTP: Line 8: Connection: Keep-Alive

HTTP: Line 9: Cookie: icaClientCode=1; icaObjectCode=1; icaBrowserCode=1;

HTTP: icaScreenResolution=1280x1024; NFuseMode=NFuse%5FCurrentFold

HTTP: er=&NFuse%5FWindowType=seamless; NFuseUseSavedFolder=On; NFu

HTTP: seLogin=NFuse%5FLogonMode=Explicit; novell_language=en-us; i

HTTP: sFScommandSup=1; IPCZQX02f7d8ed19=54ddf24d0ce6c75faa33dd1c00

HTTP: 188103fdf175f8; ASPSESSIONIDSSSRSAAB=GLOHJPPBJNJHNGNGOGBJOPA

HTTP: F

HTTP: Line 10:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 6 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 6","0.001.501 ","[151.155.164.200] ","[137.65.159.181] "," 1038 ","HTTP"," C Port=2315 GET /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_Application=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&NFuse_MIMEExtension=.ic..."

DLC: Ethertype=0800, size=1038 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=1004 ID=58452

TCP: D=80 S=2315 ACK=376883991 SEQ=4200105592 LEN=984 WIN=65535

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: GET /Citrix/NFuse17/launch.asp?NFuse_UID=56963&NFuse_Applica

HTTP: tion=Wordpad&NFuse_AppFriendlyNameURLEncoded=Wordpad&NFuse_M

HTTP: IMEExtension=.ica HTTP/1.1

HTTP: Line 2: Connection: keep-alive, TE

HTTP: Line 3: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,

HTTP: application/vnd.ms-powerpoint, application/vnd.ms-excel, ap

HTTP: plication/msword, application/x-shockwave-flash, */*

HTTP: Line 4: Referer: http://citrix.provo.novell.com/Citrix/NFuse17/appli

HTTP: st.asp?NFuse_currentFolder=

HTTP: Line 5: Accept-Language: en-us

HTTP: Line 6: Accept-Encoding: gzip, deflate

HTTP: Line 7: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.

HTTP: 0)

HTTP: Line 8: Host: citrix.provo.novell.com

HTTP: Line 9: Cookie: icaClientCode=1; icaObjectCode=1; icaBrowserCode=1;

HTTP: icaScreenResolution=1280x1024; NFuseMode=NFuse%5FCurrentFold

HTTP: er=&NFuse%5FWindowType=seamless; NFuseUseSavedFolder=On; NFu

HTTP: seLogin=NFuse%5FLogonMode=Explicit; novell_language=en-us; i

HTTP: sFScommandSup=1; ASPSESSIONIDSSSRSAAB=GLOHJPPBJNJHNGNGOGBJOP

HTTP: AF

HTTP: Line 10: TE: chunked, identity, deflate

HTTP: Line 11: Via: 1.1 ics_server.provo.novell.com (iChain 2.2.214d)

HTTP: Line 12:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 7 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 7","0.060.619 ","[137.65.159.181] ","[151.155.164.200] "," 1220 ","HTTP"," R Port=2315 HTML Data"

DLC: Ethertype=0800, size=1220 bytes

IP: D=[137.65.159.181] S=[151.155.164.200] LEN=1186 ID=45241

TCP: D=2315 S=80 ACK=4200106576 SEQ=376883991 LEN=1166 WIN=64512

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.1 200 OK

HTTP: Line 2: Server: Microsoft-IIS/5.0

HTTP: Line 3: Date: Wed, 21 Jan 2004 22:49:23 GMT

HTTP: Line 4: X-Powered-By: ASP.NET

HTTP: Line 5: Content-Length: 942

HTTP: Line 6: Content-Type: application/x-ica

HTTP: Line 7: Expires: Thu, 15 Jan 2004 00:09:23 GMT

HTTP: Line 8: Cache-control: private

HTTP: Line 9:

HTTP: Line 10:

HTTP: Line 11:

HTTP: Line 12:

HTTP: Line 13:

HTTP: Line 14:

HTTP: Line 15: [Encoding]

HTTP: Line 16: InputEncoding=ISO8859_1

HTTP: Line 17:

HTTP: Line 18:

HTTP: Line 19:

HTTP: Line 20:

HTTP: Line 21:

HTTP: Line 22:

HTTP: Line 23:

HTTP: Line 24:

HTTP: Line 25: [WFClient]

HTTP: Line 26: Version=2

HTTP: Line 27: ClientName=ichai-administ-mxjln

HTTP: Line 28:

HTTP: Line 29: RemoveICAFile=yes

HTTP: Line 30:

HTTP: Line 31:

HTTP: Line 32: [ApplicationServers]

HTTP: Line 33: Wordpad=

HTTP: Line 34:

HTTP: Line 35: [Wordpad]

HTTP: Line 36: Address=151.155.164.200:1494

HTTP: Line 37: InitialProgram=#Wordpad

HTTP: Line 38: LongCommandLine=""

HTTP: Line 39: DesiredColor=2

HTTP: Line 40: TransportDriver=TCP/IP

HTTP: Line 41: WinStationDriver=ICA 3.0

HTTP: Line 42:

HTTP: Line 43:

HTTP: Line 44:

HTTP: Line 45: AutologonAllowed=ON

HTTP: Line 46: Username=administrator

HTTP: Line 47: Domain=\50F509C390716E7A

HTTP: Line 48: ClearPassword=60219357DD642A

HTTP: Line 49:

HTTP: Line 50:

HTTP: Line 51: ClientAudio=On

HTTP: Line 52:

HTTP: Line 53: DesiredHRES=640

HTTP: Line 54: DesiredVRES=480

HTTP: Line 55: TWIMode=On

HTTP: Line 56:

HTTP: Line 57:

HTTP: Line 58:

HTTP: Line 59:

HTTP: Line 60: SessionsharingKey=2-basic-basic-ichainfarm-administrator-iCh

HTTP: ainFarm

HTTP: Line 61:

HTTP: Line 62: [EncRC5-0]

HTTP: Line 63: DriverNameWin16=pdc0w.dll

HTTP: Line 64: DriverNameWin32=pdc0n.dll

HTTP: Line 65:

HTTP: Line 66: [EncRC5-40]

HTTP: Line 67: DriverNameWin16=pdc40w.dll

HTTP: Line 68: DriverNameWin32=pdc40n.dll

HTTP: Line 69:

HTTP: Line 70: [EncRC5-56]

HTTP: Line 71: DriverNameWin16=pdc56w.dll

HTTP: Line 72: DriverNameWin32=pdc56n.dll

HTTP: Line 73:

HTTP: Line 74: [EncRC5-128]

HTTP: Line 75: DriverNameWin16=pdc128w.dll

HTTP: Line 76: DriverNameWin32=pdc128n.dll

HTTP: Line 77:

HTTP: Line 78: [Compress]

HTTP: Line 79: DriverNameWin16=pdcompw.dll

HTTP: Line 80: DriverNameWin32=pdcompn.dll

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 8 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 8","0.003.801 ","[137.65.159.179] ","[137.65.159.178] "," 1038 ","HTTP"," R Port=1843 HTML Data"

DLC: Ethertype=0800, size=1038 bytes

IP: D=[137.65.159.179] S=[137.65.159.178] LEN=1004 ID=58964

TCP: D=1843 S=80 ACK=1601828417 SEQ=543276904 LEN=984 WIN=8112

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.1 200 OK

HTTP: Line 2: Server: Microsoft-IIS/5.0

HTTP: Line 3: Date: Wed, 21 Jan 2004 22:49:23 GMT

HTTP: Line 4: X-Powered-By: ASP.NET

HTTP: Line 5: Cache-Control: private

HTTP: Line 6: Content-Type: application/x-ica

HTTP: Line 7: Content-Length: 1104

HTTP: Line 8: Via: 1.1 ics_server.provo.novell.com (iChain 2.2.214d)

HTTP: Line 9:

HTTP: Line 10:

HTTP: Line 11:

HTTP: Line 12:

HTTP: Line 13:

HTTP: Line 14:

HTTP: Line 15: [Encoding]

HTTP: Line 16: InputEncoding=ISO8859_1

HTTP: Line 17:

HTTP: Line 18:

HTTP: Line 19:

HTTP: Line 20:

HTTP: Line 21:

HTTP: Line 22:

HTTP: Line 23:

HTTP: Line 24:

HTTP: Line 25: [WFClient]

HTTP: Line 26: ProxyHost=citrix2.provo.novell.com:80

HTTP: Line 27: ProxyType=Secure

HTTP: Line 28: ProxyUsername=5487e3deece6e46bfe39c82d

HTTP: Line 29: ProxyPassword=150c40ce5efbc3b5d562e70377c38ad500aa9922

HTTP: Line 30: Version=2

HTTP: Line 31: ClientName=ichai-administ-mxjln

HTTP: Line 32:

HTTP: Line 33: RemoveICAFile=yes

HTTP: Line 34:

HTTP: Line 35:

HTTP: Line 36: [ApplicationServers]

HTTP: Line 37: Wordpad=

HTTP: Line 38:

HTTP: Line 39: [Wordpad]

HTTP: Line 40: Address=citrix2.provo.novell.com:1494

HTTP: Line 41: InitialProgram=#Wordpad

HTTP: Line 42: LongCommandLine=""

HTTP: Line 43: DesiredColor=2

HTTP: Line 44: TransportDriver=TCP/IP

HTTP: Line 45: WinStationDriver=ICA 3.0

HTTP: Line 46:

HTTP: Line 47:

HTTP: Line 48:

HTTP: Line 49: AutologonAllowed=ON

HTTP: Line 50: Username=administrator

HTTP: Line 51: Domain=\50F509C390716E7A

HTTP: Line 52: ClearPassword=60219357DD642A

HTTP: Line 53:

HTTP: Line 54:

HTTP: Line 55: ClientAudio=On

HTTP: Line 56:

HTTP: Line 57: DesiredHRES=640

HTTP: Line 58: DesiredVRES=480

HTTP: Line 59: TWIMode=On

HTTP: Line 60:

HTTP: Line 61:

HTTP: Line 62:

HTTP: Line 63:

HTTP: Line 64: SessionsharingKey=2-basic-basic-ichainfarm-administrator-iCh

HTTP: ainF

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 9 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 9","0.000.233 ","[137.65.159.179] ","[137.65.159.178] "," 415 ","HTTP"," R Port=1843 HTML Data"

DLC: Ethertype=0800, size=415 bytes

IP: D=[137.65.159.179] S=[137.65.159.178] LEN=381 ID=59220

TCP: D=1843 S=80 ACK=1601828417 SEQ=543277888 LEN=361 WIN=8112

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: arm

HTTP: Line 2:

HTTP: Line 3: [EncRC5-0]

HTTP: Line 4: DriverNameWin16=pdc0w.dll

HTTP: Line 5: DriverNameWin32=pdc0n.dll

HTTP: Line 6:

HTTP: Line 7: [EncRC5-40]

HTTP: Line 8: DriverNameWin16=pdc40w.dll

HTTP: Line 9: DriverNameWin32=pdc40n.dll

HTTP: Line 10:

HTTP: Line 11: [EncRC5-56]

HTTP: Line 12: DriverNameWin16=pdc56w.dll

HTTP: Line 13: DriverNameWin32=pdc56n.dll

HTTP: Line 14:

HTTP: Line 15: [EncRC5-128]

HTTP: Line 16: DriverNameWin16=pdc128w.dll

HTTP: Line 17: DriverNameWin32=pdc128n.dll

HTTP: Line 18:

HTTP: Line 19: [Compress]

HTTP: Line 20: DriverNameWin16=pdcompw.dll

HTTP: Line 21: DriverNameWin32=pdcompn.dll

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 10 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 10","6.566.079 ","[137.65.159.180] ","[137.65.159.179] "," 133 ","HTTP"," C Port=1845 CONNECT 137.65.159.180:1494 HTTP/1.0"

DLC: Ethertype=0800, size=133 bytes

IP: D=[137.65.159.180] S=[137.65.159.179] LEN=99 ID=60821

TCP: D=80 S=1845 ACK=3914937487 SEQ=1605255586 LEN=79 WIN=64512

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: CONNECT 137.65.159.180:1494 HTTP/1.0

HTTP: Line 2: Host: 137.65.159.180:1494

HTTP: Line 3: Accept:*/*

HTTP: Line 4:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 11 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 11","0.001.542 ","[137.65.159.179] ","[137.65.159.180] "," 1038 ","HTTP"," R Port=1845 HTML Data"

DLC: Ethertype=0800, size=1038 bytes

IP: D=[137.65.159.179] S=[137.65.159.180] LEN=1004 ID=62548

TCP: D=1845 S=80 ACK=1605255665 SEQ=3914937487 LEN=984 WIN=6065

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.0 407 Proxy Authentication Required

HTTP: Line 2: Content-Type: text/html; charset=utf-8

HTTP: Line 3: Content-Length: 1527

HTTP: Line 4: Pragma: no-cache

HTTP: Line 5: Proxy-Authenticate: Basic realm="iChain-ICA"

HTTP: Line 6:

HTTP:

HTTP: [812 bytes of Graphics Data]

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 12 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 12","0.000.208 ","[137.65.159.179] ","[137.65.159.180] "," 769 ","HTTP"," R Port=1845 HTML Data"

DLC: Ethertype=0800, size=769 bytes

IP: D=[137.65.159.179] S=[137.65.159.180] LEN=735 ID=62804

TCP: D=1845 S=80 FIN ACK=1605255665 SEQ=3914938471 LEN=715 WIN=6065

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: black" face="Comic Sans MS">Status</font></b>

HTTP: Line 2: <font color="#ff0033" face="Comic Sans MS"><b>: </b></fo

HTTP: nt><font color="black" face="Comic Sans MS">407 Proxy Authen

HTTP: tication Required </font>

HTTP: Line 3: </p>

HTTP: Line 4: <p align="left">

HTTP: Line 5: <font color="black" face="Comic Sans MS"><b>Description<

HTTP: /b></font><0909>

HTTP: Line 6: <font color="#ff0033" face="Comic Sans MS"><b>: </b></fo

HTTP: nt><font color="black" face="Comic Sans MS">Access to this p

HTTP: age is restricted because of access control policies.</font>

HTTP:

HTTP: Line 7: </p>

HTTP: Line 8: <br>

HTTP: Line 9: <br>

HTTP: Line 10: </font></td>

HTTP: Line 11: </tr>

HTTP: Line 12: <tr>

HTTP: Line 13: <td width="444" height="10" align="center"><img height="

HTTP: 8" width="445" src="ICHAINErrors/alertbar.gif"></td>

HTTP: Line 14: </tr>

HTTP: Line 15: </table>

HTTP: Line 16: </center></div>

HTTP: Line 17: </body>

HTTP: Line 18: </html>

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 13 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 13","0.008.158 ","[137.65.159.180] ","[137.65.159.179] "," 274 ","HTTP"," C Port=1846 CONNECT 137.65.159.180:1494 HTTP/1.0"

DLC: Ethertype=0800, size=274 bytes

IP: D=[137.65.159.180] S=[137.65.159.179] LEN=240 ID=60825

TCP: D=80 S=1846 ACK=4273213228 SEQ=1605326461 LEN=220 WIN=64512

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: CONNECT 137.65.159.180:1494 HTTP/1.0

HTTP: Line 2: Host: 137.65.159.180:1494

HTTP: Line 3: Accept:*/*

HTTP: Line 4: Connection: Keep-Alive

HTTP: Line 5: Proxy-Authorization: Basic NTQ4N2UzZGVlY2U2ZTQ2YmZlMzljODJkO

HTTP: jE1MGM0MGNlNWVmYmMzYjVkNTYyZTcwMzc3YzM4YWQ1MDBhYTk5MjI=

HTTP: Line 6:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 14 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 14","0.001.142 ","[151.155.164.200] ","[137.65.159.181] "," 62 ","TCP"," D=1494 S=2426 SYN SEQ=3806428749 LEN=0 WIN=6144"

DLC: Ethertype=0800, size=62 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=28 ID=64340

TCP: D=1494 S=2426 SYN SEQ=3806428749 LEN=0 WIN=6144

- - - - - - - - - - - - - - - - - - - - Frame 15 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 15","0.001.087 ","[137.65.159.181] ","[151.155.164.200] "," 62 ","TCP"," D=2426 S=1494 SYN ACK=3806428750 SEQ=485247106 LEN=0 WIN=64512"

DLC: Ethertype=0800, size=62 bytes

IP: D=[137.65.159.181] S=[151.155.164.200] LEN=28 ID=45262

TCP: D=2426 S=1494 SYN ACK=3806428750 SEQ=485247106 LEN=0 WIN=64512

- - - - - - - - - - - - - - - - - - - - Frame 16 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 16","0.000.161 ","[137.65.159.179] ","[137.65.159.180] "," 93 ","HTTP"," R Port=1846 HTML Data"

DLC: Ethertype=0800, size=93 bytes

IP: D=[137.65.159.179] S=[137.65.159.180] LEN=59 ID=64596

TCP: D=1846 S=80 ACK=1605326681 SEQ=4273213228 LEN=39 WIN=5924

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: Line 1: HTTP/1.0 200 Connection established

HTTP: Line 2:

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 17 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 17","0.000.196 ","[151.155.164.200] ","[137.65.159.181] "," 60 ","TCP"," D=1494 S=2426 ACK=485247107 WIN=6144"

DLC: Ethertype=0800, size=60 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=20 ID=64852

TCP: D=1494 S=2426 ACK=485247107 WIN=6144

- - - - - - - - - - - - - - - - - - - - Frame 18 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 18","0.166.327 ","[137.65.159.180] ","[137.65.159.179] "," 60 ","TCP"," D=80 S=1846 ACK=4273213267 WIN=64473"

DLC: Ethertype=0800, size=60 bytes

IP: D=[137.65.159.180] S=[137.65.159.179] LEN=20 ID=60826

TCP: D=80 S=1846 ACK=4273213267 WIN=64473

- - - - - - - - - - - - - - - - - - - - Frame 19 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 19","3.006.850 ","[137.65.159.181] ","[151.155.164.200] "," 62 ","TCP"," D=2426 S=1494 SYN (Retransmission of Frame 15) ACK=3806428750 SEQ=485247106 LEN=0 WIN=64512"

DLC: Ethertype=0800, size=62 bytes

IP: D=[137.65.159.181] S=[151.155.164.200] LEN=28 ID=45280

TCP: D=2426 S=1494 SYN (Retransmission of Frame 15) ACK=3806428750 SEQ=485247106 LEN=0 WIN=64512

- - - - - - - - - - - - - - - - - - - - Frame 20 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 20","0.001.051 ","[151.155.164.200] ","[137.65.159.181] "," 60 ","TCP"," D=1494 S=2426 ACK=485247107 WIN=6144"

DLC: Ethertype=0800, size=60 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=20 ID=85

TCP: D=1494 S=2426 ACK=485247107 WIN=6144

- - - - - - - - - - - - - - - - - - - - Frame 21 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 21","0.001.718 ","[137.65.159.181] ","[151.155.164.200] "," 60 ","TCP"," D=2426 S=1494 ACK=3806428750 SEQ=485247107 LEN=6 WIN=64512"

DLC: Ethertype=0800, size=60 bytes

IP: D=[137.65.159.181] S=[151.155.164.200] LEN=26 ID=45281

TCP: D=2426 S=1494 ACK=3806428750 SEQ=485247107 LEN=6 WIN=64512

- - - - - - - - - - - - - - - - - - - - Frame 22 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 22","0.000.165 ","[151.155.164.200] ","[137.65.159.181] "," 60 ","TCP"," D=1494 S=2426 ACK=485247113 WIN=6138"

DLC: Ethertype=0800, size=60 bytes

IP: D=[151.155.164.200] S=[137.65.159.181] LEN=20 ID=341

TCP: D=1494 S=2426 ACK=485247113 WIN=6138

- - - - - - - - - - - - - - - - - - - - Frame 23 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 23","0.000.177 ","[137.65.159.179] ","[137.65.159.180] "," 60 ","HTTP"," R Port=1846 Graphics Data"

DLC: Ethertype=0800, size=60 bytes

IP: D=[137.65.159.179] S=[137.65.159.180] LEN=26 ID=597

TCP: D=1846 S=80 ACK=1605326681 SEQ=4273213267 LEN=6 WIN=5924

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: [6 bytes of Graphics Data]

HTTP:

- - - - - - - - - - - - - - - - - - - - Frame 24 - - - - - - - - - - - - - - - - - - - -

\"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"

" "," 24","0.000.447 ","[137.65.159.180] ","[137.65.159.179] "," 60 ","HTTP"," C Port=1846 Graphics Data"

DLC: Ethertype=0800, size=60 bytes

IP: D=[137.65.159.180] S=[137.65.159.179] LEN=26 ID=60828

TCP: D=80 S=1846 ACK=4273213273 SEQ=1605326681 LEN=6 WIN=64467

HTTP: ----- Hypertext Transfer Protocol -----

HTTP:

HTTP: [6 bytes of Graphics Data]

HTTP:

Options

FormFill profile TAGs

Enhanced Data Security (<maskedPost/>)

JavaScript (<javaScript> and <scriptForPost>)

Case Conversion (“ff_lower_upper”)

Form Number (“formnum”)

Because it is difficult for users to change the Web application, Form Fill provides the “ff_lower_upper option” for input fields.

If this option is missing or the field value is neither upper nor lower case, Form Fill will not perform a conversion (it will maintain the value’s original case).

Form Fill supports JavaScript functions in the HTML login page with the new <javaScript> and <scriptForPost> tags.

EXAMPLE: In the login form there is a <form> tag:

<form onsubmit="do_function()" method="post” ...>

then the “do_function()” will never be executed.

… because of: "document.form[0].submit()"

If nothing between start and end tags, Form Fill will keep ALL Java scripts

Otherwise, it will keep them selectively.

Example 1: Keeping ALL Java scripts:

<javaScript>

</javaScript>

Example 2: Keeping Java scripts only for function abc():

<javaScript>

function abc()

</javaScript>

If there is nothing between start and end tags, Form Fill copies the onsubmit function

Otherwise, it copies whatever (should be statements of JavaScript) and puts it before document.forms[0].submit()

Example 1: Copying the onsubmit function:

<scriptForPost>

</scriptForPost>

In this example, the portion of the login form (on the browser side) will be:

<script language="javaScript">

<!-

do_function();

document.forms[0].submit();

//-->

</script>

Example 2: Copying customized scripts (ignoring the onsubmit function):

<scriptForPost>

var d = new Date();

document.login.timezone.value =

d.getTimezoneOffset();

</scriptForPost>

In this example, the portion of the login form (on the browser side) will be:

<script language="javaScript">

<!-

var d = new Date();

document.login.timezone.value =

d.getTimezoneOffset();

document.forms[0].submit();

//-->

</script>

Modify local HOSTS file to inject correct HOST header when troubleshooting

With iChain 2.3, rewriter now has the ability to handle multiple sub-path match strings on a single pbmh accelerator. This is useful for app's like iPrint (/ipp + /ippdocs), Virtual Office (/nps + /vo), iFolderAdmin (/iFolder + /iFolderServer), NetStorage (/NetStorage +/oneNet), and GroupWise Webaccess (/servlet + /com).

Below is a sample rewriter.cfg used with this feature. The entries under [Alias Host Names] are the sub-path match strings serviced by each pbmh accelerator in addition to the path defined on the accelerator's "Multi-homing Options" page.

[Alias Host Names]

#syntax: <AcceleratorName>=/<AdditionalSubPath>

nps=/vo

ifadmin=/iFolder

ipp=/ippdocs

netstore=/oneNet

gwise1=/com

Rewriter enhancement to support multiple back-end schemes and ports on a single accelerator

This feature is useful for web servers and applications which listen on multiple ports and may return URL references to any of these ports. Without the rewriter enhancement, multiple accelerators would be required. With the enhancement, a single accelerator can be used because rewriter can be configured to update URL references using multiple schemes and ports to the DNS name of the accelerator.

2003-12-08T12:43:39