To determine the necessary custom configuration for an application to communicate through Proxy Server, you need to do the followng five procedures in this order (these procedures are explained in detail later in this article):
- Determine whether the application uses Winsock or Web Proxy.
- Install Network Monitor on the Proxy Server.
- Capture and analyze the network traffic to determine the needs of the application.
- Configure the necessary protocol definitions or static custom packet filters.
- Test the application.
Determine Whether the Application Uses Winsock or Web ProxyMany applications provide support for use with a Proxy Server. A good example of this is Microsoft Internet Explorer. Internet Explorer can be configured to use a Proxy Server through the connection settings in Internet Options. Applications that are configured to use a proxy server use the Web Proxy to communicate through the Proxy. These applications should require only that the proper Proxy Server information be entered in order for the Web Proxy to handle the application's requests.
Applications that have no feature to use a Proxy Server may also be able to communicate through Proxy Server. These applications use the Proxy Server's Winsock Proxy. In order for this to work properly, the application must use Winsock for communication and the client computer hosting the application must have the Winsock Proxy Client properly installed. To install the Winsock Proxy Client on a Proxy Server's client computer, follow these steps:
- Run Setup.exe from the \\<servername>\mspclnt share, or use the browser to go to http://<servername>/msproxy.
- After the Winsock Proxy Client installation is complete, open a command prompt.
- Change directories to the \mspclnt folder, usually at c:\mspclnt.
- Type the following command chkwsp32 /fand then press ENTER.
Install the Network Monitor Tools and Agent on the Proxy Server
- Right-Click Network Neighborhood, and then click Properties.
- On the Services tab, click Add.
- Click Network Monitor Tools and Agent, and then click OK.
- Close the Network Properties dialog box, and restart the computer when prompted.
For additional information about Network Monitor, click the article number below to view the article in the Microsoft Knowledge Base:
Capture Network Traffic from the Client Computer
- Click Start, point to Programs, point to Administrative Tools, and then click Network Monitor.NOTE: If you use the version of Network Monitor that is included in SMS, start Network Monitor this way: click Start, point to Programs, point to Network Analysis Tools, and then click Network Monitor.
- On the Capture menu, click Networks.
- Double-click the server's internal network interface.
- To start the capture, click the Play button on the toolbar, or click Start on the Capture menu.
- Attempt to connect to the Internet using the Client application from the Client computer.
- Once the attempt fails from the Client computer, stop the capture: click the
Stop button on the toolbar, click Stop on the Capture menu.
- To view the capture, click the "eyeglasses" button on the toolbar, or click Display Captured Data on the Capture menu.NOTE: On exceptionally busy networks, you may have to click Buffer Settings on the Capture menu, and increase the amount of memory used for the buffer to make sure you do not lose any packets.
Analyze Network Traffic
The following is an example of a Network Monitor trace that was used to determine Protocol Definitions for a Winsock Application. Network Monitor interprets the TCP header information and displays it as follows:
The following is a brief description of each header component:
TCP: ....S., len: 0, seq: 28201-298201, ack: 0, win: 8192, src: 1124 dst: 443
TCP = Type of Frame
S = SYN flag, used at the beginning of the connection setup to establish sequence and acknowledgement numbers.
len = Header length, Data offset
seq = Sequence number, used to indicate the sequence number corresponding to the first octet in this segment or frame.
ack = acknowledgement number, significant only if the Ack flag is set
win = TCP Window size
src = Source Port
dst = Destination Port
Configure Protocol DefinitionBecause the sample frame above shows the application making a request to the Destination, TCP port 443, from the Source, TCP port 1124, the Protocol Definition would be configured as follows:
In this case, because the request was made to port 443, the reply would be sent back from port 443 to the originating port of 1124. The resulting configuration includes Port Ranges for subsequent connections to allow reply traffic from the external server. To configure the Protocol Definition described in the example above, follow these steps:
Protocol Name: CustomApp
Initial Connection: Port 443
Port Ranges for subsequent connections:
- Click the Protocols tab in the Winsock Proxy Service Properties dialog box.
- Click the Add button.
- Type the protocol name.
- Choose the port type and direction.
- Under port ranges for subsequent connections, click Add.
- Fill in the Port Range fields, and then select the type and direction.
- Click OK until you return to the Microsoft Management Console, and then stop and restart the Winsock Proxy.
Configure Custom Static Packet FiltersCustom static packet filters are only required if the application resides on the server. A static packet filter is one that has been manually configured. Once a Static Packet Filter is enabled for a particular port, that port is open to anyone on the External Interface. The fewer ports and services open on the External Interface, the fewer the chances of external attacks. For more information about Security, see the following Web site:
If an application must be run on the Proxy Server, configure a custom static packet filter:
- In the Winsock Proxy Server Properties dialog box, click the Security button.
- In the Security dialog box, on the Packet Filters tab, click Add.
- Click Custom Filter and define the custom filter.
- Select the protocol to use.
- Select the direction of packets that this filter will apply to.
- Select the port on the Proxy Server that the application will use.
- Select the port on the remote host that the application will use.NOTE: If the application uses a fixed port for outbound packets, and a dynamic port for inbound packets, it may be necessary to define two filters, one for each direction.
- To select the local host computer that will exchange packets with a remote host computer, under Local host, do one of the following:
- To allow the default IP address for each external interface of the Proxy Server computer to exchange packets, click Default Proxy external IP addresses.
- To allow a specific IP address for an external interface of the Proxy Server computer to exchange packets, click Specific Proxy IP, and type a valid IP address.
- To allow a specific internal computer behind Proxy Server to exchange packets, click Internal computer, and type a valid IP address.
- To allow a specific Internet (remote) host computer to exchange packets, under Remote host, click Single host and type a valid IP address. Or, to allow any Internet (remote) host computer to exchange packets, click Any host.
- Click OK.
The Internet Assigned Numbers Authority documents protocol numbers and assignment services at the following Web site: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Artikelnummer: 256145 – Letzte Überarbeitung: 31.10.2006 – Revision: 1