Wireshark · Wireshark-users: Re: [Wireshark-users] Wireshark only capturing TCP handshake

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

Let me ask you: The firewall is on the troubled platform? And this firewall 
has rules for incoming non-local connections? Bet your firewall is interfering 
 in the network stack.

Thanx,
Jaap

John Temples wrote:
> I'm trying to capture some incoming HTTP connections with Wireshark
> 0.99.8 on a Windows Server 2003 system.  The only thing Wireshark
> captures is the three packets in the three-way handshake of the TCP
> connection; no other packets related to the connection are captured.
> However, the connection completes successfully.  No capture filter is
> active in Wireshark.
>
> When running Wireshark on the PC that originates the connection, the
> entire transaction is successfully captured on the originating PC.
>
> When the connection originates from a PC on the same LAN as the
> Windows 2003 Server system, Wireshark on the Windows 2003 Server
> system successfully captures the entire transaction.
>
> The problem only occurs when the connection originates from the
> Internet.  The LAN in question has a SonicWALL firewall with no
> special configuration.
>
> What could cause Wireshark not to see the entire connection?
>
> --
> John W. Temples, III