TermDD - Error 50

Question

I am getting the following error in the Event Log of a machine running Server 2008 R2:

"The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client."

Source: TermDD Event ID: 50

I get about 5 of these per 24 hour period.

The machine is a web server. It is exposed to the outside world, but only port 80 is open to it.

I have some concern that this is the result of attempts at hacking the machine via Remote Desktop, but I can't fathom how that'd be possible with only port 80 open.

And additional reason I'm concerned about malicious intent, is that I had the site hosted on a different 2008 R2 machine, it showed these log events. Then I changed the IP forwarding rules in my router, sent external traffic to the new machine, and it began showing the log events.

There's no problem with Remote Desktop, it works normally, and is actually how I interact with these machines, there are no disconnections going on.

Any suggestions as to what might be going on?

Solution

With only port 80 exposed to the 'net it's not likely that these are actual connection attempts against the RDP server. I'd try and find some correlation between your authorized RDP connection attempts. Presumably you're connecting to a back-end LAN or VPN from which RDP is allowed, so you should also be sure that there aren't unauthorized parties there attempting to make RDP connection attempts to the server computers.

If you don't make any headway with those suggestions, sniff the traffic on the box for a day w/ a capture filter set to only record RDP traffic and see what you can find and correlate to event log entries.

Comments

[Jack]

I am the only person using RDP, and I typically leave the Remote Desktop window open to the machine all the time on my workstation. I tried closing it and leaving it off for a day, but the events still showed up. I do like your idea about watching the packets for a day, though. I already have Wireshark on the machine, so I will give that a shot.

[Jack]

I let Wireshark run for a time, and it turns out South Koreans were trying to RDP into my server. This is possible because the garbage router that Comcast gave me was allowing all ports through, despite having a rule to only do 80.