Hi Team,
If I have many appliances in my network as seen below for example. PC -> WSA -> Firewall1 -> Router -> Firewall2
And a request got blocked in Router or somewhere else. How can I find the exact part when the issue occurred, in another work, how can I know which appliance blocked the request.
There are usually few options depending on the exact behaviour of the network elements. First of all if you are lucky, you get a response packet back with an indication of the blockage (could be ICMP), which has the IP address of the blocking node.
Then if the nodes have management interfaces with statistics of some sort you can consult them directly to see if they increase when you send these blocked packets.
If that doesn't happen you wil have to go get a capture of the various network interfaces of the nodes to see if you can trace the packets that get blocked and see which node receives them but doesn't forward them.
Asked: 2020-01-06 20:01:32 +0000
Seen: 560 times
Last updated: Jan 07 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
