This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Greetings, in recent tshooting of a web application I have come across an issue where I do not see the SYN packet in the wireshark capture. In netstat I see the connection as Syn_Sent, however I don't see the packet in the wireshark capture. I do however see the capture in a netsh trace. Any idea why the packet isn't being captured with wireshark? Thanks in advance!

asked 19 Dec '14, 10:57

Ziggy's gravatar image

Ziggy
11112
accept rate: 0%

I have had this on Windows 7 when the local firewall was dropping packets silently. Try looking there (would probably be the same on linux)

(20 Dec '14, 14:46) DarrenWright

I actually first suspected windows firewall but I have turned it off in all network profiles with the same result. Thanks!

(23 Dec '14, 16:29) Ziggy

Please read the questions with the following tags:

outgoing or outbound

http://ask.wireshark.org/tags/outgoing/

Usually the reason for this is some software on the capturing system (Enpoint Security, VPN, IPS, etc.) that prevents Wireshark from seeing outgoing/outbound packets. You'll find all the details in the other questions and answers.

Regards
Kurt

permanent link

answered 27 Dec '14, 08:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×55

question asked: 19 Dec '14, 10:57

question was seen: 1,887 times

last updated: 27 Dec '14, 08:38

p​o​w​e​r​e​d by O​S​Q​A