Traffic Logging of RDP traffic-is it possible?

[Kiwisimon]

A client has had installed a new Fortigate 60D. All latest firmware is applied.

They are currently using RDP connections ( 6-7 users) to access a hosted application across a very high speed (dark fiber) connection and are experiencing severe slowdown of the connection to access the medical database. The slowdown at its worst takes about 10 mins to come right and at its best takes about 1 min to clear. It is intermittent but will occur about 3-4 times a day.. I seriously doubt the Fortigate to be at fault but I was wondering if any of you gurus out there might be able to tell me if it is possible to make a record of this slowdown from inside the firewall in the hope that we can provide evidence to the medical host that their denials of poor performance are full of s**t.

Getting to the point now where we have changed everything but are still getting the slowdowns and with a fibre connection that bursts above 1GB I don't see how it can be anything else except poor server performance at their end.

signed

Pi**ed off of Maybury  :)

Here is an example of their standard answer to my client

"Hello Helen

There are currently no issues with Houston’s Fibre connection.

There might be an issue with your sites connection.

Support Team

"

[Shawn_W]

Any update?

[Christopher_McMullan]

Probably the simplest way to prove your point would be if you could run a packet capture at the time of the slowdown (could you start a second session for testing while the first session slows down?).

Find out the current IP of the server your internal client is contacting at the time, if it is dynamic, or else just enter it if it is known and fixed:

diag sniffer packet any "host w.x.y.z and port 3389" 4

If RDP traffic is the one affected protocol, this would show the timestamp for each packet: look for large gaps in the elapsed time between one packet and the next. See where the latency is being introduced. Verbosity level 4 in the sniff will show you not only the source and destination socket and protocol, but also the interface and direction the packet was detected on (i.e., WAN1 in, internal out, etc.).