UltraVNC Server-Client Pairs Sending Unknown Server Message Types: Troubleshooting Guide
When trying to write a VNC proxy application that records RFB traffic passing between a VNC server and client, you may encounter issues where UltraVNC server-client pairs are sending unknown server message types. This troubleshooting guide will cover key concepts and provide detailed context on the topic, with subtitles, paragraphs, and code blocks to help you better understand and resolve the issue.
Understanding VNC and RFB Protocol
VNC (Virtual Network Computing) is a remote desktop protocol that allows users to control one computer from another over a network. RFB (Remote Frame Buffer) is the protocol used for communication between VNC client and server. The RFB protocol uses a client-server architecture, where the server sends updates of the display to the client, which then sends back user input events.
Unknown Server Message Types
In the context of UltraVNC, unknown server message types may occur when there is a mismatch between the client and server's understanding of the RFB protocol. This may be due to various reasons such as version incompatibility, custom message types, or bugs in the implementation. These unknown message types can cause issues with the proper functioning of the VNC session and may need to be addressed for successful recording of RFB traffic.
Analyzing RFB Traffic with Wireshark
To investigate unknown server message types, you can use a network protocol analyzer such as Wireshark to capture and analyze the RFB traffic between the VNC client and server. This will help you identify the unknown message types and their frequency of occurrence.
$ tshark -i eth0 -Y "rfb.version == 3.8" -T fields -e rfb.message_type -E separator=/t -e data.data
1527114167.672332 3.8 /set_deflate 3
1527114167.672411 3.8 /bell
1527114167.724534 3.8 /frame_buffer_update 287568 0 17351 1 23 3 23 3 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 1 23 3 /cut_text 4984 13
Handling Unknown Message Types in your Proxy Application
Once you have identified the unknown message types, you will need to handle them in your proxy application. One way to do this is to log the unknown message types for further analysis and then forward them to the appropriate recipient. This can be done using a switch-case structure or a similar approach.
void handle_rfb_message(rfbMessage* msg) {
switch (msg->messageType) {
case RFB_MESSAGE_SET_DEFLATE:
handle_set_deflate(msg);
break;
case RFB_MESSAGE_CUT_TEXT:
handle_cut_text(msg);
break;
case RFB_MESSAGE_UNKNOWN:
default:
// Log the unknown message type for further analysis
log_unknown_message(msg);
// Forward the message to the appropriate recipient
forward_rfb_message(msg);
break;
}
}
References:
- VNC Protocol, https://www.realvnc.com/docs/rfb-protocol.pdf
- UltraVNC, https://www.ultravnc.net/
- Wireshark, https://www.wireshark.org/
This article has provided an overview of troubleshooting UltraVNC Server-Client pairs sending unknown server message types. By understanding the VNC protocol, analyzing RFB traffic, and handling unknown message types in your proxy application, you can successfully record RFB traffic passing between VNC server and client.