Wireshark-users: [Wireshark-users] capturing before/after firewall in Linux
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "kapetr" <kapetr@xxxxxxxxx>
Date: Fri, 28 Dec 2012 18:58:59 +0100 (CET)
Hello,

I run Wireshark in Ubuntu 12.04.1 64b

If I see it correct - wireshark shows all incoming packet - even these, which are dropped by firewall (iptables).

1. is this so ?

2. by outgoing packets I expect it will be reversed: wireshark will not show packets dropped by FW  ?

[in other words: wireshark is bite between FW and NIC driver ?] 

3. Is there a way to show in Wireshark ALL in/out packets AND mark (colorize) packets which are/will-be dropped by FW ?

[Wireshark would have to monitor also packets between FW and higher layer of system]

Thanks --kapetr