Can You Capture Packets That Are Being Blocked On Your System?

 

I get this question a lot and surprised I have yet to address it. Someone asked “will Wireshark capture the packets my firewall blocks.  Unfortunately, the short answer is “it depends on a few variables”.

I thought it would be helpful if I showed you how I would answer this question.

The methodology is pretty simple.

Get a baseline:

-          Disable firewall

-          Start capture with an icmp capture filter

-          Have another computer ping you

-          Stop capture and review results

Test

-          Enable firewall

-          Start capture with an icmp capture filter

-          Have another computer ping you

-          Stop capture and review results

Don’t worry about what I got, determine how your computer behaves.

Enjoy