Home » Questions » Computers [ Ask a new question ]

Wireshark and Windows Firewall

Wireshark and Windows Firewall

If I block a port in the Windows Firewall, and then attempt a connection to that port from another PC, what should I expect to see in Wireshark?

Asked by: Guest | Views: 103
Total answers/comments: 2
Guest [Entry]

"Where is Wireshark running, on the destination machine or on the source machine? If it's running on the source machine I would expect to see behavior as in # 2. You should see the outgoing connection from the source machine in Wireshark but no return traffic. I'm curious, does the Windows Firewall send a RST when it blocks incoming connections or does it silently drop the connection?

Come to think of it, I might expect to see behavior as in # 2 on the destination machine as well due to the fact that the incoming connection has to be initiated before Windows firewall can do it's job. It can't block a connection that hasn't made it to the destination machine and up to layer 3 yet."
Guest [Entry]

You should receive an inbound connection attempt,because the firewall blocked the packets, so the machine will have no response to the request.