Wireshark position in stack versus local firewall

To be totally accurate Wireshark doesn't figure in the networking stack, the component that does that is WinPCap. There are some architecture diagrams on their site, but they don't really show where the drivers fit into the stack, and besides that they are woefully out of date (they list Win 95 through to Win XP as supported OS's).

WinPCap is an NDIS 5 driver so if you can find other documentation (from MS ??) showing where NDIS 5 fits in that might also help.

Other than that you might try the WinPCap support.

if I see the datagram in Wireshark on the local machine, can I be confident it is passed up all the way the IP stack to the application ?

No, because the packet could

• have the wrong destination MAC address and you see it only because the interface was put in promiscuous mode by Wireshark
• a wrong IP checksum and the OS would discard it
• be 'broken' in another way, and thus the OS drops it
• be dropped by the firewall (your assumption)

In the first three cases, you would see the frame in Wireshark, although the application never gets the UDP packet (we have had several similar issues in other questions). Please check if the OS shows an increasing number of dropped frames (netstat -s).

Regarding the firewall problem, see the answer of @grahamb.

There is a local firewall running on the server which is controlled by ActiveDirectory profile Administrators, I cannot disable it (temporarily),

Well, checking the firewall (config and logs) would have been the first thing I would have done ;-))

Regards
Kurt