Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Understanding TCP Reverse Connect Flow for AVD using Event Logs

Understanding TCP Reverse Connect Flow for AVD using Event Logs

Written By Anoop C Nair
Last Updated June 25, 2024
Posted In AVD
SHARE

You can Understand the TCP Reverse Connect Flow for AVD using Event Logs. Let’s quickly review the WVD event logs using TCP Reverse Connect technologies. You can also check this internal process of RDP connection through the secure channel from Windows 10 devices.

In the previous post, I have a WVD Troubleshooting Options Tips Tricks – Windows Virtual Desktop. There could be many ways to perform WVD troubleshooting as per Microsoft docs.

I’m going to share my experience in this blog post. I was analysing TCP Reverse connect technology used in WVD using the event logs (Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV/Operational).

Reverse TCP (Transmission Control Protocol) is a form of network communication where a connection is initiated from the target system to the attacker’s system instead of vice versa.

Patch My PC
Index
WVD TCP Reverse Connect Technology
WVD Related Events Logs Event ID 229
Adding Additional Headers
Contacting WVD RD Gateway
Connecting to the Nearest Azure Backbone
TCP Reverse Connect Completed
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Table 1

WVD TCP Reverse Connect Technology

For the WVD TCP reverse connect technology, we don’t need to open any inbound ports, even the default RDP port, TCP/3389. Instead, an agent creates an outbound connection using TCP/443 into the WVD management plane. Azure is your reverse proxy for RDP traffic.

The following diagram explains the connection details. It might help you understand the WVD event log flow.

Understanding TCP Reverse Connect Flow for AVD using Event Logs - Fig.1
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Fig.1

All the following events are taken from Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV/Operational.

CUM RDP Listener Reverse Connect Tcp Udp

‘Got connection for named pipe’ in CUMRDPListenerReverseConnectTcpUdp::OnNamedPipeConnectionCompleted at 5172 err=[0x0]

Reverse TCP Connect Context

‘ReverseTCPConnectContext::HandleRequest’ in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::HandleRequest at 4970 err=[0x0]

Adding Additional Headers

Adding an extra header to secure authentication.

Understanding TCP Reverse Connect Flow for AVD using Event Logs - Fig.2
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Fig.2

‘Adding extra header ‘Cookie’=’ARRAffinity=f0ae4aa2de7044dc11cff22d08a382782347f334ad1816b1aa6f1a6e6d72” in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::HandleRequest at 5034 err=[0x0]

Adding extra header ‘ms-wvd-activity-hint’

‘Adding extra header ‘ms-wvd-activity-hint’=’ms-wvd-hp:99c34ceb-9ed1-41a2-c9ea-08d86484831” in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::HandleRequest at 5034 err=[0x0]

Adding extra header ‘X-MS-User-Agent’=’com.microsoft.wvd.agent to get authenticated with WVD RD gateway.

‘Adding extra header ‘X-MS-User-Agent’=’com.microsoft.wvd.agent/1.0.2116.3600” in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::HandleRequest at 5034 err=[0x0]

Contacting WVD RD Gateway

Contacting the nearest WVD RD Gateway in Singapore https://rdgateway-c101-sin-r1.wvd.microsoft.com/

Understanding TCP Reverse Connect Flow for AVD using Event Logs - Fig.3
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Fig.3

‘Starting Reverse Connect GUID=’b13d33bf-e7b1-42u3-b347-f80a7ef98765′ URI=’https://rdgateway-c101-sin-r1.wvd.microsoft.com/api/v2/Connections/reverse/b16dh33bf-e7b1-42e0-b347-f80a7ef12745?RDmiGatewayToken=CfDJ8CK-Jasjdajdhasjkdhby7-g3b2okHpyasdkjuS1_NasdkiJG

Resolving the Name of WVD RD Gateway – DNS?

‘WINHTTP_CALLBACK_STATUS_RESOLVING_NAME name=’rdgateway-c101-sin-r1.wvd.microsoft.com” in CHttpIoRequestWinHttp::StatusCallback at 2528 err=[0x0]

Resolved the Name of WVD RD Gateway to IP

‘WINHTTP_CALLBACK_STATUS_NAME_RESOLVED name=’104.211.242.104′‘ in CHttpIoRequestWinHttp::StatusCallback at 2512 err=[0x0]

Understanding TCP Reverse Connect Flow for AVD using Event Logs - Fig.4
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Fig.4

Connecting to the Nearest Azure Backbone

Now Connecting to Nearest Azure Backbone (?) to Reach the VM – From south India it’s reaching out Azure Chennai Region?

‘WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER IP=’104.211.242.104′‘ in CHttpIoRequestWinHttp::StatusCallback at 2520 err=[0x0]

‘WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER IP=’104.211.242.104” in CHttpIoRequestWinHttp::StatusCallback at 2516 err=[0x0]

TCP Reverse Connect Completed

Reverse connect succeeded – TCP reverse connect completed for WVD completed.

‘Closing Request Handle=0x6e559840‘ in CHttpIoRequestWinHttp::WebSocketCompleteUpgrade at 1972 err=[0x0]

‘Sending reply to WVD Agent. Reverse connect succeeded.‘ in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::OnConnectionCompleted at 5106 err=[0x0]

Understanding TCP Reverse Connect Flow for AVD using Event Logs - Fig.5
Understanding TCP Reverse Connect Flow for AVD using Event Logs – Fig.5

‘Reverse connection (websocket) successfully completed‘ in CUMRDPListenerReverseConnectTcpUdp::OnConnectionCompleted at 5257 err=[0x0]

‘OnConnectionCompleted(TCP reverse connect completed)’ in CUMRDPListenerReverseConnectTcpUdp::OnConnectionCompleted at 5338 err=[0x0]

‘Set RDPTransportMode to TCP+UDP.‘ in CUMRDPListenerReverseConnectTcpUdp::OnConnectionCompleted at 5382 err=[0x0]

ReverseTCPConnectContext

‘Sending reply to WVD Agent. Reverse connect succeeded.’ in CUMRDPListenerReverseConnectTcpUdp::ReverseTCPConnectContext::OnConnectionCompleted at 5106 err=[0x0]

CUMRDPListenerReverseConnectTcpUdp
‘UDP port number for SxS stack not set. UDP listener won’t be enabled.’ in CUMRDPListenerReverseConnectTcpUdp::GetUdpPort at 4703 err=[0x0]

CUMRDPListenerReverseConnectTcpUdp
‘Reverse connection (websocket) successfully completed‘ in CUMRDPListenerReverseConnectTcpUdp::OnConnectionCompleted at 5257 err=[0x0]

Resources

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His primary focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

AVD

Windows 365 Frontline is Now Windows 365 Flex with No Change to Features or Licensing

Key Takeaways Windows 365 Frontline is Now Windows 365 Flex with No Change to Features or Licensing! Hey, let’s discuss about Windows 365 and Azure Virtual Desktop Expanding Access to Cloud Windows for Every Workstyle. The way people work is evolving, and so are cloud-delivered Windows solutions. From small businesses to enterprises and shift workers, […]

AC Anoop C Nair 4 min read
AVD

How RDP Multipath Improves Azure Virtual Desktop Connectivity Using Dynamic UDP Path Selection

Key Takeaways How RDP Multipath Improves Azure Virtual Desktop Connectivity Using Dynamic UDP Path Selection! RDP Multipath creates multiple connection paths between your device and the remote desktop instead of relying on just one. It continuously checks which path is performing best and automatically switches if one becomes slow or drops. This ensures a smoother […]

AC Anoop C Nair 4 min read
AVD

Resilient Connectivity Architecture with Multiple Service Instances in Azure

Key Takeaways Resilient Connectivity Architecture with Multiple Service Instances in Azure! This architecture helps IT administrators by providing a more reliable and scalable connectivity platform for cloud services. Because multiple service instances run independently within each region, the platform can continue operating even if one component fails. This reduces service disruptions and ensures that users […]

AC Anoop C Nair 3 min read